Pandora Box / Online

Pandora Box / Pandora Online — Mediatek Chipset Specialist

5 min read

What is Pandora Box / Pandora Online?

Pandora Box and Pandora Online are MediaTek (MTK) chipset specialist tools focused on advanced operations for devices powered by MediaTek SoCs. Pandora provides deep MTK-specific operations that generic multi-brand tools often cannot match, including BROM-level access, NVRAM management, and DA authentication bypass.

How MTK BROM Operations Work

Every MediaTek chipset contains a Boot ROM (BROM) — a hard-coded, read-only program burned into the chip at the factory. BROM executes first when the device powers on and is responsible for loading the next stage bootloader (Preloader). Pandora exploits the BROM interface to gain full control:

BROM mode entry: Device connects with BROM exposed (via USB timing exploit, volume button combination, or hardware test point)
DA loading: Pandora sends a Download Agent (DA) — a small program — into the device's RAM via USB
DA execution: The DA runs in RAM and provides full access to the device's flash storage (eMMC/UFS)
Operations: Read/write/erase any partition, modify NVRAM, repair IMEI, bypass FRP, flash firmware

MTK DA Authentication Bypass

Newer MediaTek SoCs (MT6765+, Dimensity series) implement DAA (Download Agent Authentication) — the BROM checks a digital signature on the DA before executing it. Unauthorized DA files are rejected. Pandora includes bypass methods for DAA-protected chipsets, enabling full access even on secured devices.

Supported MediaTek SoCs

Generation	SoC Models
Legacy	MT6572, MT6580, MT6582, MT6592
2016-2019	MT6735, MT6737, MT6739, MT6750, MT6753, MT6755 (P10), MT6757 (P20/P25)
2019-2021	MT6761 (A22), MT6762 (P22), MT6765 (P35/G35), MT6768 (G85), MT6769 (G80), MT6771 (P60/P70)
2021-2024	MT6781 (G96), MT6785 (G90T), MT6833 (Dim 700), MT6853 (Dim 720), MT6873 (Dim 800), MT6877 (Dim 900)
2022+	MT6883 (Dim 1000), MT6893 (Dim 1200), MT6895 (Dim 8100), MT6983 (Dim 9000), MT6985 (Dim 9200)

Core Functions

Function	Technical Detail
IMEI Repair	Direct NVRAM read/write — edits MP0B_001 binary file containing IMEI, WiFi MAC, BT MAC. Can backup and restore NVRAM for disaster recovery
FRP Bypass	Erase frp/nvdata/protect1/protect2 partitions via BROM DA access
Flash	Scatter file flash via BROM: boot, recovery, system, vendor, preloader, lk (little kernel), logo, and custom partitions
Factory Reset	Selective format: userdata only (preserves system) or full format (complete erase)
Read Firmware	Full ROM dump from device for backup or analysis

Pandora uses a credit-based or subscription system.

How to Use Pandora Box/Online: Step-by-Step

Purchase Pandora activation/credits from Code-GSM
Download Pandora software and install (for Pandora Box: connect Z3X hardware first)
Log in (Pandora Online) or connect dongle/box
Select the MTK tab — Pandora specializes in MediaTek chipsets
Put the MTK device in BROM mode:
- Power off the phone completely
- In Pandora, click "Connect" or "Start"
- Hold Vol Up (or Vol Up+Down on some devices) and plug USB cable
- The software should detect the BROM handshake within 2-3 seconds
After detection: select operation — Read Info, Unlock, FRP, IMEI (NVRAM), Flash, Format
Execute and monitor the log

Tutorial: MTK BROM IMEI Repair

Connect device in BROM mode (as above)
Click "Read NVRAM" first — this backs up the current NVRAM (important!)
Select "Write IMEI" or "IMEI Repair"
Enter the correct IMEI(s) — IMEI1 and IMEI2 for dual-SIM devices
Click Write — the tool writes directly to the NVRAM partition
Reboot the phone and check: dial *#06# to verify new IMEI

Tips

BROM mode timing is critical: click "Connect" in software FIRST, then plug USB within 1-2 seconds
If BROM fails: try different Vol key combos, ensure the phone battery has charge, use a short USB cable
For MTK devices with DA Auth (newer SoCs): Pandora may need auth bypass — check the supported SoC list
Always backup NVRAM before writing — a corrupted NVRAM can break IMEI, WiFi, Bluetooth

Browse Pandora at Code-GSM

Troubleshooting Pandora Box / Pandora Online

Problem	Cause	Solution
MTK phone not entering BROM	Vol key held too late, DA authentication on newer SoC, or wrong key combo for model	Hold Vol Up BEFORE plugging USB. If phone uses MT6833+ (Dimensity series): DA auth bypass required — ensure Pandora version supports that SoC. Try Vol Down instead of Vol Up on some Transsion/Vivo MTK models
"Auth fail" or "Handshake error" in BROM	Newer MediaTek SoCs (MT6765v/c, MT6833, MT6853+) require signed Download Agent authentication	Use Pandora's built-in DA bypass for that SoC. Update Pandora to latest version — DA support is added per-SoC. If unsupported: hardware test point (force BROM pre-bootloader) may be needed
NVRAM write succeeds but IMEI still null	Only IMEI1 was written, or modem partition needs flash	Write both IMEI1 and IMEI2. If still null: flash the modem/baseband firmware partition from a matching scatter ROM
Scatter flash aborts mid-way	Wrong scatter file for board version, USB cable quality, or PC USB power issue	Match scatter file to exact board version (not just model name). Use original USB cable. Plug directly into PC, not USB hub. Disable power management for USB ports in Device Manager

Frequently Asked Questions — Pandora Box / Pandora Online

Q: What is the difference between Pandora Box (hardware) and Pandora Online?
A: Pandora Box requires a physical USB box device connected to your PC. Pandora Online is a cloud/account-based version that works without hardware — operations are processed via server but still need the phone connected via USB on your PC. Both cover the same MTK operations; Online removes the need to own or ship the hardware box.

Q: Can Pandora handle all MediaTek chipsets?
A: Pandora covers a very wide range of MTK SoCs. Older SoCs (MT6580/MT6739/MT6755/MT6761/MT6765) are fully supported. Newest Dimensity chips (MT6893/MT6983/MT6985) may require tool updates. Check the Pandora release notes for your specific SoC version support.

Q: What is the BROM test point (PCB short)?
A: Some MTK phones have a hardware solder point on the PCB. When shorted to GND while connecting USB, it forces BROM mode regardless of bootloader state. Useful when Vol key method fails. Test point locations are device-specific — search "[model] brom test point" for PCB diagrams.

Q: Does Pandora support dual-SIM IMEI repair?
A: Yes — Pandora can write IMEI1 and IMEI2 (dual SIM) via NVRAM. Both must be written — writing only IMEI1 on a dual-SIM phone leaves IMEI2 invalid.

Back to Knowledge Base