I bricked an Acer Liquid Z530 smartphone by trying to flash TWRP on it, unbricked it with SP Flash Tool, restored the original official firmware and rooted it.
A relative of mine has an Acer Liquid Z530 model T02 low-end smart phone running Android 5.1. The phone said "no space left" on the internal memory, although it has a 32 GB micro SD card to store images and videos on.
Disk Usage (available on F-Droid) showed that of the 3.2 GiB accessible internal memory, 3.1 GiB were in use by "System data".
Via ADB I got the same information:
shell@acer_T02:/ $ df Filesystem Size Used Free Blksize /system 3.0G 2.6G 473.2M 4096 /data 3.2G 3.1G 109.9M 4096 /storage/sdcard1 3.2G 3.1G 59.9M 4096 /mnt/media_rw/sdcard0 29.8G 98.6M 29.7G 32768
More information were not available because the phone was not rooted and I could not access the partition for examination.
- How to brick the phone
- Recovering from boot loop
- Installing original firmware
- Installing TWRP
- Cleanup
- Findings
How to brick the phone
Rooting an Android Phone involves downloading Chainfire's SuperSU which contains an su binary and an app that shows a confirmation screen whenever super user rights are requested.
The su binary can only be installed in recovery mode, usually with a recovery manager like TWRP because the normal stock recovery tools only allow installation of signed .zip files.
Installation of TWRP is easy: Unlock the bootloader and then install TWRP by running
$ fastboot flash recovery twrp-1.2.3.img $ fastboot reboot
I downloaded the unofficial TWRP for Z530, ran the steps above and the phone was stuck in a boot loop. It started up for about 5 seconds and then rebooted.
Recovering from boot loop
It turns out that low-price android devices often are based on MediaTek chips/boards, and those want to be flashed with their own tool: SP Flash Tool.
SP flash tool does not work with the official
Z530 firmware provided by Acer
(OS_Acer_AV0L0.1.034.00.WW.GEN1_A51L_A.zip)
but needs a special crafted
Acer Liquid Z530 T02 Stock Firmware (Flash File)
file
that can be
downloaded from AndroidMTK.com.
(Acer_Liquid_Z530_T02_MT6735_07192017_5.1.zip)
I installed SP flash tool on Windows (it does not work on Ubuntu 18.04 [kernel too old] and neither on Debian unstable [libpng12.so.0 missing]) and had to install all of the firmware parts. Just flashing the boot image did not work, it led to a boot loop of 30 seconds.
Following the how to flash instructions is important:
- Remove battery from phone
- Do not connect your phone to computer yet
- Do all the settings in SP flash tool
- Click download
- Now connect the phone via USB
- Flashing will start (may take some time until you see something in flash tool)
After the new firmware had been flashed onto the Z530 (and all user data had been lost), it booted up again and I could select the language.. chinese or english :/
Installing original firmware
After getting the phone to start up, I wanted the German language back.
I downloaded the official Z530 firmware provided by Acer (OS_Acer_AV0L0.1.034.00.WW.GEN1_A51L_A.zip), copied it onto the micro SD card and then started the phone in official recovery mode by pressing Power and Volume up for ~ 15 seconds until the green recovery mode screen was visible.
After selecting the .zip file for recovery I got an error message:
Opening update package...
Installing update...
This package is for "WW_GEN1" sku; this is a "AAP_SUN".
Installation aborted
AAP is "Asia PAcific", and the German firmware could not be installed onto that one :/
The SKU or "Carrier ID" can be changed:
The Acer Z530 service manual
page 10 shows a Switch Carrier ID
application that can be used.
Unfortunately this app was not available and I could
not access is via the #2237243# dial code.
I tried to find a SP flash tools compatible german firmware file (or at least one with WW_GEN1) and got hold of FirmwareX.Net_Acer_AV0L0_Z530_1.025.00_WW_GEN1_MT6735.rar but that one could not be flashed at all.
I was lost until I remembered that I only needed a recovery tool that did not do such silly SKU/CID checks.. TWRP!
Installing TWRP
I already knew that flashing the recovery "partition" with fastboot would not work, and I knew that flashing with SP flash tools did work.
In the extracted Acer_Liquid_Z530_T02_MT6735_07192017_5.1.zip I replaced recovery.img with the TWRP image file from unofficial TWRP for Z530. Then I used SP flash tool to only flash the recovery partition, and that worked fine!
I booted up the phone into recovery mode by keeping Power + Volume Up pressed and was greeted with the TWRP splash screen.
TWRP had no problems flashing the WW_GEN1 firmware over the AAP_SUN one. Now I could finally select "German" as language.
Rooting
With TWRP working, I could easily install the SuperSU zip file via recovery mode and had root access, which finally let me inspect the "system data" partition.
Cleanup
The Acer stock firmware comes with many unneeded pre-installed applications, and I used adb shell + root to get rid of them by finding the package name with
$ pm list packages $keyword
and then removing the application with
$ pm uninstall $packagename
Some could not be removed at all despite root access, so I disabled them with
$ pm disable $packagename
After removing and disabling those packages, /storage/sdcard1 (a.k.a /data) was still pretty full:
655 MiB /data/data/com.android.providers.downloads 656 MiB /data/dalvik-cache 500 MiB /data/app 96 MiB /data/app-lib
I deleted all download files and everything in app-lib except PreinstallProvider-Acer_58.
As result, the data partition has 1.32 GiB of free space now:
Findings
Mediatek Engineer mode
You may start the "engineer mode" via adb shell:
$ am start -n com.mediatek.engineermode/com.mediatek.engineermode.EngineerMode
Switch Carrier ID
The official German Z530 firmware from Acer's site did contain the "Switch CID" app. It's hidden in the com.cci.nvramapp package and can be started with the dial code or adb shell:
$ am start -n com.cci.nvramapp/com.cci.nvramapp.NvRamActivity
Disable "Left Page"
The unnerving "Acer Left page" home screen can be disabled by:
F-Droid: Der Erweiterung wurden keine Sonderrechte erteilt
You need to install the F-Droid service extension via recovery/TWRP and not just via F-Droid itself.