===== PART 1 =====

============================================================
BLITZTECH ISP BRIDGE / JAILBREAK GUIDE
For Keefe Score 7T Tablet
Version 3.0 (Fully Expanded, Termux Integrated)
============================================================

Prepared by: BlitzTech Forge Technical Division
Audience: Beginners and Intermediate Modders
Purpose: Educational / Research Reference Only

============================================================
CONCEPT & GOALS
============================================================

What This Is:
-------------
This guide teaches you how to bypass institutional locks on the Keefe Score 7T
tablet by directly accessing and rewriting its eMMC storage through an
In-System Programming (ISP) connection. It explains how to build a bridge using
a SanDisk Clip Sport MP3 player, how to solder safely, how to use an Android
phone with Termux to perform firmware operations, and how to troubleshoot
common errors.

Why ISP Instead of Normal Flashing:
-----------------------------------
- Locked tablets block USB debugging and normal flashing tools.
- ISP allows direct, low-level access to the eMMC, ignoring lock software.
- The chip does not need to be removed from the board.
- This is the same method professional repair shops use to recover phones.

Role of the MP3 Bridge:
-----------------------
- The SanDisk Clip Sport MP3 player (ATJ2127 chipset) has a microSD interface.
- By soldering its microSD lines to the tablet s eMMC lines, we make the MP3
 act like a USB-to-eMMC adapter.
- The Android phone, via OTG, sees the tablet eMMC as if it were a removable
 SD card.

End Goals:
----------
1. Make a full Golden Dump backup of the locked firmware.
2. Inspect partitions, confirm structure, identify lock mechanisms.
3. Replace or patch system/vendor partitions while preserving unique data
 (nvram, modem).
4. Restore modified image back to tablet.
5. Boot into a functional, unlocked Android 10 environment.

Important Notes:
----------------
- This guide assumes **no PC access**. All steps are done with a phone + Termux.
- Termux is central. Every command runs inside Termux.
- If you are unsure about wiring, soldering, or commands: slow down, re-read,
 and reference the Glossary or Appendices.

============================================================
MASTER CHECKLIST
============================================================

[ ] Android host phone with OTG support (e.g. Moto G Sapphire Blue)
[ ] Termux installed from F-Droid (not Play Store)
[ ] Termux storage access enabled (termux-setup-storage)
[ ] Packages installed: coreutils, util-linux, proot-distro (optional)
[ ] tmux installed (optional, recommended)
[ ] USB OTG adapter/cable
[ ] SanDisk Clip Sport MP3 (ATJ2127 SoC) or similar bridge
[ ] Keefe Score 7T tablet (powered off, battery charged)
[ ] Fine-tip soldering iron, flux, thin insulated wire
[ ] Multimeter (optional but recommended)
[ ] Stable power source (tablet battery connected or regulated bench supply)
[ ] At least 32GB free storage on phone (/sdcard)
[ ] External backup media for image copies
[ ] isp_bridge.sh script installed in Termux ($PREFIX/bin)

============================================================
TABLE OF CONTENTS
============================================================

Chapter 1 Introduction to ISP Bridging
Chapter 2 Hardware Components & Chips
Chapter 3 Building the ISP Bridge
Chapter 4 Preparing the Host Phone (Termux Deep Dive)
Chapter 5 Dumping the Tablet eMMC
Chapter 6 Inspecting & Modifying Images
Chapter 7 Restoring Modified Images
Chapter 8 First Boot & Unlock Behavior
Chapter 9 Troubleshooting Guide
Chapter 10 FAQ
Chapter 11 Glossary
Chapter 12 Appendices (A G)
Chapter 13 Index

============================================================
CHAPTER 1 INTRODUCTION TO ISP BRIDGING
============================================================

Definition:
ISP (In-System Programming) is the practice of connecting directly to a chip s
data lines while it remains on the board. In this case: accessing the eMMC
storage chip on the Score 7T tablet.

How It Works:
- The tablet s eMMC has pins for CMD (command), CLK (clock), DAT0 (data line),
 VCC (power), and GND (ground).
- By wiring these to an external device (the MP3 bridge), we can read/write raw
 data regardless of what the tablet s CPU is doing.
- The tablet CPU must be held in reset or powered down to prevent bus conflict.

Why an MP3 Player:
- Cheap, common, already exposes microSD lines.
- Easier to source than dedicated eMMC programmers.
- Compatible with Android OTG hosts.

