Need stock /oem partition dump or full EDL firmware for Sunmi P2 Pro (T6920) - Stuck on bootloop

[gddxvid]

Hi everyone,

I accidentally ran an erase command on the oem partition of my Sunmi P2 Pro (Model: T6920, Qualcomm MSM8917) using this EDL script, and now the device is stuck in a persistent bootloop (stuck on the first Sunmi logo).

The hardware is completely intact and EDL Mode is working perfectly. The device boots into Qualcomm emergency download mode (9008), and the printgpt command reads the partition table successfully.

Since Sunmi stock ROMs are not publicly available, I cannot restore the device. I tried flashing files from Sunmi V2 Pro (Qualcomm), but the digital signatures do not match and it remains stuck on the bootlogo.

Does anyone have a full partition dump, a QFIL factory firmware package, or just a working oem.img backup pulled directly from a working Sunmi P2 Pro (T6920)?

Any help or file links to bypass this signature verification would be highly appreciated. Thank you!

[xedsvg]

@gddxvid Do you have a loader file? I have a couple of devices around, maybe I can dump one.
Dumping a device now, it looks like they are using the factory loader.

[xedsvg]

@gddxvid https://limewire.com/d/nfioj#rBwmyJW2o4 (It expires in 1 week)

[gddxvid]

Hi! I managed to successfully flash the oem.img via EDL, but upon booting the Sunmi P2 Pro, it immediately hits the orange tamper/security screen showing: "Unknown error, please reboot..."The device has triggered its hardware/software security lock due to a signature mismatch. To bypass this orange screen and recover the device, I need to restore the entire operating system using matching signatures.Could you please provide me with the full stock firmware (ROM) package for this Sunmi P2 Pro? I need all the main partition images (like boot.img, system.img, vendor.img, vbmeta.img, and a matching oem.img) so I can flash the entire bundle together via EDL and clean-restore the device.Let me know if you have the full ROM files available. Thank you!

[xedsvg]

Sure, I have one at the office. I'll link it in the morning.

[MXCRDSVFT]

hey guys... any word on a qc loader to crack my Galaxy s25 edge? it's a canadian telus device.

[gddxvid]

Sure, I have one at the office. I'll link it in the morning.

Hi! Just wanted to follow up on this. Did you manage to find the stock firmware package at the office? Whenever you have a moment to share the link, I'm ready to download it. Thanks again for your time and help!

[xedsvg]

@gddxvid sorry, friday mood installed faster than expected and left office before uploading. I'm ssh-ing now into the work laptop, grabbing it locally and uploading it. ETA 20-30 min.

BACKUP your persistence.bin AND your IMEI's, MAC addrs for WIFI, BT and etc. or you'll need to edit the persistence.bin from the archive. Ask an llm to change the SN with the one of your device otherwise it will install all the software for that sn from sunmi servers and it will softlock.

You don't have a user bin as it's 16GB but you can dd an empty 10-100mb file, write that and the os will rewrite a proper one.

sunmi_no_userdata.zip

[gddxvid]

@gddxvid sorry, friday mood installed faster than expected and left office before uploading. I'm ssh-ing now into the work laptop, grabbing it locally and uploading it. ETA 20-30 min.

BACKUP your persistence.bin AND your IMEI's, MAC addrs for WIFI, BT and etc. or you'll need to edit the persistence.bin from the archive. Ask an llm to change the SN with the one of your device otherwise it will install all the software for that sn from sunmi servers and it will softlock.

You don't have a user bin as it's 16GB but you can dd an empty 10-100mb file, write that and the os will rewrite a proper one.

sunmi_no_userdata.zip

Hi everyone,

Quick update: I successfully managed to get the device out of the bootloop and it boots perfectly fine now into the system!

Here is what worked for me:
I reflashed the original raw partitions (aboot, cmnlib, devcfg) in parallel with the modified boot_final.bin via EDL mode using the Raspberry Pi. This aligned the hardware partitions correctly. On the first boot, it triggered the native encryption screen ("Erasing updates"), successfully encrypted the userdata partition, and booted straight into the OS. It survives reboots and power cycles without any issues.

However, I am currently stuck with the following software restrictions:

1. Preinstalled System App: Since this was a retail-purchased device, the kiosk app is baked into the firmware as the default Home Launcher and cannot be closed or bypassed easily.
2. ADB is Broken / Blocked: Even though the "USB debugging connected" notification shows up on the screen and Developer Options can be accessed, the main "USB debugging" toggle is greyed out and enforced by a Device Policy (MDM). Therefore, running adb devices on a PC or Raspberry Pi returns an empty list (MTP storage connection works fine though).
3. Unknown Sources Blocked: The toggle to allow unknown sources is completely greyed out. Trying to trigger the shortcut via browser APK downloads or USB OTG sticks still stops at the system security pop-up.

If anyone knows another workaround or method to bypass the greyed-out ADB toggle or to force install packages on this specific Sunmi firmware, please let me know. Huge thanks for the help so far!

[gicko]

this is possible send me the firmware to flash one device this is dead because i unlock with soft flash to power on and put device in poweron state via edl

[mamania]

@gddxvid sorry, friday mood installed faster than expected and left office before uploading. I'm ssh-ing now into the work laptop, grabbing it locally and uploading it. ETA 20-30 min.

BACKUP your persistence.bin AND your IMEI's, MAC addrs for WIFI, BT and etc. or you'll need to edit the persistence.bin from the archive. Ask an llm to change the SN with the one of your device otherwise it will install all the software for that sn from sunmi servers and it will softlock.

You don't have a user bin as it's 16GB but you can dd an empty 10-100mb file, write that and the os will rewrite a proper one.

sunmi_no_userdata.zip

Hi, I’m working on a SUNMI T2S L1561 based on Qualcomm SDM660.
I’m investigating a boot issue after bootloader/FRP and A/B experiments. I’m not looking to flash your P2 Pro firmware directly, but its Qualcomm SUNMI partition layout could be extremely useful for comparison.

If you have a full EDL partition dump, QFIL package, rawprogram*.xml, GPT dump, or individual small partitions such as frp, misc, devinfo, oem, persist, vbmeta, etc., would you be willing to share them?

Even a partition list or printgpt output would help a lot.

Also, if anyone here happens to have an original SUNMI T2S L1561/L1562 ROM, factory firmware, QFIL/EDL package, or a full partition dump from a working unit, that would be absolutely fantastic and probably the most useful reference for me.

Thanks!