FRP and SP Flash Tool Guide

FORMAT VERSION
1- open Sp Flash Tool And Select Scatter File
2- go To Format Tab And Select Manual Format Flash
Open Your Scatter File And Check Address
And Add >Bein Address 0x6A00000
And Add >Format Length 0x100000
3- Now Press Start And Connect Mobile With Pc
4- After Done Disconnect Usb Cable And Disconnect Battry
And Insert Battry And Power On Phone

Learning Guide — MT6761 scatter, FRP and SP Flash Tool (Educational)

Purpose: This concise learning guide step-by-step reference so you can study how MediaTek scatter files work, where FRP fits, and how SP Flash Tool uses the scatter — strictly for educational and backup testing on devices you own. This guide avoids instructions that would assist bypassing security on devices you do not own.

Audience: technicians, hobbyists, and learners who want to understand MediaTek scatter layouts and safe SP Flash Tool workflows.

Table of contents

• 1) Safety, legality and prerequisites
• 2) Quick glossary
• 3) What is a scatter file? (structure explained)
• 4) Partition map (summary & neighborhood of FRP)
• 5) What is FRP and how Android uses it
• 6) SP Flash Tool — how it reads and uses the scatter
• 7) Creating blank frp.bin files (safe test files)
• 8) Making a learning scatter (showing FRP in SPFT)
• 9) Safe SPFT operations you should practice (readback & backups)
• 10) Best practices and recommended workflow
• 11) Appendix A — useful snippets and reference material
• 12) Appendix B — PowerShell commands to create blank files
• 13) Appendix C — Visual diagrams

Page 1

1) Safety, legality and prerequisites

Important disclaimer: Factory Reset Protection (FRP) is an anti-theft feature. This guide does not provide instructions to bypass FRP on devices you do not own. Use the steps here only on devices you legitimately own and for learning purposes.

Prerequisites:

• A dedicated test device / backup phone (recommended). Do not experiment on your daily phone.
• A computer (Windows is common for SP Flash Tool)
• SP Flash Tool (official, appropriate version)
• USB drivers for your device (e.g., VCOM/MTK drivers)
• A copy of the scatter file for your device (you already have **MT6761_Android_scatter.txt**)
• Basic familiarity with command line (for creating a blank .bin)

Back to top

Page 2

2) Quick glossary

Scatter file

A YAML-like text file describing partition names, offsets and sizes for eMMC/UFS flash. SPFT and other tools use it to map files to partitions.

FRP

Factory Reset Protection (stored in a small partition). Android checks this during initial setup to prevent unauthorized reuse.

SP Flash Tool (SPFT)

A popular flashing tool for MediaTek devices that reads scatter files to perform read/write/format operations.

Readback

SPFT feature to dump (backup) a partition to a file.

Format (Manual)

An SPFT feature that erases a specified address range on the flash. It is dangerous if used incorrectly.

Back to top

Page 3

3) What is a scatter file? (structure explained)

A scatter file is a human-readable mapping of partition metadata. Each partition block typically contains:

• partition_index: numerical index
• partition_name: logical name used by the OS
• file_name: filename associated when flashing
• is_download: whether SPFT will show/attempt to flash the partition by default
• linear_start_addr / physical_start_addr: start address in eMMC (hex)
• partition_size: size in hex
• other flags: operation_type, is_reserved, boundary_check, etc.

Example (frp entry):

- partition_index: SYS6
  partition_name: frp
  file_name: frp.bin
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x1888000
  physical_start_addr: 0x1888000
  partition_size: 0x100000  # 1 MB
  operation_type: INVISIBLE

The important idea: the scatter does not contain partition contents — it only points to where they live and what file (if any) should be flashed there.

Back to top

Page 4

4) Partition map — summary & neighborhood of FRP

Below is the concise map for SYS0 → SYS10 (start, end, size). These were taken from your scatter.