============================================================
CHAPTER 2 HARDWARE COMPONENTS & CHIPS
============================================================

Keefe Score 7T Tablet (Main Board Components):
----------------------------------------------
- MT8168V SoC: quad-core Cortex-A53, controls everything.
- KLMAG2GEAC eMMC: 32GB NAND flash, holds OS and data.
- MT6358 PMIC: manages voltages for CPU, RAM, eMMC.
- MT7668: Wi-Fi/Bluetooth combo chip.
- ALC5640: audio codec.
- BQ24195: charger IC.

SanDisk Clip Sport MP3 (Bridge Components):
-------------------------------------------
- ATJ2127 SoC: exposes SDIO (microSD) interface.
- MicroSD pinout:
 Pin 3 = CMD
 Pin 5 = CLK
 Pin 7 = DAT0
 Pin 6 = GND
 Pin 4 = VDD (optional, usually skip)

Pin Numbering Notes:
--------------------
- Most PCBs mark pin 1 with a dot or triangle.
- On eMMC: notch orientation defines numbering.
- On microSD: pins run left to right when contacts face you, notch up.
- Always confirm with board diagrams or continuity testing.

============================================================
CHAPTER 3 BUILDING THE ISP BRIDGE
============================================================

Tools Needed:
- Fine-tip soldering iron
- 30 34 AWG wire
- Flux
- Magnification (loupe/microscope)
- Kapton tape for insulation

Steps:
1. Open MP3 player, expose microSD pads.
2. Identify CMD, CLK, DAT0, GND pads (see Appendix E diagrams).
3. Tin wires with solder, apply flux.
4. Solder wires to MP3 pads.
5. Open tablet, locate eMMC pads (CMD, CLK, DAT0, GND, VCC).
6. Solder wires from MP3 tablet (1:1 mapping).
7. Optionally connect VCC if needed (most stable if tablet battery stays).
8. Secure wires with tape/glue to avoid stress.
9. Double-check continuity with multimeter.

Reset Handling:
- Tablet CPU must not interfere. Hold reset line or ensure tablet stays off.
- If unsure, connect wires with tablet battery unplugged first.

============================================================
CHAPTER 4 PREPARING THE HOST PHONE (TERMUX DEEP DIVE)
============================================================

Why Termux:
- Provides Linux command line on Android.
- Critical since no PC is available.

Where to Get Termux:
- Install F-Droid (https://f-droid.org)
- Search Termux install the official package
- Do not use Google Play version (outdated, broken)

Initial Setup:
1. Open Termux once, let it initialize.
2. Grant storage access:
 Command:
 termux-setup-storage
 Effect:
 - Prompts Android for permission.
 - Creates ~/storage symlinks (~/storage/shared /sdcard).

Required Packages:
- Update package list:
 pkg update -y
- Install base:
 pkg install -y coreutils util-linux
- Optional advanced:
 pkg install -y proot-distro
 proot-distro install debian
- tmux (to keep sessions alive):
 pkg install -y tmux

What Each Does:
- coreutils: provides dd, sha256sum, cat, head, etc.
- tmux: terminal multiplexer, keeps jobs running if app pauses.

Verifying Device Visibility:
- Plug MP3 bridge via OTG, with tablet attached.
- Check USB presence:
 ls -l /dev/bus/usb/*/*
- Check block devices:
 ls -l /dev/block/sd*
 lsblk -o NAME,SIZE,TYPE
- Expect a new /dev/block/sdX (~32GB).

If Device Not Found:
- Try different OTG cable or phone.
- Ensure bridge wires are correct.
- Ensure tablet is powered or battery connected.

Keeping Jobs Alive:
- dd can take 30 60 minutes.
- Use tmux to prevent interruption:
 tmux
 # run dd or isp_bridge.sh inside
- Reattach later with:
 tmux attach

Cross-Reference:
- For full beginner details, see Appendix G: Termux Reference.
- For command explanations, see Chapter 11: Glossary.

## SanDisk Clip Sport MP3 (ATJ2127) MicroSD Pad Rows (Non Root Edition)
Orientation: USB port up, headphone jack to the right, pads facing you.

Outer row (closest to board edge, left right = Pins 1 4):
1 DAT2
2 DAT3 / CD
3 CMD
4 VDD (3.3V, optional)

Inner row (closer to board center, **right left = Pins 5 8**):
5 CLK (rightmost inner pad, nearest headphone jack)
6 GND
7 DAT0
8 DAT1 (leftmost inner pad, furthest from headphone jack)

 The inner row counts **backwards** compared to the outer row (start at the headphone jack and count 5 8).

