Help with rooting Aligator S5065 Duo MT6580 Android 7.0 - Android Q&A, Help & Troubleshooting

I need help to root my Aligator S5065 Duo phone. It ha Andoid 7.0 and the chipset is Mediatek MT6580.
Here is some info from the phone:
BB Chip : mt6580
MS Board. : ALIGATORS5065
Build Time : Tue Jan 23 15:35:41 CST 2018
Krenel Ver. : 3.18.35+ ([email protected]) (gcc version 4.8 (GCC)) #2 SMP PREEMPT Tue Jan 23 16:11:14 CST 2018
Android Ver. : 7.0
SW Ver. : alps-mp-n0.mp2-V1-droi6580.weg.n
Custom Build Verno. : unknown
IMEI1 : XXX
IMEI2 : XXX
Modem Ver. ALIGATOR_S5065_OS_1.1_2018 0123
Bar code : 010901MT000000000000003891_155648
The idea was:
1) make a full backup using MTK Droid Tool
2) flash TWRP using SP Flash Tool
3) boot TWRP and install Magisk
Problems:
1) MTK Droid Tool v2.5.3. doesn't support this chipset and I didn't found a newer version - so no full backup
I've tried to download a stock ROM or a full backup.
I have found MT6580__ALIGATOR__ALIGATOR_S5065__alps-mp-n0.mp2-V1_droi6580.weg.n__Android_7.0.ispff but it seems to need Infinity CM2 Dongle for flashing, which I don't own.
I have also found ALIGATOR S5065 – 7.0_MT6580_WL581M.LG.ALIG.HB.N.F.S12.B18.0927.V3.02_OS_1.1_20170927.zip which seems to be usable but not exactly the same as I have in my phone, at least it contains a scatter file. With the help of this scatter file I have I've read back my phone but the read imgs are considerably bigger, than the original ones in the zip - that doesn't seem right?
2) I have downloaded TWRP_3.2.3-0_20180803_UNOFFICIAL_MT6580_N.zip which should be a TWRP recovery for my chipset and the same kernel version, so I hoped it could work. But when trying to flash it with SP Flash Tool I get "PMT changed for the ROM" error message. The suggested solution for this error seem to be very risky (formating the phone, atc.), so I didn't dare to try ...
Now I'm stuck and I don't know how to proceed.
Any help would be really appreciated

---

Some progress:
I got a custom TWRP recovery image from Matty1993 <- thank you very much
I flashed it using adb and fastboot:
adb devices - successfully listed my device
adb reboot bootloader
fastboot flash recovery c:\adb\recovery.img - got this error message: "FAILED (remote: 'not allowedin locked state')"
Locked bootloader, unlocking ...
fastboot flashing unlock
- (bootloader) Start unlock flow
- OKAY [ 18.800s]
- Finished. Total time: 18.816s
Flashing the recovery.img
fastboot flash recovery c:\adb\recovery.img
Sending 'recovery' (10226 KB) OKAY [ 0.359s]
Writing 'recovery' OKAY [ 0.640s]
Finished. Total time: 1.030s
Success
fastboot reboot-bootloader
Rebooting into bootloader OKAY [ 0.000s]
Finished. Total time: 0.016s
fastboot erase cache (I don't know if it was a good idea but it was in the tutorial, I was following)
******** Did you mean to fastboot format this ext4 partition?
Erasing 'cache' OKAY [ 0.109s]
Finished. Total time: 0.125s
fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.016s
Now when booting the phone complains:
Orange state
Your device has been unlocked and can't be trusted
Your device will boot in 5 seconds
In 5 second it starts to boot but it stays forever on the "POWERED BY android" logo
I can boot to TWRP recovery (also fastboot), so I did and flashed magisk (because the main goal was to root my phone) and selected to delete cache/dalvik.
I'm not able to switch off the phone, it reboots. I had tu pull the battery (luckily it's removable).
The phone info changed
BB Chip : mt6580
MS Board. : ALIGATORS5065
Build Time : Tue Jan 23 15:35:41 CST 2018
Krenel Ver. : 3.18.35+ ([email protected]) (gcc version 4.8 (GCC)) #2 SMP PREEMPT Tue Jan 23 16:11:14 CST 2018
Android Ver. : 7.0
SW Ver. : alps-mp-n0.mp2-V1-droi6580.weg.n
Custom Build Verno. : unknown
IMEI1 : unknown
IMEI2 : unknown
Modem Ver. ALIGATOR_S5065_OS_1.1_2018 0123
Bar code : unknown
The IMEIs and Bar code are now "uknown".
What did I wrong and what to do, to fix it?