Index	Partition	Start (hex)	End (hex)	Size (hex)	Size (MB)	Note
SYS0	preloader	0x0	0x7FFFF	0x80000	0.5	Boot preloader
SYS1	pgpt	0x0	0x7FFF	0x8000	0.03	Partition GUID/table
SYS2	boot_para	0x8000	0x107FFF	0x100000	1.0	Boot parameters
SYS3	proinfo	0x108000	0x407FFF	0x300000	3.0	Device info (IMEI) — protected
SYS4	para	0x408000	0x48FFFF	0x80000	0.5	Misc params
SYS5	expdb	0x488000	0x1887FFF	0x1400000	20.0	Debug / crash logs
SYS6	frp	0x1888000	0x1987FFF	0x100000	1.0	Factory Reset Protection
SYS7	nvcfg	0x1988000	0x3987FFF	0x2000000	32.0	Radio calibration — protected
SYS8	nvdata	0x3988000	0x7987FFF	0x4000000	64.0	Network/radio data
SYS9	md_udc	0x7988000	0x9021FFF	0x169A000	22.6	Modem firmware
SYS10	metadata	0x9022000	0xB021FFF	0x2000000	32.0	Filesystem metadata

Visual neighborhood:

Because FRP sits between larger partitions (expdb and nvcfg), a misaligned erase or incorrect address can corrupt adjacent data (e.g., modem calibration). That’s why scatter files typically mark FRP as hidden/non-downloadable by default.

Back to top

Page 5

5) What is FRP and how Android uses it

FRP (Factory Reset Protection) is a flag/area that ties the device to the last Google account after a factory reset. During the initial setup after a reset, Android checks FRP; if it’s flagged (requires verification) the setup will request Google credentials.

The **frp** partition is typically small (1 MB here) and purposely set **is_download: false** in the vendor scatter to avoid accidental overwrites.

Why it matters for learners: understanding where FRP lives and how the boot process references it helps you make safer choices when manipulating firmware and backups. But remember: intentionally bypassing FRP on a device you don’t own is illegal in many jurisdictions.

Back to top

Page 6

6) SP Flash Tool — how it reads and uses the scatter

Key SPFT workflows:

• Load scatter: SPFT parses the scatter and shows partitions with associated file names.
• Download tab: Partitions marked is_download: true appear and will be flashed if you press Download.
• Readback: Allows you to dump (backup) partition contents by specifying start + length and an output filename.
• Format (Auto/Manual): Erases data on the eMMC; manual format requires explicit start address and length; dangerous if used incorrectly.

Flags that affect SPFT behavior:

• is_download: true/false — visible vs. hidden in the Download tab.
• operation_type — e.g., INVISIBLE, UPDATE, BOOTLOADERS, PROTECTED — informs SPFT how to treat the partition.

Back to top

Page 7

7) Creating blank frp.bin files (safe test files)

You may want a placeholder **frp.bin** of the exact partition size for testing how SPFT recognizes it. Below are cross-platform ways to make a blank (zeroed) binary file.

Linux / macOS (Terminal):

# 1 MB
dd if=/dev/zero of=frp.bin bs=1M count=1

# 2 MB
dd if=/dev/zero of=frp_2mb.bin bs=1M count=2

Windows (PowerShell):

# 1 MB
fsutil file createnew frp.bin 1048576

# 2 MB
fsutil file createnew frp_2mb.bin 2097152

Python (cross-platform):

size_bytes = 1024 * 1024  # 1 MB
with open("frp.bin", "wb") as f:
    f.write(b"\x00" * size_bytes)

# For 2 MB, multiply by 2

Note: Blank files are filled with zeros. They are useful for testing that SPFT will accept a file of the exact size the scatter expects. Do not flash such a file onto a production device unless you understand the consequences.

Back to top

Page 8

8) Making a learning scatter (showing FRP in SPFT)

Vendor scatters typically hide FRP to avoid accidental writes. For learning, you may want to copy the original scatter and create a modified version that shows FRP in the Download tab only for testing on a device you own.

What to change (educational):

- partition_index: SYS6
  partition_name: frp
  file_name: frp.bin
  is_download: true           # show in SPFT Download tab (learning only)
  operation_type: UPDATE      # visible like other update partitions
  linear_start_addr: 0x1888000
  partition_size: 0x100000

Recommended workflow:

1. Duplicate the original scatter file — keep the original untouched.
2. Edit the copy to change only is_download and operation_type (as above).
3. Load the modified scatter into SPFT — observe that FRP now appears like other partitions.
4. Do NOT press Download on a device you rely on — use a test device or only inspect how SPFT responds.