## Keefe Score 7T Tablet 9 Test Pads (Top Bottom)
1 DAT2
2 DAT3
3 CMD
4 VDD (3.3V)
5 CLK
6 GND
7 DAT0
8 DAT1
9 Card Detect / NC

### Final Bridge Mapping (MP3 Tablet)
MP3 Pin 3 (CMD) Tablet Pad 3 (CMD)
MP3 Pin 5 (CLK) Tablet Pad 5 (CLK)
MP3 Pin 7 (DAT0) Tablet Pad 7 (DAT0)
MP3 Pin 6 (GND) Tablet Pad 6 (GND)
MP3 Pin 4 (VDD) Tablet Pad 4 (VDD) [optional if tablet battery is connected]

===== PART 2 =====

============================================================
CHAPTER 5 DUMPING THE TABLET EMMC
============================================================

Objective:
Create a Golden Dump a complete raw copy of the tablet s eMMC.
This is the most important step. It provides a safety net in case
anything fails later. NEVER skip it.

Preconditions:
- MP3 bridge wired and connected to tablet.
- Tablet powered off or CPU held in reset.
- Phone sees device at /dev/block/sdX (check with lsblk).
- At least 32GB free space on /sdcard.

Steps (Termux):
---------------
1. Verify device:
 lsblk -o NAME,SIZE,TYPE
 Expected: one device with ~32GB (e.g. /dev/block/sdb).

2. Run dump with script:
 isp_bridge.sh dump /sdcard/tablet_original.img
 - Script will prompt for confirmation.
 - Progress output shows MB/s and bytes copied.
 - Takes 20 60 minutes depending on OTG speed.

3. Hash for verification:
 sha256sum /sdcard/tablet_original.img > /sdcard/tablet_original.img.sha256
 - Save hash file to external media.
 - You can later re-run sha256sum on the device to check for corruption.

Expected Output Example:
------------------------
 34359738368 bytes (32 GB) copied, 1800 s, 19.1 MB/s
 [INFO] Dump complete: /sdcard/tablet_original.img
 Suggested: sha256sum "/sdcard/tablet_original.img" > "/sdcard/tablet_original.img".sha256

Cross-Reference:
- isp_bridge.sh script details Appendix D.
- sha256sum explanation Glossary, Termux Reference.

============================================================
CHAPTER 6 – NON-ROOT PARTITION ANALYSIS
---------------------------------------
You cannot use loop devices or mount partitions without root. Use this method instead:

1) Show partition table:
   fdisk -lu /sdcard/tablet_dump.img

2) Extract a partition (example: system):
   dd if=/sdcard/tablet_dump.img of=/sdcard/system.img \
      bs=512 skip=START count=SECTORS status=progress

3) Inspect partition files without mounting:
   file /sdcard/system.img
   hexdump -C /sdcard/system.img | less
   # Optional in Debian proot (still unrooted):
   # apt update && apt install -y binwalk
   # binwalk /sdcard/system.img

CHAPTER 7 – NON-ROOT RESTORE
----------------------------
Create Golden Dump:
  tmux
  dd if=/dev/block/sdX of=/sdcard/tablet_dump.img bs=4M status=progress
  sha256sum /sdcard/tablet_dump.img > /sdcard/tablet_dump.img.sha256

Restore full image back to tablet eMMC via the bridge:
  dd if=/sdcard/tablet_working.img of=/dev/block/sdX bs=4M status=progress
  sync

(Confirm the correct /dev/block/sdX with: lsblk -o NAME,SIZE,TYPE)
If dd is unstable or storage is tight, you can use EtchDroid to write the full .img from the phone to the bridged device (no root).

CHAPTER 8 FIRST BOOT & UNLOCK BEHAVIOR
============================================================

Objective:
Verify that the tablet boots into the modified firmware.

Steps:
1. Disconnect ISP bridge (remove wires or unplug MP3).
2. Reconnect tablet battery (if disconnected).
3. Power on tablet normally.

Expected Behavior:
- Device boots past institutional lock screen.
- May show standard Android 10 setup wizard.
- Wi-Fi, touch, display should work.
- Serial number, IMEI, and calibration intact (since nvram preserved).

If Boot Fails:
- Bootloop: likely AVB/dm-verity not patched see Troubleshooting.
- No power: check battery reconnected, not bricked.
- Black screen but vibration: wrong system/vendor image.

Post-Boot Checklist:
- Open Settings About Tablet.
- Confirm build number reflects modified firmware.
- Test Wi-Fi, audio, display.
- If successful, proceed to personalization.

