April 14, 2018 PARTHASARATHI PANDA
Today you will learn an interesting topic about manual erasing the FRP using SP Flash Tool but before you format Factory Reset Protection FRP HEX address, it's very important to know the perfect EMMC HEX address and length of FRP of the Android smart phone. So here you will know how to get the FRP address and length in the EMMC and then you can format phone using the same address to remove FRP lock of your phone.
How to Get EMMC Information:
To get the EMMC info or EMMC information you need to use any tool that support MediaTek read info and supports all latest mediatek MTK chip-sets. You can use Miracle Box V2.54 which is working without Box [Download Here] to read EMMC info to get the FRP address and length. To format FRP lock you can use Smartphone Flash Tool or SP Flash Tool, see the below details to know how remove FRP lock by formatting with SP Flash Tool.
 |
| How To Get The EMMC FRP Base Address and Length [HEX] Miracle Box |
For Example:
Here is a phone with MediaTek MT6753 runs on Android 6.0 with so and so manufacturer and brand, after readinfo with Miracle Tool v2.54 we get the following EMMC information and in this EMMC info you will get the FRP begin address and length, just have look below.
MediaTek MT6753 EMMC Info:
PROINFO BaseAddr:0x80000 Size:0x300000
NVRAM BaseAddr:0x380000 Size:0x500000
PROTECT1 BaseAddr:0x880000 Size:0xA00000
PROTECT2 BaseAddr:0x1280000 Size:0xA00000
LK BaseAddr:0x1C80000 Size:0x80000
PARA BaseAddr:0x1D00000 Size:0x80000
BOOT BaseAddr:0x1D80000 Size:0x1000000
RECOVERY BaseAddr:0x2D80000 Size:0x1000000
LOGO BaseAddr:0x3D80000 Size:0x800000
EXPDB BaseAddr:0x4580000 Size:0xA00000
SECCFG BaseAddr:0x4F80000 Size:0x80000
OEMKEYSTORE BaseAddr:0x5000000 Size:0x200000
SECRO BaseAddr:0x5200000 Size:0x600000
KEYSTORE BaseAddr:0x5800000 Size:0x800000
TEE1 BaseAddr:0x6000000 Size:0x500000
TEE2 BaseAddr:0x6500000 Size:0x500000
FRP BaseAddr:0x6A00000 Size:0x100000
NVDATA BaseAddr:0x6B00000 Size:0x2000000
METADATA BaseAddr:0x8B00000 Size:0x2500000
SYSTEM BaseAddr:0xB000000 Size:0x90000000
CACHE BaseAddr:0x9B000000 Size:0x19000000
USERDATA BaseAddr:0xB4000000 Size:0x692B80000
FLASHINFO BaseAddr:0x746B80000 Size:0x1000000
>>Done.
Just check the above bold line which contains FRP base address and size, then you can use the same details in SP Flash Tool and format the FRP lock, to format with flash tool please see the below example.
Format FRP Lock With SP Flash Tool:
 |
| How to format FRP lock using SP flash tool |
- So now we got the FRP Address and length which is (FRP BaseAddr:0x6A00000 Size:0x100000)
- Now open SP flash tool and go to Format Tab
- Then select "Manual Format Flash" and give the begin address and length to format.
- Here we have begin address 0x6A00000 and length 0x100000
- Enter the begin address [HEX] and Format Length [HEX]
- Then click on Start button and connect the switched off phone to PC.
