Documentation & tools for hacking Qin (Duoqin) / Doov brand phones.

Support me on Ko-fi ☕

• Overview
  • Device compatibility
    • Officially supported
    • Works but no official support
    • Does not work
• Warning ⚠️ ⚠️ ⚠️
• Prerequisites
• Install the flashing tools
  • Create bootable USB stick
  • Boot from USB stick
  • General info about the Linux ISO
• Make a backup
  • Option 1 (Recommended): store backup on 2nd USB stick
  • Option 2: store backup on the live Linux environment
• Unlock the bootloader
  • For most models
  • For F21 Pro and similar models where “press volume up” doesn’t work
• Flash new ROM
• Enter fastboot
• Recover from backup
  • Recover stock ROM without affecting American bands or other partitions
  • Full recovery
• Remove TWRP from F21 Pro
  • Solution
• Flash American bands on F21 Pro
  • Flash
    • Option 1: Use Linux to rewrite IMEI & MAC
    • Option 2: Use Windows to rewrite IMEI & MAC
  • Verify
• Device button combinations
• Common errors
  • Error: write_sparse_skip_chunk: don't care size XXXXXXXXX is not a multiple of the block size XXXX
  • FAILED (remote: 'Erase is not allowed on locked devices')
  • FAILED (remote: 'This partition doesn't exist')
  • FAILED (remote: 'Not enough space to resize partition')
    • Solution
      • Option 1: Delete product partition
      • Option 2: Delete COW partitions
        • For cow partitions that are in slot a (e.g. system_a-cow)
        • For cow partitions that are in slot b (e.g. system_b-cow)
        • Finally
  • Dm-verity corruption
    • Solution
  • Orange state warning
  • Preloader - [LIB]: Status: Handshake failed
  • An error occured while extracting files. Command exited abnormally.
• Special Thanks

This guide has been written to walk the owners of Qin/Doov devices through flashing DumberOS (formerly Dumbdroid) or any other compatible ROM of their choice.

The guide assumes that you are using Windows 10/11. If you are using Linux, I trust your ability to figure out the OS specific parts on your own. If you are using macOS, good luck.

If you encounter any issues while following this guide, refer to the common errors section. If your issue isn’t listed there, please open a new issue in this repository and include a description of it along with the relevant logs.

The guide itself should work on most Qin and Doov devices. As for DumberOS support, it will depend on the device:

• Qin F21 Pro

• Qin F22 Pro

• Doov R77 Pro (R77c)

• Doov R77

• Doov R17 (Z17) Pro (3.5 inch screen)

• Dumber Mini

Some things may not work. Keys may not be mapped correctly, you will need to use a keymapper. Your experience will vary.

• Qin F25 Pro

• Doov R70 Pro

• Tiq Mini M5

• Tiq Mini M5s

• Qin F22¹ (see footnote)

• Do NOT use AI chatbots for this unless you want a bricked device.
• Do NOT skip making a backup. I cannot help you if you brick your device and do not have a backup.
• Do NOT delete or flash the preloader. Recovering from a broken preloader is extremely difficult, if not impossible. Especially without a backup.

Flashing your device can brick your phone if done incorrectly.
By following this guide, you agree to proceed at your own risk. I'm not responsible for any damage, data loss, or other issues that may occur.

1. A Qin or Doov brand phone.
2. A computer with at least 8GB² of RAM and three USB-A ports³ for running the flashing tools.⁴ (see footnote for Apple)
3. Two USB flash drives.⁵ Each having a capacity of 12GB or more.⁶ Alternatively, you could use only one flash drive if you have +16GB of RAM, check the note in Make a backup to learn more.
4. A data transfer USB A-C cable. Strictly A-C, not C-C. Make sure the cable you use is capable of transferring data, not just power.⁷ No adapters should be used with this cable, it needs to be connected directly to a USB-A port.

