Azkali/mtk_partitions.md

## mtk_partitions.md

      
    Raw
  

              mtk_partitions.md
            
          
    MediaTek Partition Table Reference


MT6xxx — printgpt output


Boot & Bootloader Chain


Partition
Purpose


lk_a/b
Little Kernel — MTK's bootloader (equivalent to U-Boot), initializes hardware before Android


boot_a/b
Android kernel + ramdisk (standard Android boot image)


vendor_boot_a/b
Vendor ramdisk, separated out in Android 11+ (GKI architecture)


init_boot_a/b
Generic ramdisk for Android 13+ (splits init from vendor_boot)


gz_a/b
Geniezone — MTK's hypervisor / TrustZone OS base


tee_a/b
Trusted Execution Environment (TEE) — secure world OS, handles fingerprint, DRM, keys


Firmware / Co-processors


Partition
Purpose


md1img_a/b
Modem firmware image (huge at 200MB — full cellular stack)


spmfw_a/b
System Power Manager firmware — handles sleep/wake power states


scp_a/b
Sensor Control Processor firmware — manages sensors, always-on processing


sspm_a/b
System Speed/Power Management firmware


mcupm_a/b
MCU Power Management firmware


dpm_a/b
Dynamic Power Management firmware


pi_img_a/b
Peripheral Interface firmware


connsys_bt_a/b
Bluetooth firmware (ConnSys = MTK's connectivity subsystem)


connsys_wifi_a/b
Wi-Fi firmware


connsys_gnss_a/b
GPS/GNSS firmware


dtbo_a/b
Device Tree Blob Overlay — hardware description overlaid on top of kernel DT


Verified Boot / Security


Partition
Purpose


vbmeta_a/b
Verified Boot metadata — root of trust for boot chain signatures


vbmeta_system_a/b
vbmeta for the system super partition


vbmeta_vendor_a/b
vbmeta for the vendor partition


seccfg
Security configuration — lock/unlock state, boot mode flags


sec1
Secondary security data, efuse shadow / crypto keys


otp
One-Time Programmable area — burned in hardware fuses (read-only effectively)


Android System


Partition
Purpose


super
Dynamic partitions container (6GB) — holds system, vendor, product, odm as logical volumes inside


userdata
User data, apps, files (~461GB — the bulk of your storage)


metadata
Manages dynamic partition metadata (logical partition mapping inside super)


Logging / Debug


Partition
Purpose


expdb
Exception Database (128MB) — crash dumps, kernel panics, tombstones. Best debug target


para
Boot parameters / panic log carried across reboots


misc
Bootloader control block — stores recovery commands, OTA flags


NVRAM / Calibration


⚠️ Back these up before any flashing — they contain device-unique calibration data and IMEI


Partition
Purpose


nvram
Non-volatile RAM (64MB) — modem calibration, Wi-Fi MAC, IMEI, audio tuning


nvdata
Extended NV data, runtime modem config


nvcfg
NV configuration, separate from runtime nvdata


persist
Persistent storage that survives factory reset — DRM licenses, face data


protect1/2
Protected storage for TEE/TrustZone data


Device Identity / Config


Partition
Purpose


proinfo
Product info — model, region, hardware revision


csci
Country/carrier customization info


frp
Factory Reset Protection — Google account lock


boot_para
Boot parameters passed between bootloader stages


dram_para
DRAM calibration parameters — timing data for RAM


Misc


Partition
Purpose


logo
Bootloader splash screen (25MB, raw image data)


flashinfo
eMMC/UFS flash management info — bad block table, wear leveling metadata. Last partition, sentinel


