---
title: "Unbrick \"Cannot load Android system\""
date: 2022-05-10T09:52:39+02:00
draft: false
---

Disclaimer: I have no idea on which phones it works,
it might actually brick your phone even more, etc.
If in doubt, don't listen to me.

Short answer:
- enter fastboot (depends on your phone)
- create an 8KB empty file - `truncate -s 8K file`
- flash it to `para`/`boot_para`/sometimes `misc` - `fastboot flash para file`
- reboot

Long answer - a short tale about living with a broken phone:

Honestly, this might not even apply to you. There's the "Try again" option.
But, you see, I have a broken power button and couldn't select it...
I've been doing some software patches to my phone to mitigate this hardware issue,
most notably making [a few patches][1] to my phone's bootloader, incl.
one that makes it boot on plugged USB cable, because sadly on this phone it's
not a togglable option, like others have. (`fastboot oem off-mode-charge 0`)

Unfortunately, the patches did not help this time. I was presented with
two options and no way to pick either of them. Tried disconnecting my battery
and connecting it back, to no avail - bootloader just skipped straight to recovery,
completely ignoring the volume buttons. Making matters even worse, the recovery
didn't handle USB in any way - no fastbootd, no adb, no anything. Just the screen
of doom and my phone lying to my face with the ominous "Cannot load Android system".

After trying all the simple solutions, I realized my only hope was to
patch the bootloader again (lol) and make it boot regular boot.img.
To make stuff a bit easier, I focused first on getting working fastboot;
from there I can just override the bootloader again and reboot without
having to use the dreaded Smart Phone Flash Tool, just `fastboot flash lk lk.img`.

So... I opened Ghidra alongside MediaTek's Little Kernel-based bootloader code,
generously leak^Wopen-sourced by Umidigi with the Linux sources and other stuff.
At first I tried to find stuff related to the actual issue itself - `wipe`, `erase`,
anything like that, but couldn't find anything meaningful. Ended up spending multiple
hours trying to map the C code onto functions Ghidra was showing me, expecially that
some of them were so highly optimized, that the decompiler was completely lost.
Fortunately, it yielded some nice results - at the end of `mt_boot_init` there was
a following snippet:
```c
        /* Will not return */
        boot_linux_from_storage();

fastboot:
        target_fastboot_init();
```

This meant that if I'm lucky, I can get to fastboot with just one simple patch,
replacing the branch instruction to `boot_linux_from_storage` with a NOP or two.
And lucky I was, because a while later I had [the patch][2] ready and it worked!
Less fortunately, removing that call meant that it couldn't boot *any* Linux,
and the Android recovery is one too. My workaround turned out to be another laptop
with SPFT that reflashed only the `lk` partition - seems a bit pointless, but
it allowed me for faster prototyping, because I could do most of the stuff from
my Linux workstation and only use Windows for clicking one button.

What followed was a lot of trial and error with changing various things,
including trying to repack the recovery - turns out [magiskboot][3] can be ran
on a regular Linux machine and is _really_ good at its job; you can just unpack
the Magisk .apk file and run `lib/x86_64/libmagiskboot.so`.
Sadly, I didn't get much further with that, so I gave up on experimentation
and opened [Android Code Search][4] in hopes of finding something useful.

From perspective, I wish I did that sooner, because only after a few minutes
of looking around the code, I found [bootloader_message.cpp][5] which revealed
that the bootloader uses the `misc` partition to communicate with recovery.
The partition wasn't there on my phone, but now that I knew where to look,
I opened the recovery executable from my phone in Ghidra and found out that MTK
uses the name `para` instead, for some reason. With all that, I ensured that
making the partition empty [wouldn't break anything][6] and just flashed it.

With all that, after a few days of messing around, I finally booted my phone
(and promptly dropped it in the bathtub the same day, causing it to bootloop
again before I managed to backup any data from it :) )
Fortunately, it managed to survive and serves me as a backup phone to this day.


[1]: https://github.com/ptrcnull/umidigi-f2-patches
[2]: https://github.com/ptrcnull/umidigi-f2-patches/blob/master/force_fastboot.patch
[3]: https://topjohnwu.github.io/Magisk/tools.html
[4]: https://cs.android.com/
[5]: https://cs.android.com/android/platform/superproject/+/master:bootable/recovery/bootloader_message/bootloader_message.cpp
[6]: https://cs.android.com/android/platform/superproject/+/master:bootable/recovery/bootloader_message/bootloader_message.cpp;l=142