Target : MTK8735 , tablet. Operation : Read Info ( Full + Extended )
It read - Boot , Phone Info , Extended Info.
What included in extended info?
Modem info -
allow check and seek SAME models for NV/FW (even from DIFFERENT BRANDS!) HW Info - allow CHECK/SEEK/VERIFY Hardware info ( supported by phone HW ) -
allow check and seek SAME models for NV/FW (even from DIFFERENT BRANDS!) Code:
Operation : Check / Read Info [ v1.26 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
[AP] : Initial info read Ok!
Brand : Ursus
ProdName : Ursus TS170
ProdModel : Ursus TS170
Device : TS170
AndroidVer: 5.0
MTKxCPU : MT6735
MTKxPRJ : ALPS.L0.MP8.V1.1_FAJUE8735.6TB.4M.L
MODEM :
BaseBand : MT6735_S00_MOLY_LR9_W1444_MD_LWTG_MP_V1_P1_3G18_4G13720_1_lwg_n
EXTRA :
LCD : Not info available :(
LCD Res : 600x1024
TOUCH [0] : GSLX6XX
CAM [0] : gc2235_mipi_raw
CAM [1] : gc2355_mipi_raw
CAM [2] : gc0339_mipi_raw
CAM [3] : gc0310_mipi_yuv
MODEM : fajue8735_3g18_4g13720_v0.2
LOCALE : en_US zh_CN zh_TW es_ES pt_BR ru_RU fr_FR de_DE tr_TR vi_VN ms_MY in_ID th_TH it_IT ar_EG hi_IN bn_IN ur_PK fa_IR pt_PT nl_NL el_GR hu_HU tl_PH ro_RO cs_CZ ko_KR km_KH iw_IL my_MM pl_PL es_US bg_BG hr_HR lv_LV lt_LT sk_SK uk_UA de_AT da_DK fi_FI nb_NO sv_SE en_GB hy_AM zh_HK et_EE ja_JP kk_KZ sr_RS sl_SI ca_ES
Done!
Elapsed: 00:00:21
Reconnect Power/Cable!
NVRAM :
Now NVRAM saved as MODEM base.
Which allow NOT depend on PHONE MODEL. Need just find same alive NVRAM ( up to every character ) with same BaseBand version!
Code:
Operation : Read NVRAM [ v1.26 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
[Info] : BaseBand : MT6735_S00_MOLY_LR9_W1444_MD_LWTG_MP_V1_P1_3G18_4G13720_1_lwg_n
Read Ok, MT6735_S00_MOLY_LR9_W1444_MD_LWTG_MP_V1_P1_3G18_4G13720_1_lwg_n_eMMC.spnv saved
Done!
Elapsed: 00:00:17
Reconnect Power/Cable!
Repair Security : Real repair security 
Now it supported few different types of new MTK platforms.
Code:
Operation : Repair Security [ v1.26 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
IMEI [00] : 352378070009463
IMEI [01] : 352378070009471
Set IMEI [00] : 009964432190542
Set IMEI [01] : 009964432190559
Prepare finished. Security check required!
Wait for phone...
Phone found! [ 63 ]
Sync...
PostCheck Ok! Repair done!
Done!
Elapsed: 00:00:41
Reconnect Power/Cable!
Read Factory Firmware : Just a World First 
CM2 ONLY one tool, which can read Factory Firmware from MTK phones. It same as factory one 
Code:
Operation : Read Flash [ v1.26 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
Reading Flash Conent now ...
Brand : Ursus
ProdName : Ursus TS170
ProdModel : Ursus TS170
Device : TS170
AndroidVer: 5.0
MTKxCPU : MT6735
MTKxPRJ : ALPS.L0.MP8.V1.1_FAJUE8735.6TB.4M.L
MediaTek MT67xx [x64] : Normalize settings Ok
[Read Ok] : preloader_l781.bin
[Read Ok] : lk.bin
[Read Ok] : boot.img
[Read Ok] : recovery.img
[Read Ok] : logo.bin
[Read Ok] : secro.img
[Read Ok] : tz1.img
[Read Ok] : tz2.img
[Read Ok] : system.img
[Read Ok] : cache.img
[Read Ok] : userdata.img
[Read Ok] : intsd.img
[ScatCFG] : MT6735 / V1.1.2 / l781 / EMMC
FW Size : 1403 MiB
Scatter saved to : E:\MT6735__Ursus__Ursus TS170__TS170__5.0__ALPS.L0.MP8.V1.1_FAJUE8735.6TB.4M.L\
All done!
Done!
Elapsed: 00:05:00
Reconnect Power/Cable!
Factory Firmware Writing :
Just a World First Code:
Scatter Load Ok , BaseBand : MT6735 , Project : l781 , Storage : EMMC
Files found : 12 , Set to Flash : 11
Ready to Flash!
Operation : Flash [ v1.26 ]
======= Flash
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
ScatCFG : BaseBand : MT6735 , Project : l781 , Storage : EMMC
Setting : Flash Pre-Erase (Safe) : Enabled
Setting : AFF verify : Enabled
BL : Check HW compatibility
BL : BBID supported by BootLoader!