Raw Offsets & Sizes


Partition
Offset
Size


misc
0x8000
512 KB


para
0x88000
512 KB


expdb
0x108000
128 MB


frp
0x8108000
1 MB


nvcfg
0x8208000
32 MB


nvdata
0xA208000
64 MB


vbmeta_a
0xE208000
8 MB


vbmeta_system_a
0xEA08000
8 MB


vbmeta_vendor_a
0xF208000
8 MB


vbmeta_b
0xFA08000
8 MB


vbmeta_system_b
0x10208000
8 MB


vbmeta_vendor_b
0x10A08000
8 MB


metadata
0x11208000
32 MB


persist
0x13208000
~54 MB


protect1
0x16800000
8 MB


protect2
0x17000000
8 MB


seccfg
0x17800000
8 MB


otp
0x18000000
48 MB


md1img_a
0x1B000000
200 MB


spmfw_a
0x27800000
1 MB


pi_img_a
0x27900000
1 MB


dpm_a
0x27A00000
4 MB


scp_a
0x27E00000
6 MB


sspm_a
0x28400000
1 MB


mcupm_a
0x28500000
1 MB


gz_a
0x28600000
32 MB


lk_a
0x2A600000
4 MB


boot_a
0x2AA00000
64 MB


vendor_boot_a
0x2EA00000
64 MB


init_boot_a
0x32A00000
8 MB


dtbo_a
0x33200000
8 MB


tee_a
0x33A00000
5 MB


sec1
0x33F00000
2 MB


proinfo
0x34100000
3 MB


nvram
0x34400000
64 MB


csci
0x38400000
1 MB


boot_para
0x38500000
1 MB


dram_para
0x38600000
25 MB


connsys_bt_a
0x39F00000
8 MB


connsys_wifi_a
0x3A700000
8 MB


connsys_gnss_a
0x3AF00000
8 MB


logo
0x3B700000
25 MB


md1img_b
0x3D000000
200 MB


spmfw_b
0x49800000
1 MB


pi_img_b
0x49900000
1 MB


dpm_b
0x49A00000
4 MB


scp_b
0x49E00000
6 MB


sspm_b
0x4A400000
1 MB


mcupm_b
0x4A500000
1 MB


gz_b
0x4A600000
32 MB


lk_b
0x4C600000
4 MB


boot_b
0x4CA00000
64 MB


vendor_boot_b
0x50A00000
64 MB


init_boot_b
0x54A00000
8 MB


connsys_bt_b
0x55200000
8 MB


connsys_wifi_b
0x55A00000
8 MB


connsys_gnss_b
0x56200000
8 MB


dtbo_b
0x56A00000
8 MB


tee_b
0x57200000
6 MB


super
0x57800000
9216 MB (~9 GB)


userdata
0x297800000
~461 GB


flashinfo
0x772AFF8000
16 MB


Key Notes


A/B partitions: This device uses A/B (seamless) updates. All critical partitions are duplicated. Only one slot is active at a time.
super is a dynamic partition container — use lpunpack to extract system, vendor, product, odm from it.
expdb is your primary crash log target. Dump with: python3 mtk.py r expdb expdb.bin
nvram contains your IMEI and RF calibration — always back up before flashing: python3 mtk.py r nvram nvram.bin
➜  Downloads ca
➜  Downloads cat mtk_partitions.md

MediaTek Partition Table Reference


GPD Win Max 2 — MT6xxx — printgpt output


Boot & Bootloader Chain


Partition
Purpose


lk_a/b
Little Kernel — MTK's bootloader (equivalent to U-Boot), initializes hardware before Android


boot_a/b
Android kernel + ramdisk (standard Android boot image)


vendor_boot_a/b
Vendor ramdisk, separated out in Android 11+ (GKI architecture)


init_boot_a/b
Generic ramdisk for Android 13+ (splits init from vendor_boot)


gz_a/b
Geniezone — MTK's hypervisor / TrustZone OS base


tee_a/b
Trusted Execution Environment (TEE) — secure world OS, handles fingerprint, DRM, keys


Firmware / Co-processors


Partition
Purpose


md1img_a/b
Modem firmware image (huge at 200MB — full cellular stack)


spmfw_a/b
System Power Manager firmware — handles sleep/wake power states


scp_a/b
Sensor Control Processor firmware — manages sensors, always-on processing


sspm_a/b
System Speed/Power Management firmware


mcupm_a/b
MCU Power Management firmware


dpm_a/b
Dynamic Power Management firmware


pi_img_a/b
Peripheral Interface firmware


connsys_bt_a/b
Bluetooth firmware (ConnSys = MTK's connectivity subsystem)


connsys_wifi_a/b
Wi-Fi firmware


connsys_gnss_a/b
GPS/GNSS firmware


dtbo_a/b
Device Tree Blob Overlay — hardware description overlaid on top of kernel DT