Cross-Reference:
- Troubleshooting guide Chapter 9.
- FAQ (bootloop/dm-verity) Chapter 10.

## Non Root Dump & Restore
Create Golden Dump:
 tmux
 dd if=/dev/block/sdX of=/sdcard/tablet_dump.img bs=4M status=progress
 sha256sum /sdcard/tablet_dump.img > /sdcard/tablet_dump.img.sha256

Restore full image back to tablet eMMC via the bridge:
 dd if=/sdcard/tablet_working.img of=/dev/block/sdX bs=4M status=progress
 sync

(Confirm the correct /dev/block/sdX with: lsblk -o NAME,SIZE,TYPE)
If dd is unstable or storage is tight, you can use EtchDroid to write the full .img from the phone to the bridged device (no root).

===== PART 3 =====

============================================================
CHAPTER 9 TROUBLESHOOTING GUIDE
============================================================

[!] Rule: Always start by checking wiring, power, and free space before assuming software failure.

Case 1 No device detected in Termux
-------------------------------------
- Symptom: isp_bridge.sh list shows nothing.
- Causes:
 * Bad OTG cable.
 * Bridge not powered.
 * Wires not soldered correctly.
 * Phone/ROM does not expose USB mass storage.
- Fix:
 * Try another OTG cable/adapter.
 * Confirm MP3 bridge powers on (LED/screen).
 * Use multimeter to confirm continuity.
 * Try different host phone.

Case 2 dd speed extremely slow (<1 MB/s)
------------------------------------------
- Symptom: Dump takes 24+ hours.
- Causes:
 * Poor OTG cable.
 * Loose wiring, poor solder joints.
- Fix:
 * Replace cable, resolder with flux.
 * Keep wires <10cm if possible.

Case 3 Dump corrupted
-----------------------
- Symptom: sha256sum differs between dumps.
- Causes:
 * Interference/noisy connections.
 * Tablet not held in reset, CPU fighting bus.
- Fix:
 * Hold CPU reset line.
 * Power tablet only via battery, not USB.
 * Redo dump.

Case 4 Tablet won t boot after restore
----------------------------------------
- Symptom: Black screen, bootloop, or stuck logo.
- Causes:
 * Wrong system/vendor image.
 * vbmeta/dm-verity not patched.
- Fix:
 * Reflash golden dump.
 * Patch vbmeta to disable verification.
 * Retry with known-good image.

Case 5 Wi-Fi/Audio missing after unlock
-----------------------------------------
- Symptom: Device boots, but hardware doesn t work.
- Cause: Wrong vendor.img for device variant.
- Fix: Restore original vendor partition.

============================================================
CHAPTER 10 FREQUENTLY ASKED QUESTIONS
============================================================

Q: Do I need to remove the eMMC chip from the tablet?
A: No. ISP lets you program in-circuit without desoldering.

Q: How do I know which pad is CMD/CLK/DAT0?
A: Pads are labeled on board silkscreen, or see Appendix E diagrams.
 Pin 1 is usually marked with a dot or notch.

Q: Can I use a different MP3 player?
A: Only if it exposes SDIO lines. The Clip Sport (ATJ2127) is confirmed.

Q: Can I brick the tablet?
A: Yes, if you overwrite nvram or flash wrong partitions. Always keep a golden dump.

Q: Why Termux and not a PC?
A: User constraint: no PC available. Termux provides full Linux command line on Android.

Q: How long does a dump/restore take?
A: Typically 20 60 minutes for 32GB eMMC via OTG.

============================================================
CHAPTER 11 GLOSSARY (EXPANDED)
============================================================

[Chips Keefe Score 7T]
-------------------------
- MT8168V SoC: Main CPU. Must be held in reset during ISP.
- KLMAG2GEAC eMMC: 32GB NAND storage. Target of ISP dump/restore.
- MT6358 PMIC: Power management chip.
- MT7668 Wi-Fi/BT: Wireless connectivity.
- ALC5640 Audio Codec: Sound system.
- BQ24195 Charger IC: Battery charging.

[Chips SanDisk Clip Sport MP3]
--------------------------------
- ATJ2127 SoC: Provides microSD interface used as bridge.

[Termux]
--------
- Termux: Android app providing Linux environment.
- F-Droid: Safe app store, required source for Termux.
- pkg: Termux package manager.
- coreutils: Provides dd, sha256sum, etc.
- proot-distro: Lets you run Debian for advanced tools.
- tmux: Keeps jobs alive if app closes.