---

forget MTK Droid Tool it is outdated and does not support scatter for devices > 4 GB. you can use SP Flash Tool for full ROM dump. First thing you should do is backup your nvram partition, hopefully it is not too late...
https://www.getdroidtips.com/backup-restore-imei-nvram-data-mediatek
If you already have backup of stock boot.img:
- copy file to /external_sd/TWRP/BACKUPS folder
- rename it to boot.emmc.win
- create a backup of current boot (just in case)
- restore renamed stock boot.emmc.win from TWRP
regarding boot stuck:
- Format Data and Wipe Cache from TWRP, reboot recovery, wipe again (Wipe -> Format Data -> type yes)
- reboot TWRP, check if /system /data and /cache is mounted/mountable (you should see folders or files inside)
- reboot system and wait 5 minutes, first boot may take a while because the data partition is forced encrypt
- if android is completely booted, check IMEI
Now, if your device is in good condition, reboot recovery and make a full TWRP backup.

---

Thank you very much for your help.
I did a dump before, using the SP Flash Tool and the scatter from the downloaded ALIGATOR S5065 – 7.0_MT6580_WL581M.LG.ALIG.HB.N.F.S12.B18.0927.V3.0 2_OS_1.1_20170927.zip file.
So I have a sort of a "backup"
Now I'm going to read and I'll report back how it went.

---

blakegriplingph said:
NVRAM data must have been wiped off somehow, as that's one reason as to why your serial numbers have gone kaput.
Click to expand...
Click to collapse
If this is the case, you can "download" (=flash) your backup files from SP Flash Tool. In scatter file change entries to "is_download: true". Open the edited scatter file with SP Flash Tool. Make sure you uncheck all checkboxes, except nvram, nvdata (and cache, if you still have problems with this partition). Double click on file name and select the file for each partition. Make sure EMMC_USER is selected. The file sizes must fit partition size. Do NEVER flash PRELOADER! Press start, then connect phone, then insert battery.
nvram.bin 5120 KiB (0x00500000)
nvdata.bin 32768 KiB (0x02000000)
cache.img 409600 KiB (0x19000000)
If done, hold Volume Up key while unplug + plug in USB cable, this will boot into recovery. Wipe Cache and Data

---

My sizes of the backup files:
nvram.bin 5 242 880 seems OK
nvdata.bin 33 554 432 seems OK
cache.img 419 430 400 bigger
Is there a way I can check the integrity of them before flashing?
And what when I get the "PMT changed for the ROM" error message?
I've attached the used scatter file

---

Should be fine if you use same scatter file used for read back. If you got "PMT changed" (probably wrong scatter file), you must restore all partitions (except preloader) with the exactly same scatter file you have created your backup. Then your phone should be restored to its original state no matter if scatter file was wrong. Once you get your phone in good condition, you can create your own scatter file with current partition layout from WwR MTK v2.30

---

Matty1993 said:
All good mate yeah orange state is because you unlocked bootloader and didnt factory reset [...]
If you still get dramas with orange state let me know ill manually patch the dm-verity out of your boot.img for you
Click to expand...
Click to collapse
Orange state just mean unlocked bootloader, you can't get rid of. Do not lock the bootloader again, just leave it orange state is fine...

---

I thought so and it doesn't really bother me

---

Matty1993 said:
Your device comes with out of the box encryption in your boot.img fstab your system path will be /dev/block/platform/mtk-msdc/******/msdc/by-name/system /system ext4 ro wait, "verify"
Click to expand...
Click to collapse
Zdendav said:
I did all the steps:
- wipe, format
- factory reset
hangs on the "POWERED BY android" logo, when trying to boot
- flashed boot.img in fastboot
- reboot
I was not fast enough to go onto TWRP, it tried to boot, hangs on the "POWERED BY android" logo
-reboot into TWRP
- wipe, format
- factory reset
still hangs on the "POWERED BY android" logo, when trying to boot
I can borrow exactly the same phone from a relative (fully working) - maybe I should do a full backup of it, then I'll have "clean" images of boot, recovery etc.
Meanwhile I did another full backup and this time I used WwR MTK v2.30 to create a correct scatter.
I attach both scatter files.
Click to expand...
Click to collapse
as @Matty1993 already figured out, your phone seems fine, just dm-verity prevents to boot because of recovery checksum mismatch. You have to disable dm-verity.
Install Disable_Dm-Verity_ForceEncrypt.zip from TWRP. This will patch your boot.img and modify fstab entries. Format Data, then use "Copy Log" option and upload recovery.log here

---

aIecxs said:
Should be fine if you use same scatter file used for read back. If you got "PMT changed" (probably wrong scatter file), you must restore all partitions (except preloader) with the exactly same scatter file you have created your backup. Then your phone should be restored to its original state no matter if scatter file was wrong. Once you get your phone in good condition, you can create your own scatter file with current partition layout from WwR MTK v2.30
Click to expand...
Click to collapse
I did try and I got the "PMT changed" even when I selected all partitons except preloader ..
I did borrow exactly the same phone from a relative and created a full backup and from it a proper scatter file. I compared both scatter files and there are differences (as expected)
I attach both scatter files
I don't know how to proceed.
1) Lock the bootloader?
2) Flash parts from the borrowed phone? Which parts?
PS I have also a backup of userdata taken in factory mode.