Verified Boot / Security


Partition
Purpose


vbmeta_a/b
Verified Boot metadata — root of trust for boot chain signatures


vbmeta_system_a/b
vbmeta for the system super partition


vbmeta_vendor_a/b
vbmeta for the vendor partition


seccfg
Security configuration — lock/unlock state, boot mode flags


sec1
Secondary security data, efuse shadow / crypto keys


otp
One-Time Programmable area — burned in hardware fuses (read-only effectively)


Android System


Partition
Purpose


super
Dynamic partitions container (6GB) — holds system, vendor, product, odm as logical volumes inside


userdata
User data, apps, files (~461GB — the bulk of your storage)


metadata
Manages dynamic partition metadata (logical partition mapping inside super)


Logging / Debug


Partition
Purpose


expdb
Exception Database (128MB) — crash dumps, kernel panics, tombstones. Best debug target


para
Boot parameters / panic log carried across reboots


misc
Bootloader control block — stores recovery commands, OTA flags


NVRAM / Calibration


⚠️ Back these up before any flashing — they contain device-unique calibration data and IMEI


Partition
Purpose


nvram
Non-volatile RAM (64MB) — modem calibration, Wi-Fi MAC, IMEI, audio tuning


nvdata
Extended NV data, runtime modem config


nvcfg
NV configuration, separate from runtime nvdata


persist
Persistent storage that survives factory reset — DRM licenses, face data


protect1/2
Protected storage for TEE/TrustZone data


Device Identity / Config


Partition
Purpose


proinfo
Product info — model, region, hardware revision


csci
Country/carrier customization info


frp
Factory Reset Protection — Google account lock


boot_para
Boot parameters passed between bootloader stages


dram_para
DRAM calibration parameters — timing data for RAM


Misc


Partition
Purpose


logo
Bootloader splash screen (25MB, raw image data)


flashinfo
eMMC/UFS flash management info — bad block table, wear leveling metadata. Last partition, sentinel