[Commands]
----------
- dd: Raw disk copier (used for dump/restore).
- sha256sum: File integrity check.
- fdisk -l: Show partition table of image/device.
- simg2img: Convert Android sparse image to raw.
- lsblk: Show block devices.

[Concepts]
----------
- ISP: In-System Programming. Direct chip access.
- Golden Dump: First complete backup.
- AVB: Android Verified Boot, enforces signed partitions.
- vbmeta: Metadata image storing AVB information.
- dm-verity: Kernel feature verifying partitions.
- Sparse Image: Space-saving Android image format.

============================================================
CHAPTER 12 APPENDICES
============================================================

Appendix A Command Cheat Sheet
--------------------------------
dd if=/dev/block/sdX of=/sdcard/dump.img bs=4M status=progress
sha256sum dump.img > dump.img.sha256
fdisk -l dump.img

-----------------------------------------

Appendix C Pre/Post Flash Checklists
--------------------------------------
Pre:
- Battery charged
- Golden dump made
- Wires double-checked
Post:
- Verify boot
- Test Wi-Fi
- Confirm About Tablet info

Appendix D isp_bridge.sh Script
---------------------------------
(see full script in this section; includes dump/restore/verify functions)

Appendix E Wiring Maps
------------------------
MP3 Tablet:
- CMD CMD
- CLK CLK
- DAT0 DAT0
- GND GND
- VCC VCC (optional)

Appendix F Reference Diagrams
-------------------------------
MicroSD pinout (notch up, contacts facing):
1 DAT2, 2 CD/DAT3, 3 CMD, 4 VDD, 5 CLK, 6 VSS, 7 DAT0, 8 DAT1

Appendix G Termux Reference
-----------------------------
- Installation via F-Droid.
- termux-setup-storage for permissions.
- pkg update; pkg install coreutils util-linux proot-distro tmux.
- ~/storage/shared maps to /sdcard.
- Use tmux for long dd jobs.
- Troubleshooting: no /dev/block/sdX check OTG, phone ROM.

============================================================
CHAPTER 13 INDEX
============================================================

AVB ........................... Ch. 11
Battery check ................. Appendix C
Clip Sport MP3 ................ Ch. 2
Commands cheat sheet .......... Appendix A
dd ............................ Ch. 5, 11
Device not detected ........... Ch. 9
Dump image .................... Ch. 5
fdisk ......................... Ch. 6, 11
Golden Dump ................... Ch. 5, 11
Glossary ...................... Ch. 11
ISP definition ................ Ch. 1
isp_bridge.sh ................. Appendix D
OTG issues .................... Ch. 9
Reset handling ................ Ch. 3
sha256sum ..................... Ch. 5, 11
Sparse images ................. Ch. 6, 11
System/vendor partitions ...... Ch. 6
Termux setup .................. Ch. 4, App. G
tmux .......................... Ch. 4, App. G
vbmeta ....................... Ch. 6, 11
Wiring maps ................... App. E

============================================================
END OF GUIDE
============================================================

BlitzTech ISP Bridge / Jailbreak Guide v3.0 
Prepared by BlitzTech Forge Technical Division 
For educational and research purposes only.

## Non Root Partition Analysis & Slicing (Termux)
You cannot use loop devices or mount partitions without root. Replace those steps with:

1) Show partition table (read only):
 fdisk -lu /sdcard/tablet_dump.img

2) Extract a partition by sector offsets from fdisk (example: system):
 dd if=/sdcard/tablet_dump.img of=/sdcard/system.img \
 bs=512 skip=START count=SECTORS status=progress

3) Inspect partition files without mounting:
 file /sdcard/system.img
 hexdump -C /sdcard/system.img | less
 # Optional in Debian proot (still unrooted):
 # apt update && apt install -y binwalk
 # binwalk /sdcard/system.img

## Non Root Dump & Restore
Create Golden Dump:
 tmux
 dd if=/dev/block/sdX of=/sdcard/tablet_dump.img bs=4M status=progress
 sha256sum /sdcard/tablet_dump.img > /sdcard/tablet_dump.img.sha256

Restore full image back to tablet eMMC via the bridge:
 dd if=/sdcard/tablet_working.img of=/dev/block/sdX bs=4M status=progress
 sync

(Confirm the correct /dev/block/sdX with: lsblk -o NAME,SIZE,TYPE)
If dd is unstable or storage is tight, you can use EtchDroid to write the full .img from the phone to the bridged device (no root).