Back to top

Page 9

9) Safe SPFT operations you should practice

Practicing non-destructive operations is the best learning approach:

• Readback & Backups: Use Readback to dump proinfo, nvcfg, and other protected partitions to files. Keep secure backups.
• File checks: Place your blank frp.bin next to the modified scatter and reload. SPFT will indicate whether the file is present and match the specified length.
• Simulate: On a test unit, try loading the modified scatter and doing a Readback of FRP to see a dump — this is read-only and safe if done properly.
• Avoid Manual Format: do not use manual Format on production devices. If you must practice Manual Format, do so on an expendable test board where losing data won’t be a problem.

Back to top

Page 10

10) Best practices and recommended workflow

• Always keep a copy of the original scatter and original backups of proinfo, nvcfg, nvdata.
• Use a test device dedicated for learning.
• Keep a log of actions (what scatter you used, what file names and timestamps) so you can roll back.
• For locked devices where you are the legitimate owner, prefer account recovery and OEM support channels rather than overwriting protection partitions.
• When in doubt, stop and ask an authorized service center.

Back to top

Page 11

11) Appendix A — useful snippets and references

A. Example FRP scatter block (original vs. learning)

Original (vendor):

- partition_index: SYS6
  partition_name: frp
  file_name: frp.bin
  is_download: false
  operation_type: INVISIBLE
  linear_start_addr: 0x1888000
  partition_size: 0x100000

Learning copy (safe testing on your own hardware):

- partition_index: SYS6
  partition_name: frp
  file_name: frp.bin
  is_download: true
  operation_type: UPDATE
  linear_start_addr: 0x1888000
  partition_size: 0x100000

B. Commands to create blank files (recap)

• dd if=/dev/zero of=frp.bin bs=1M count=1 (Linux/macOS)
• fsutil file createnew frp.bin 1048576 (Windows PowerShell)
• Python snippet shown above

Back to top

Page 12

12) Appendix B — PowerShell commands to create blank files

Here’s a quick reference for generating different file sizes with PowerShell. The syntax is:

fsutil file createnew <filename> <size_in_bytes>

Since 1 MB = 1,048,576 bytes, multiply by the number of MB you need.

SizeBytes	Command
1 MB	fsutil file createnew frp_1mb.bin 1048576
2 MB	fsutil file createnew frp_2mb.bin 2097152
3 MB	fsutil file createnew frp_3mb.bin 3145728
4 MB	fsutil file createnew frp_4mb.bin 4194304
5 MB	fsutil file createnew frp_5mb.bin 5242880
6 MB	fsutil file createnew frp_6mb.bin 6291456
7 MB	fsutil file createnew frp_7mb.bin 7340032
8 MB	fsutil file createnew frp_8mb.bin 8388608
9 MB	fsutil file createnew frp_9mb.bin 9437184
10 MB	fsutil file createnew frp_10mb.bin 10485760

These files are empty placeholders filled with zeros, suitable for learning and testing in SP Flash Tool.

Back to top

Page 13

13) Appendix C — Visual diagrams

A. Boot & FRP verification flow

Power On → Preloader (SYS0) → LK (SYS22) → Boot_a (SYS24) → Android Init

   │
   └─> Android Init reads FRP (SYS6 @0x1888000)
        │
        ├─ If FRP flag set → Setup Wizard asks Google login
        └─ If not set       → Normal boot continues

B. Partition neighborhood diagram

┌───────────────┐ 0x0488000
│ expdb (20 MB) │ SYS5
└───────────────┘ 0x1887FFF
┌───────────────┐ 0x1888000
│ frp (1 MB)    │ SYS6
└───────────────┘ 0x1987FFF
┌───────────────┐ 0x1988000
│ nvcfg (32 MB) │ SYS7
└───────────────┘ 0x3987FFF

These diagrams help you visualize how FRP fits into the boot chain and the physical eMMC address space.

Back to top

Page 14

summarize preview