Wednesday, April 27, 2016

Fixing bricked Mediatek MT65xx MT6572 phones. Unbricking Philips S309 / S308 (SangFei) with testpoint

A few days ago I found this great deal on a relatively unknown phone, Philips S309. After researching a bit about it, it seems that it's actually built by a chinese company called SangFei. They have bought the rights to use the Philips brand after a joint venture they had together on the mobile market. The phones are quite decent and they have good prices, but they're not widely known, mainly because SangFei only exports them to China, Russia, Brazil, India and Romania.

Philips S309 on its box

The battery in my old Blackberry didn't hold too much charge anymore and it's a bit heavy to carry around so instead of investing in a new battery, I got the Philips. My joy was very short lived though, since I managed to brick it after only 2 days. Seemingly there are 2 versions of the S309, a 4GB one and an 8 GB one that is available only in Russia. Another difference is that the 8GB version has Android 5.1 installed. Of course, people managed to read the 5.1 ROM (easy to do on Mediatek phones) and uploaded the backup file on, where I found it.

This is where things went downhill. As you probably know, Mediatek ROMs have a PRELOADER partition which is responsible for loading the OS. If this partition gets corrupted or replaced with an incompatible one, the phone will be completely dead, it will not switch on or connect to the computer in any way. The Flash Tool will not see it either, so there's no way of writing back the original ROM, even if a backup is available.

Even if I knew that the preloader should not be written to the phone under any circumstances, I made the mistake of completely writing the Lollipop ROM to my phone, thinking that it would work since, well, it was for Philips S309. Little did I know that SangFei released 2 versions of the same phone with different hardware. It turns out that the 4GB version cannot use the Lollipop rom. This led to my phone becoming a nice and shiny brick.

Searching online for a solution for this specific phone proved to be futile, but there was some info on unbricking, although useless in my case. For some phones it is possible to activate the "meta" mode (which is a sort of last ditch recovery option for Mediatek devices, officially advertised as "On-chip boot ROM for Factory Flash Programming") by holding the Menu button then plugging in the USB cable. This didn't work for me, but after some more digging, I found another interesting post by rua1 @

It looks like there's a second way of entering meta mode, but the case of the phone needs to be opened. On the mainboard of most Mediatek phones there's a test point called KCOL0 that gets the phone into meta mode when it is connected to GND. Of course, not all phones are the same, the testpoint could be pretty hard to find, and most of the time it's not labelled.

There are some things needed for finding the TP: a computer (Windows or Linux OS, I used Debian here) with the Flash Tool installed, USB cable, a piece of wire, multimeter, screwdrivers, phone case opening kit, the original software (or a complete backup) of the bricked phone and of course, patience.

Rules to find TP safely:

  • The TP is usually located near the Volume buttons, seems that they're somehow related
  • It carries around 1.8 volts. Use a multimeter to check the voltage (red lead on the TP, black on the GND)
  • If it's over 2.5 volts, it's not the one you need

Here's are the test points for Philips S309 and Philips S308:

Philips S309 KCOL0 testpoint

Philips S308 KCOL0 testpoint

The unbricking procedure for Windows (works on MT65XX phones):

  • Open up the case of the phone (for S308 / S309 take out the top and bottom plastic pieces first, there are scews hidden beneath them)
  • Use USBDeview from Nirsoft ( to remove all Mediatek drivers from your PC
  • Get the MediaTek USB VCOM drivers ( and unpack them to a folder
  • Open the Flash Tool, choose the scatter file from the backup ROM for your phone then go to download tab, select only PRELOADER
  • Connect the USB cable to the phone and the PC, press the Download button in the Flash Tool
  • Connect the TP to GND with a piece of wire. ATTENTION! Make sure to connect the TP only to Ground. Hold it connected for a few seconds. The computer will detect a new device, when it asks for the driver location point it to the MediaTek USB VCOM drivers
  • If the VCOM driver disconnects / dissapears too soon, press Download again in the Flash Tool, reconnect USB cable and the TP
  • If everything worked, a red progress bar will appear at the bottom of the Flash tool and the computer will upload the PRELOADER to the phone. Wait for the OK window (green circle) to appear.
  • If you want to also write the rest of the ROM, it's recommended to exit the Meta mode and enter normal flash mode. Go to the Download tab in the Flash Tool, deselect PRELOADER and select the other partitions, press Download. Disconnect and reconnect the phone to the USB cable while holding the Volume Up key. The phone will use the newly installed preloader to enter Flash mode without needing the testpoint.

On Linux, the steps are the same, the only exception is that no VCOM driver installation is needed, after connecting the testpoint the phone got detected instantly and the flashing begun. 

Things to keep in mind:
  •  Don't interrupt the flashing process!
  • Use only a copy of the ROM made exactly for your device. A complete backup made with the Flash Tool always saves the day.
  • Don't touch the NVRAM partition, it holds the IMEI and calibration data for your phone.
  • Don't use the Flash Tool to format or test the memory if you don't have a complete backup, it will clear everything, including the partition that holds the IMEI, etc.


Q: What to do if the phone enters boot loop? (phone keeps resetting at the Android logo)
A: Turn off the phone and turn it on while holding the Up volume key. This will start the recovery mode. At the Android logo, short press the Power button
then navigate to "Format cache" then "Format user data" or "Reset user data" options. Choose them one by one with them vol Up button. After finishing, choose reset.

Q: What to do if I get a PMT error and the flashing stops?

A: This usually means that the ROM you chose has a different partitioning scheme than the one on the phone. To bypass it, instead of Download only option, select Firmware upgrade. This will tell the tool to update the partitioning scheme on the phone:

Change flashing mode to fix PMT error
In conclusion:
  • If it ain't broke, don't fix it!
  • Never ever update the preloader on Mediatek phones!
  • Always back up the complete ROM from Mediatek phones before flashing them (with the ReadBack function in Flash Tool)! It might save you from using the phone as a paper weight later on :-).

Another link that contains many tools and drivers:

That's about it, I hope this helps someone.


  1. hi thans. do you have diagram for s308 i have broken usb connector and i need the diagram

  2. My honor holly mobile has dead position plz help i find kcolo and kcol1 but how to connect kcolo gnd ply help urjent ...

  3. Thanks ! Saved my phone with this !!!
    Only one mention. In my case the USB device was connecting and disconnecting immediately after connecting KCOLO to GND, so SP Flash tool did not have time to finish the download.
    I had to change a setting in SP Flash Tool -> Connection -> set without battery.
    After setting this, the device didn't disconnect at all, after connectinn KCOLO to GND, and SP Flash Tool was able to flash the PreLoader correctly.

  4. Please Anybody Help me to Find KCOLO/TP Points....
    Model = Samsung Clone GT-I8552

  5. thanks a lot!
    helped rivived phone!

  6. AS i was trying to solder kcolo it break due to high temperature of soldering gun is there any point to connect points

  7. But what if the device is still being detected, albeit as a USB Serial Device? Even after flashing it through Write Memory the device is still knackered, i.e. it won't get out of Serial Device mode. The thing here is the bootloader is restricted and you can't flash unsigned firmware images unless you work around with it through the aforementioned method.

    The device in question is a LeapFrog Epic, if it helps.

  8. Hello, Can you please help me with backup of s309 4gb version ? I can`t find it anywhere. And sadly, I didn`t made a backup first.


  9. A testing machine to test the colorfastness test of textiles. TESTEX Crock Meter