Raw Offsets & Sizes


Partition
Offset
Size


misc
0x8000
512 KB


para
0x88000
512 KB


expdb
0x108000
128 MB


frp
0x8108000
1 MB


nvcfg
0x8208000
32 MB


nvdata
0xA208000
64 MB


vbmeta_a
0xE208000
8 MB


vbmeta_system_a
0xEA08000
8 MB


vbmeta_vendor_a
0xF208000
8 MB


vbmeta_b
0xFA08000
8 MB


vbmeta_system_b
0x10208000
8 MB


vbmeta_vendor_b
0x10A08000
8 MB


metadata
0x11208000
32 MB


persist
0x13208000
~54 MB


protect1
0x16800000
8 MB


protect2
0x17000000
8 MB


seccfg
0x17800000
8 MB


otp
0x18000000
48 MB


md1img_a
0x1B000000
200 MB


spmfw_a
0x27800000
1 MB


pi_img_a
0x27900000
1 MB


dpm_a
0x27A00000
4 MB


scp_a
0x27E00000
6 MB


sspm_a
0x28400000
1 MB


mcupm_a
0x28500000
1 MB


gz_a
0x28600000
32 MB


lk_a
0x2A600000
4 MB


boot_a
0x2AA00000
64 MB


vendor_boot_a
0x2EA00000
64 MB


init_boot_a
0x32A00000
8 MB


dtbo_a
0x33200000
8 MB


tee_a
0x33A00000
5 MB


sec1
0x33F00000
2 MB


proinfo
0x34100000
3 MB


nvram
0x34400000
64 MB


csci
0x38400000
1 MB


boot_para
0x38500000
1 MB


dram_para
0x38600000
25 MB


connsys_bt_a
0x39F00000
8 MB


connsys_wifi_a
0x3A700000
8 MB


connsys_gnss_a
0x3AF00000
8 MB


logo
0x3B700000
25 MB


md1img_b
0x3D000000
200 MB


spmfw_b
0x49800000
1 MB


pi_img_b
0x49900000
1 MB


dpm_b
0x49A00000
4 MB


scp_b
0x49E00000
6 MB


sspm_b
0x4A400000
1 MB


mcupm_b
0x4A500000
1 MB


gz_b
0x4A600000
32 MB


lk_b
0x4C600000
4 MB


boot_b
0x4CA00000
64 MB


vendor_boot_b
0x50A00000
64 MB


init_boot_b
0x54A00000
8 MB


connsys_bt_b
0x55200000
8 MB


connsys_wifi_b
0x55A00000
8 MB


connsys_gnss_b
0x56200000
8 MB


dtbo_b
0x56A00000
8 MB


tee_b
0x57200000
6 MB


super
0x57800000
9216 MB (~9 GB)