This has been by far the most difficult part of the process for most users. To simplify it I have created a customized Linux ISO that comes with the tools you need pre-installed. The OS you are using on your machine is irrelevant as it will not be affected.
The Linux ISO does not include SN Write Tool, which you will only need if you are flashing the American bands and for whatever reason you decide to not go with the Linux way of rewriting the identifiers. You will have to use Windows for that part if you need it.

1. Download the Linux ISO that comes pre-installed with the tools.
2. Download and install Rufus.
3. Launch Rufus and insert a USB stick. Your USB drive should show up in the Device field.
4. Click SELECT. Choose the Linux ISO and click Open to confirm.
5. If you’ve already tried Rufus and the USB stick failed to boot on your system, change Partitioning scheme to GPT and check that Target system is set to UEFI (non CSM). This works on modern systems that disable legacy compatibility.
6. Click START. Click OK or Yes on any prompts and popups.
7. The image will now be written to the drive. Once it is done, the status bar will say READY. You can then click CLOSE to finish the process.

There are two ways you could go about this.

Option 1: Connect your USB stick if it is not already. Hold the Shift key while pressing the Restart button and wait until Windows prompts you to choose an option. Click Use a device and then click Removable Device. Windows should now reboot into the USB drive.

Option 2: Connect your USB stick if it is not already. Reboot your computer and go into the BIOS. Disable Secure Boot and change the boot order to make the USB drive the first option. Save and reboot. These are some general instructions. This method will depend on your computer model, so you will have to look it up if you don't know how to do it.

Finally: When the computer reboots, you will be greeted with a few options. Press enter on the first option Start Linux Mint (If you have already done that before and ran into issues, then try picking Compatibility Mode instead). Once you have booted into Linux, you will be shown a login screen. Insert the password user and hit enter.

• Password for logging in to the live Linux environment is user.
• There is no persistence. Meaning that any data you store on the Linux ISO itself will be lost after a reboot.
• Wi-Fi may not work on some computer models due to unavailable proprietary drivers. In which case you will have to either use an Ethernet cable or transfer data via an external drive.
• Any command you run in the terminal is case-sensitive, so type it exactly as instructed.
• Includes empty vbmeta file, American bands partitions, python script to force fastboot mode, bash script to rewrite IMEI & MAC, and an F21 Pro boot image without TWRP.
• There are 4 pre-installed programs that you can run with the following commands from the terminal:

1. adb
2. fastboot
3. ghex
4. mtk for CLI mode of mtkclient & mtk_gui for the graphical interface

To open the terminal, simply click the black square icon in the task bar at the bottom.
Going forward, whenever I mention Run, it means type the command that follows in the terminal and press enter.
You should always run commands from home directory. If you are having an issue with a command, you should run cd first to go back to the home directory if you aren't in it already.

1. While booted into the live Linux image, connect your 2nd USB stick and wait for a notification in the top right corner of the screen that says Volume mounted. This 2nd USB stick should previously be formatted to exFAT (not FAT32), we will use this one for storing the backup. Do not unplug the 1st USB stick that has the Linux image on it.
2. Open the terminal in the Linux ISO by clicking the black square icon in the taskbar.
3. Type lsblk and hit enter. Under MOUNTPOINTS you will see an entry similar to
   /media/user/exampleName. In your case exampleName will be whatever your USB drive name is. Take note of this path as we will use it in the next step. Note: Sometimes you might see more than one mountpoint that looks similar but with a different name like /media/user/differentName, we want the one that has the flash drive's name and not something else like your computer's internal drive.
4. Run mkdir "/media/user/exampleName/stock_rom" but replace exampleName in the path with whatever your drive name was from the previous step. This command creates the folder we will be using to store our backup in.
5. To make the backup, run mtk rl --skip userdata "/media/user/exampleName/stock_rom" but don't forget to replace exampleName. Connect the cable to your phone while it is turned off and wait for the command to finish running. This will take roughly 10 minutes and will show this message once it is done DaHandler - All Dumped partitions success. If the command ran into any errors at any point, you probably don't have enough storage on your 2nd USB drive (possibly due to it being formatted as FAT32) and you should not proceed until you resolve the issue, even if you see the success message at the end. You can double check to see if the files were actually made inside the stock_rom folder of the USB drive using the file explorer, but keep in mind that this does not mean they were made correctly if you did run into any errors.
6. To backup the preloader, run mtk r preloader "/media/user/exampleName/stock_rom/preloader.bin" --parttype=boot1. Don't forget to replace exampleName here too. After this has finished, you should now be able to see a bunch of files with .bin extension inside the stock_rom folder of your USB drive.