---

don't flash anything with SP flash tool, just see my previous post. boot + recovery + nvram are identical, but tee1 + tee2 + teeinfo missing, and metadata + userdata have different size. keep the backup created with scatter file from WwR_MTK this seems to be the right one

---

aIecxs said:
Install Disable_Dm-Verity_ForceEncrypt.zip from TWRP. This will patch your boot.img and modify fstab entries. Format Data, then use "Copy Log" option and upload recovery.log here
Click to expand...
Click to collapse
Done. Did it all in one go (without any reboot), then powered off.
Log is attached

---

aIecxs said:
don't flash anything with SP flash tool, just see my previous post. boot + recovery + nvram are identical, but tee1 + tee2 + teeinfo missing, and metadata + userdata have different size. keep the backup created with scatter file from WwR_MTK this seems to be the right one
Click to expand...
Click to collapse
Sorry I missed your post until I posted mine ...
I'll keep all backups until it's sorted out.
And thank you very much aIecxs and Matty1993 for all your help

---

thanks for the log. seems there is something wrong, maybe with TWRP or maybe with phone.
Code:
E:Primary block device '/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/userdata' for mount point '/data' is not present!
Failed to mount '/cache' (Invalid argument)
Error installing zip file '/external_sd/Disable_Dm-Verity_ForceEncrypt_04.03.19.zip'
Flash stock boot.img and stock recovery.img from fastboot. reboot into stock recovery. Wipe Data + Cache. reboot to bootloader. boot into TWRP from fastboot. copy log to sdcard and upload again. reboot your phone and wait 5 minutes.

---

I flashed the stock recovery and boot in fastboot in one go.
Then rebooted to recovery but there is only "Supported API: 3" in the lower left corner of the display and that's all.
What to do next?
Edit: It's even worse, I'm not able to enter fastboot, recovery etc., the phone doesn't react to the volume button and always show the orange message a boot to the Supported API: 3 screen.

---

This indicates something is wrong with cache partition. Usually a normal system boot from stock boot.img will fix this. If you can't enter fastboot mode, flash recovery from SP Flash Tool. Try this version it has changed fstab. This should fix the /data mount. Then you should be able to enter fastboot again.
Code:
[strike]/data ext4 /dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/userdata flags=encryptable=/dev/block/platform/mtk-msdc.0/by-name/metadata[/strike]
/data ext4 /dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/userdata flags=encryptable=/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/metadata
Regarding /cache try following from fastboot:
Code:
fastboot format:ext4 cache
after this wipe cache again from stock recovery (you can boot stock recovery from fastboot without flashing it). if cache still not mounted in TWRP, your only choice left is flash backup of cache partition from your friends phone from SP Flash Tool
edit: attachment deleted

---

Flashed your recovery, now it always boots into twrp, volume buttons still seem to not work, I'm still not able to enter fastboot.
Edit: I was able to enter fastboot by "adb reboot bootloader" when in TWRP, strangely "adb reboot fastboot" booted into TWRP.
I formatted the cache, rebooted into stock recovery, formatted the cache again.
Rebooted into TWRP, in file manager the cache is empty, in the mount menu I'm not able to tick any of the listed partitions to mount it ...
I'm not able to post the new log, it copies it to /data/media but in the file manager the location is empty ...

---

i have added some mount points, please download and flash again. you can copy recovery.log from adb
Code:
adb pull /tmp/recovery.log C:\adb\recovery.log
please post output of df and mount
Code:
adb shell
mount
busybox df -aT

---

/ # mount
rootfs on / type rootfs (rw,seclabel)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
/ # busybox df -aT
Filesystem Type 1K-blocks Used Available Use% Mounted on
tmpfs tmpfs 463204 44 463160 0% /dev
devpts devpts 0 0 0 0% /dev/pts
proc proc 0 0 0 0% /proc
sysfs sysfs 0 0 0 0% /sys
selinuxfs selinuxfs 0 0 0 0% /sys/fs/selinux
tmpfs tmpfs 463204 32 463172 0% /tmp
adb functionfs 0 0 0 0% /dev/usb-ffs/adb