userdata
0x297800000
~461 GB


flashinfo
0x772AFF8000
16 MB


Key Notes


A/B partitions: This device uses A/B (seamless) updates. All critical partitions are duplicated. Only one slot is active at a time.
super is a dynamic partition container — use lpunpack to extract system, vendor, product, odm from it.
expdb is your primary crash log target. Dump with: python3 mtk.py r expdb expdb.bin
nvram contains your IMEI and RF calibration — always back up before flashing: python3 mtk.py r nvram nvram.bin
Partition	Purpose
`lk_a/b`	Little Kernel — MTK's bootloader (equivalent to U-Boot), initializes hardware before Android
`boot_a/b`	Android kernel + ramdisk (standard Android boot image)
`vendor_boot_a/b`	Vendor ramdisk, separated out in Android 11+ (GKI architecture)
`init_boot_a/b`	Generic ramdisk for Android 13+ (splits init from vendor_boot)
`gz_a/b`	Geniezone — MTK's hypervisor / TrustZone OS base
`tee_a/b`	Trusted Execution Environment (TEE) — secure world OS, handles fingerprint, DRM, keys
Partition	Purpose
`md1img_a/b`	Modem firmware image (huge at 200MB — full cellular stack)
`spmfw_a/b`	System Power Manager firmware — handles sleep/wake power states
`scp_a/b`	Sensor Control Processor firmware — manages sensors, always-on processing
`sspm_a/b`	System Speed/Power Management firmware
`mcupm_a/b`	MCU Power Management firmware
`dpm_a/b`	Dynamic Power Management firmware
`pi_img_a/b`	Peripheral Interface firmware
`connsys_bt_a/b`	Bluetooth firmware (ConnSys = MTK's connectivity subsystem)
`connsys_wifi_a/b`	Wi-Fi firmware
`connsys_gnss_a/b`	GPS/GNSS firmware
`dtbo_a/b`	Device Tree Blob Overlay — hardware description overlaid on top of kernel DT
Partition	Purpose
`vbmeta_a/b`	Verified Boot metadata — root of trust for boot chain signatures
`vbmeta_system_a/b`	vbmeta for the system super partition
`vbmeta_vendor_a/b`	vbmeta for the vendor partition
`seccfg`	Security configuration — lock/unlock state, boot mode flags
`sec1`	Secondary security data, efuse shadow / crypto keys
`otp`	One-Time Programmable area — burned in hardware fuses (read-only effectively)
Partition	Purpose
`super`	Dynamic partitions container (6GB) — holds `system`, `vendor`, `product`, `odm` as logical volumes inside
`userdata`	User data, apps, files (~461GB — the bulk of your storage)
`metadata`	Manages dynamic partition metadata (logical partition mapping inside `super`)
Partition	Purpose
`expdb`	Exception Database (128MB) — crash dumps, kernel panics, tombstones. Best debug target
`para`	Boot parameters / panic log carried across reboots
`misc`	Bootloader control block — stores recovery commands, OTA flags
Partition	Purpose
`nvram`	Non-volatile RAM (64MB) — modem calibration, Wi-Fi MAC, IMEI, audio tuning
`nvdata`	Extended NV data, runtime modem config
`nvcfg`	NV configuration, separate from runtime nvdata
`persist`	Persistent storage that survives factory reset — DRM licenses, face data
`protect1/2`	Protected storage for TEE/TrustZone data
Partition	Purpose
`proinfo`	Product info — model, region, hardware revision
`csci`	Country/carrier customization info
`frp`	Factory Reset Protection — Google account lock
`boot_para`	Boot parameters passed between bootloader stages
`dram_para`	DRAM calibration parameters — timing data for RAM
Partition	Purpose
`logo`	Bootloader splash screen (25MB, raw image data)
`flashinfo`	eMMC/UFS flash management info — bad block table, wear leveling metadata. Last partition, sentinel
Partition	Offset	Size
`misc`	0x8000	512 KB
`para`	0x88000	512 KB
`expdb`	0x108000	128 MB
`frp`	0x8108000	1 MB
`nvcfg`	0x8208000	32 MB
`nvdata`	0xA208000	64 MB
`vbmeta_a`	0xE208000	8 MB
`vbmeta_system_a`	0xEA08000	8 MB
`vbmeta_vendor_a`	0xF208000	8 MB
`vbmeta_b`	0xFA08000	8 MB
`vbmeta_system_b`	0x10208000	8 MB
`vbmeta_vendor_b`	0x10A08000	8 MB
`metadata`	0x11208000	32 MB
`persist`	0x13208000	~54 MB
`protect1`	0x16800000	8 MB
`protect2`	0x17000000	8 MB
`seccfg`	0x17800000	8 MB
`otp`	0x18000000	48 MB
`md1img_a`	0x1B000000	200 MB
`spmfw_a`	0x27800000	1 MB
`pi_img_a`	0x27900000	1 MB
`dpm_a`	0x27A00000	4 MB
`scp_a`	0x27E00000	6 MB
`sspm_a`	0x28400000	1 MB
`mcupm_a`	0x28500000	1 MB
`gz_a`	0x28600000	32 MB
`lk_a`	0x2A600000	4 MB
`boot_a`	0x2AA00000	64 MB
`vendor_boot_a`	0x2EA00000	64 MB
`init_boot_a`	0x32A00000	8 MB
`dtbo_a`	0x33200000	8 MB
`tee_a`	0x33A00000	5 MB
`sec1`	0x33F00000	2 MB
`proinfo`	0x34100000	3 MB
`nvram`	0x34400000	64 MB
`csci`	0x38400000	1 MB
`boot_para`	0x38500000	1 MB
`dram_para`	0x38600000	25 MB
`connsys_bt_a`	0x39F00000	8 MB
`connsys_wifi_a`	0x3A700000	8 MB
`connsys_gnss_a`	0x3AF00000	8 MB
`logo`	0x3B700000	25 MB
`md1img_b`	0x3D000000	200 MB
`spmfw_b`	0x49800000	1 MB
`pi_img_b`	0x49900000	1 MB
`dpm_b`	0x49A00000	4 MB
`scp_b`	0x49E00000	6 MB
`sspm_b`	0x4A400000	1 MB
`mcupm_b`	0x4A500000	1 MB
`gz_b`	0x4A600000	32 MB
`lk_b`	0x4C600000	4 MB
`boot_b`	0x4CA00000	64 MB
`vendor_boot_b`	0x50A00000	64 MB
`init_boot_b`	0x54A00000	8 MB
`connsys_bt_b`	0x55200000	8 MB
`connsys_wifi_b`	0x55A00000	8 MB
`connsys_gnss_b`	0x56200000	8 MB
`dtbo_b`	0x56A00000	8 MB
`tee_b`	0x57200000	6 MB
`super`	0x57800000	9216 MB (~9 GB)
`userdata`	0x297800000	~461 GB
`flashinfo`	0x772AFF8000	16 MB