1. Open the terminal in the Linux ISO by clicking the black square icon in the taskbar.
2. Run mkdir stock_rom to create the folder we will be using to store our backup in.
3. To make the backup, run mtk rl --skip userdata stock_rom. Connect the cable to your phone while it is turned off and wait for the command to finish running. This will take roughly 10 minutes and will show this message once it is done DaHandler - All Dumped partitions success. If the command ran into any errors at any point you should not proceed until you resolve the issue, even if you see the success message at the end. You can double check to see if the files were actually made inside the stock_rom folder which you can find inside the home folder using the file explorer, but keep in mind that this does not mean they were made correctly if you did run into any errors.
4. To backup the preloader, run mtk r preloader stock_rom/preloader.bin --parttype=boot1. After this has finished, you should now be able to see a bunch of files with .bin extension inside the stock_rom folder of your USB drive.
5. Move the stock_rom folder to an external drive or upload it to a cloud storage solution like Google Drive. Note: rebooting the Linux ISO will reset the live image and you will lose your backup if you haven't moved it somewhere else.

You need to unlock the bootloader in order to flash the new ROM.

1. Enter fastboot.
2. Run fastboot flashing unlock.
3. Run fastboot --disable-verity --disable-verification flash vbmeta vbmeta_a.bin.

1. Turn off the phone.
2. Run mtk da seccfg unlock. Connect the cable and wait for the command to finish.
3. Enter fastboot.
4. Run fastboot --disable-verity --disable-verification flash vbmeta vbmeta_a.bin.

There are a few LineageOS ROMs available that you can try. I'm going to flash DumberOS as it's currently the best option for these keypad phones.

1. Enter fastboot mode if you aren't in it already.
2. Run fastboot reboot fastboot and wait for the device to reboot into fastbootD (colored text on black background).
3. Erase user data if you are upgrading from the stock ROM. Updating DumberOS doesn’t require this step. Run the following commands.
   fastboot erase userdata
fastboot erase metadata
4. Download the appropriate *.img.gz from the latest build of DumberOS onto the Linux ISO or the 2nd USB drive. Choose between G-apps and Vanilla (Micro-g). For the F21 pro use version 30. For all other phones use 31.
5. After the download has finished, extract (unzip) the file by right clicking on it and then clicking Extract here. Do NOT simply rename it to .img from .img.gz.
6. Run this command from fastbootD
   fastboot flash system "Downloads/???.img" but replace ??? with the actual filename and wait for it to finish. Note: The "Downloads/???.img" path assumes you extracted the DumberOS image inside the Downloads folder of the live Linux image.
7. Run fastboot reboot and wait for the device to reboot. If Orange State warning appears, press the power button to proceed and wait 5-10 minutes for the new OS to boot. Don't worry if it seems stuck on orange state warning on the first boot, just give it some time.

If you need to enter fastboot:

1. Turn off the phone if it is not already.
2. Run python3 mtkfastboot.py.
3. Conncect the cable and wait until the command forces the device to reboot into fastboot. You should see a text that says "fastboot" at the bottom left of the screen.

If you have messed something up and would like to recover from your backup, do the following:

1. Turn off the phone.
2. Assuming your backup is stored on your USB drive, Run mtk w super "/media/user/exampleName/stock_rom/super.bin" but replace exampleName with the name of your drive as mentioned in Make a backup.
3. Connect your cable and wait for the command to finish running. Once it's done unplug the cable and turn on the phone.

