I got a used Blackview BV4900S Android smartphone and wanted to prepare it properly so it can be used.
Reinstalling original firmware
Firmware download
The Blackview website does not have a download section: I had to contact customer support via e-mail (customerservice1@) to get the firmware file and installation tool.
They sent a link to the firmware file BV4900s_EEA_L620_V1.3_20220518V10 - uploaded to Mega instead of their own website... Another link was for the firmware install tool UpgradeDownload_R26.21.4101.7z. The instructions they sent were for a different tool, though.
Flash tool
The BV4900S has a Spreadtrum Unisoc SC9863A chipset, unlike the BV4900 and BV4900 Pro which both have a MediaTek chipset.
The official tool to flash .pac firmware files on Unisoc phones is SPD Flash Tool, the executable is named UpgradeDownload.exe.
On Windows 7 I had to install the Spreadtrum SPD drivers that I got from AndroidFileHost: SPD_Driver_R4.20.4201.zip. The SPD Flash Tool site has them as well, but their download was abysmal slow.
The official SPD version SPD_Upgrade_Tool_R27.23.1902.zip did not
work on my Windows 7 installation;
it failed with CFWDL-driver error
.
Instead I used the SPD version R26.21.4101 I got from Blackview,
which worked fine.
The installation steps were:
- Install SPD drivers
- Extract SPD Flash Tool and run UpgradeDownload.exe
- Load the .pac file
- Click the "Play" button in SPD Flash Tool
- On the off-state phone, hold Power and Volume Down with one hand and then plug in the USB cable.
- Flashing will start automatically; you will see a progress bar in the tool.
When loading a .pac file, SPD Flash Tool actuall extracts its contents into a subdirectory, in my case PAC_s9863a1h10_DownloadFiles_BV4900s_EEA_L620_V1.3_20220518V10_718_19C9C_0:
boot.img cache.img dtbo.img fdl1-sign.bin fdl2-sign.bin FileList.ini gnssbdmodem.bin gnssmodem.bin odmko.img PackInfo.csv persist.img PM_sharkl3_cm4_v2.bin prodnv.img s9863a1h10.xml SC9600_sharkl3_pubcp_modem.dat sharkl3_cm4.bin sharkl3_pubcp_deltanv.bin sharkl3_pubcp_DM_DSP.bin sharkl3_pubcp_LTEA_DSP.bin sharkl3_pubcp_nvitem.bin sml-sign.bin socko.img super.img teecfg-sign.bin tos-sign.bin u-boot-sign.bin u-boot-spl-16k-sign.bin unisoc_HD_720_1440_24bit.bmp 'unisoc_HD_720_1440_24bit.bmp(1)' userdata.img vbmeta_product.img vbmeta-sign.img vbmeta_system_ext.img vbmeta_system.img vbmeta_vendor.img
s9863a1h10.xml contains the partition list.
Rooting BV4900S
Being a cheap chinese smart phone, there is no Lineage OS port for it. So I had to take the stock firmware, but at least wanted root access to I could install an ad blocker.
I wanted to install Magisk to get root. The boot image was extracted by SPD Flash Tool, and the Magisk App was able to patch the boot image. But: Flashing the boot image is not possible.
Fastboot
I found two ways to access fastboot:
- Enable ADB via the Android system preferences developer settings. Then run adb reboot fastboot.
- When the phone is powered off, hold Power and Volume up until the Blackview logo appears. You are in recovery mode now. From there you can switch to fastboot.
Unlocking bootloader
Flashing the boot image fails because the boot loader is locked:
$ fastboot flash boot ../magisk_patched-26300_weTYA.img Sending 'boot_a' (65536 KB) FAILED (remote: 'Download is not allowed on locked devices') fastboot: error: Command failed
In Android developer settings I enabled "OEM unlocking" and then tried to unlock the bootloader, but all commands failed:
$ fastboot flashing unlock FAILED (remote: 'Unrecognized command flashing unlock') fastboot: error: Command failed $ fastboot flashing unlock_critical FAILED (remote: 'Unrecognized command flashing unlock_critical') fastboot: error: Command failed $ fastboot getvar unlocked unlocked: no
Other Spreadtrum devices could be unlocked by fetching some token and signing the custom firmware with it. The command does not work on this phone:
$ fastboot oem get_identifier_token ... OKAY [ 0.001s] finished. total time: 0.001s $ fastboot oem invalidcommand ... OKAY [ 0.001s] finished. total time: 0.001s
Blackview support says they do not support unlocking their devices. I asked on XDA for help but don't really expect any outcome.
For now I am stuck; the BV4900S cannot be unlocked.
USB IDs
dmesg output:
usb 1-2: new high-speed USB device number 63 using xhci_hcd usb 1-2: New USB device found, idVendor=18d1, idProduct=4ee8, bcdDevice= 4.04 usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-2: Product: BV4900s usb 1-2: Manufacturer: Chinoe usb 1-2: SerialNumber: BV4900sEEA00001817
usb 1-2: new high-speed USB device number 64 using xhci_hcd usb 1-2: New USB device found, idVendor=1782, idProduct=4ee0, bcdDevice= 4.14 usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-2: Product: Unisoc Phone usb 1-2: Manufacturer: Unisoc usb 1-2: SerialNumber: BV4900sEEA00001817