BL : Check eMMC compatibility
BL : Only one records found, and determined as universal
BL : eMMC supported by BootLoader!
BL : Flash Pre-Erase
Total blocks to Erase : 1
Erase : 0x0000000001C80000-0x00000001C0300000
Flash Pre-Erase Done, time used : 00:00:03
SecCfg Passed , 1799
BMT remark not need. Will skip
Sending Preloader ...
Use : preloader_l781.bin
Preloader Sent , Init passed
SecCfg Passed , 1799
PartCount : 0017
Update PMT by user request
Repartition Done!
Processing : Flash Write
Flash now : LK
Image Flash Ok
Flash now : BOOT
Image Flash Ok
Flash now : RECOVERY
Image Flash Ok
Flash now : LOGO
Image Flash Ok
Flash now : SECRO
Image Flash Ok
Flash now : TEE1
Image Flash Ok
Flash now : TEE2
Image Flash Ok
Flash now : SYSTEM
Image Flash Ok
Flash now : CACHE
Image Flash Ok
Flash now : USERDATA
Image Flash Ok
Flash now : INTSD
Image Flash Ok
Flash Write Done, time used : 00:07:47
Processing : Verify
Verify Passed : LK
Verify Passed : BOOT
Verify Passed : RECOVERY
Verify Passed : LOGO
Verify Passed : SECRO
Verify Passed : TEE1
Verify Passed : TEE2
Verify Passed : SYSTEM
Verify Passed : CACHE
Verify Passed : USERDATA
Verify Passed : INTSD
Data Verify Done, time used : 00:00:03
Update Mirror PMT
Update Done!
Update RomInfo done
Done!
Elapsed: 00:08:07
Reconnect Power/Cable!
Read PhoneBook : While others bla-bla about "they world first and unique" - we just making new features
Code:
Operation : Read UserData [ v1.26 ]
PhoneBook : Enabled
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
Step #1
Step #2
Read Ok, PhoneBook records extracted : 3
TXT Saved to : C:\MT6735_PhoneBook.txt
Write : 3
CSV Saved to : C:\MT6735_PhoneBook.csv
Write : 3
VCF Saved to : C:\MT6735_PhoneBook.vcf
Write : 3
VCFv3 Saved to : C:\MT6735_PhoneBook_v3.vcf
Done!
Elapsed: 00:00:23
Reconnect Power/Cable!
Reset UserLocks :
Without coments 
Code:
Operation : Clear UserLocks [Pin/Pwd/Pattern/FVLock/GoogleAcc] [ v1.26 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
LSSA Ok!
LSSW Ok!
LSSS Ok!
LSSG Ok!
LSSK Ok!
Security Settings : Clear Ok!
[Info] : Android 5.x / MT67xx : If phone stuck on "Logo"
1. Wait 2-3 minutes. Power Off phone by long press "Power" button
2. Power On phone again
3. Or wait up to 3-7 minutes, until phone start by itself
4. Also recommended reboot phone twice before start use it
Done!
Elapsed: 00:00:24
Reconnect Power/Cable!
Read PatternLock : Without coments Code:
Operation : Read PatternLock [ v1.26 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 63 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0xFF
BLVersion : 0x01
Preloader Status : Alive
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
Reading data ...
FS Size : 4096 MiB
Magic Ok
Mount point : /data
Get PatternLock ...
PatternLock Sequnce : 12456987
Done!
Elapsed: 00:00:29
Reconnect Power/Cable!
Repair Preloader :
While some blamers even don't know about such feature and make empty noise about "not possible" to repair
Code:
Operation : Init Preloader [ v1.26 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 62 ]
Sync...
Inital regs read done
Boot Info :
BB_CPU_ID : 6735
BB_CPU_HW : CA00
BB_CPU_SW : 8A00
BB_CPU_SB : 0000
BB_CPU_NM : [MediaTek] MT6735_S00
Processing BROM stage
SecCfgVal : 0x00000000
BromVersion : 0x05
BLVersion : 0xFE
Preloader Status : Not active (Erased)
Processing DA stage
DA Select done , sending
NAND_ID : 00000000000000000000000000000000
eMMC_ID : 5600017030303031E5D5063881B1C44E
DA Stat : v4.2 on BBID : 0x93
DRAM not initialized , configure DRAM Settings
DRAM EmiReq Ok , 0x00BC
DRAM Init Ok , 0x40000000
DA Sent. Configure setting now ...
DA started successuflly
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0070 , OEM : 0100
[eMMC] : FLASH_INF : 80001
[eMMC] : FLASH_CID : 70010056313030303806D5E54EC43281
[eMMC] : FLASH_LEN : 0x00000001C3000000
INT RAM : 0x00020000
EXT RAM : 0x40000000
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
SecCfg Passed , 1799
BL : BBID supported by BootLoader!
Flash Info :
FlashID [0] CID : 000000000000000000 , Name :
BL : Only one records found, and determined as universal
BL : Storage supported by BootLoader!
Sending BootLoader ...
Preloader Sent , Init passed
SecCfg Passed , 1799
PartTable Init Ok , Count : 18
All Done
Done!
Elapsed: 00:00:08
Reconnect Power/Cable!