Follow the three steps in the previous subsection but replace the command in the 2nd step with mtk wl "/media/user/exampleName/stock_rom". This should take about 10 minutes to flash.

If you come from that one infamous guide on XDA where they guide you to install TWRP without making a backup. You have probably been stuck trying to flash DumberOS. That's because fastbootD is broken on that particular installation of TWRP.

Because there are different hardware revisions of the F21 Pro, I cannot guarantee that this solution will work. That's why it's essential to make a backup first. If it does not work for you then you will need to find a boot image that's compatible with your device and does not have TWRP installed.

1. Make sure that you have made a backup.
2. Turn off the phone.
3. Run mtk w boot_a TWRPless_F21_Boot/boot_a.bin.
4. Connect the cable and wait for the command to finish.

TWRP should now be gone.

In this section we will go through the process of flashing American bands on the F21 Pro for users who need them.

• This part should be followed after unlocking the bootloader and before flashing a new ROM because SN Write Tool does not work with LineageOS/DumberOS.
• Make sure that you have made a backup.
• Covered LTE Bands: 2, 4, 12, 13, 17, 66, 71
  This covers most T-Mobile users, in addition to some AT&T support depending on region.
• Verizon will not work on DumberOS. As for getting it to work on the stock ROM you will need to flash the 1.1.1 firmware which I won't be covering in this guide. You can look up other guides on how to do that.

Pick one of the following options for flashing the bands. The Linux method is experimental but that's what I would recommend going forward. The Windows method will probably be removed once the Linux method has been tested extensively.

1. Turn off the phone.
2. Run mtk r nvdata nvdata.bin, connect the cable and wait for the command to finish running.
3. Run sudo sh rewrite.sh, type in the password user once prompted and hit enter to rewrite IMEI and MAC addresses to the LTE bands files.
4. Run mtk wl F30_Modem_Files, connect the cable and wait for the command to finish running to flash LTE bands.
5. Follow the steps in Verify.

1. Backup Identifiers

   1. Go to Settings > About Phone.
   2. Write down these fields: IMEI, WiFi MAC, Bluetooth MAC.

2. Flash LTE Bands

   1. Turn off the phone.
   2. Run mtk wl F30_Modem_Files from the Linux ISO, connect the cable and wait for it to finish.

3. Prepare SN Write Tool (Windows)

   1. Switch to Windows, download and unzip SN Write Tool.

4. Restore Identifiers

   1. Open SN Write Tool
   2. Set:
      ComPort: USBVCOM Target Type: Smart Phone
   3. Click System Config. Under Write Option, check IMEI, BT Address, and WiFi Address.
   4. Under Database File
      1. Check Load AP DB from DUT and Load Modem DB from DUT.
      2. Click MD1_DB: Select MDDB_InfoCustomAppSrcP_MT6761S00...EDB (inside AP DB Base/MT6761).
      3. Click AP_DB: Select APDB_MT6761_S01__W1947... (inside AP DB Base/MT6761).
      4. Click Save and return to the main window.
   5. Click Start and input your saved identifiers (no spaces in IMEI, no colons in BT/WiFi).
   6. Hold your phone's Back button, plug it in via USB, and click OK. Wait for the green PASS. If a second window pops up, close it if you already saw PASS.

5. Follow the steps in Verify.

1. Turn on the phone and check IMEI, WiFi MAC, Bluetooth MAC fields in Settings > About Phone to confirm your identifiers are restored.
2. Dial *#*#3646633#*#* to open Engineer Mode. Go to Band Mode, scroll down and confirm bands 2, 4, 12, 13, 17, 66, 71 are active.
3. Test calls/texting and internet data on the stock ROM to make sure whatever issue you might face after installing DumberOS isn't related to your carrier.

Button combos that are useful to know sometimes.

• For BROM mode you will need to run mtkclient first, and then hold the button combo and plug in the cable while still holding the buttons.
• Recovery mode is built into the phone and no cable or program is required.

You probably didn't unzip the ROM file you are trying to flash. Unzip and try again with the unzipped file.

You have not unlocked the bootloader because you probably missed a step in Unlock the bootloader. Go back and redo the steps in that section.

You are probably trying to flash the system partition from fastboot instead of fastbootD.
Run fastboot reboot fastboot and wait for the device to reboot into fastbootD (colored text on black background).

On some devices like the F21 Pro 3GB model, you might run into this error when you try to flash the system partition with DumberOS.

You can pick one of the following options to fix it.

1. Enter fastboot
2. Run fastboot reboot fastboot and wait for the device to reboot into fastbootD,.
3. Run fastboot getvar current-slot to check which slot is currently active (a or b). Take note of the active slot as we will be using it in the next step.
4. Run fastboot delete-logical-partition product_a if your active slot was a in the previous step, otherwise replace product_a with product_b in the command.

You can now repeat steps 6-7 from Flash new ROM section.

1. Enter fastboot mode if you aren't in it already.
2. Run fastboot getvar all and check if you have any partitions with the name ending with cow. Example: system_a-cow. If you have them proceed to the next step, otherwise ignore this option and use Option 1 instead.
3. Run fastboot getvar current-slot to check which slot is currently active (a or b). Take note of the active slot as we will be using it later.

1. Run fastboot set_active a to set the active slot to a.
2. Run fastboot reboot fastboot and wait for the device to reboot into fastbootD.
3. Use fastboot delete-logical-partition examplePartition to delete the desired cow partition. Replace examplePartition with the name of the cow partition you want to delete (e.g. system_a-cow).
4. Repeat the previous step for each cow partition in the a slot.

1. Run fastboot set_active b to set the active slot to b.
2. Run fastboot reboot fastboot and wait for the device to reboot into fastbootD.
3. Use fastboot delete-logical-partition examplePartition to delete the desired cow partition. Replace examplePartition with the name of the cow partition you want to delete (e.g. system_b-cow).
4. Repeat the previous step for each cow partition in the b slot.

1. Switch back to your initial active slot with the fastboot set_active exampleSlot command, replace exampleSlot with a or b depending on which one was active before deleting the cow partition.
2. Repeat steps 6-7 from Flash new ROM section.

A common issue that many run into is the following message appearing on boot and not letting them go past the bootloader after unlocking the device.

dm-verity corruption
Your device is corrupt.
It can't be trusted and may not work properly
Press power button to continue.
Or, device will power off in 5s

Follow step 3-4 from this section. If that doesn't work, you can try this:

1. Turn off the phone.
2. Run mtk w vbmeta_a vbmeta_a.bin.
3. Connect the cable and wait for the command to finish. Then unplug and reboot the phone to see if the message is gone.

Your device may show this message on boot. This is normal as long as your device boots after you press the power button and wait 5 seconds. You don't need to remove it but you can if you wish to, although it may require some effort. Follow the AlikornSause guide if you are interested.

Orange State
Your device has been unlocked and can't be trusted
Your device will boot in 5 seconds

Assuming you are using the Linux ISO in this guide and not some other OS:

1. Make sure your cable matches the description in Prerequisites.
2. Press CTRL+C to kill mtkclient.
3. Unplug the cable.
4. Rerun the command.
5. Replug the cable.

If it still doesn't work try again in BROM mode. Repeat step 2-4. On step 5 hold the button combo and plug the cable in while still holding the buttons. Repeat this a couple of times if it still doesn't work.

If you see this error inside the Linux ISO you are probably running out of RAM and the system is crashing because the live image uses RAM for storage. Most likely because your computer has less RAM than what's stated in Prerequisites.

• AlikornSause - for his amazing guide.
• Michal Brzozowski - for making DumberOS.
• Deathmist - for providing f21 boot image and various tips on using fastboot and mtkclient.
• ars18 - for writing a very useful script for rewriting IMEI & MAC addresses.
• CatStoleTheCrown - for his guide on restoring identifiers with SN Write Tool.