Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UFS flash based unlock issues (example: Redmi note 9t) #54

Closed
soralis0912 opened this issue Sep 9, 2021 · 16 comments
Closed

UFS flash based unlock issues (example: Redmi note 9t) #54

soralis0912 opened this issue Sep 9, 2021 · 16 comments
Assignees
@bkerler
Labels
enhancement New feature or request

Comments

@soralis0912
Copy link

preloader

https://github.com/soralis0912/xiaomi_preloader_collection/blob/main/preloader_begonia.bin
@soralis0912 soralis0912 changed the title prease add bootloader unlock Redmi note 9t please add bootloader unlock Redmi note 9t Sep 9, 2021
@soralis0912
Copy link
Author

I'm try it
But can't Unlock device.

@soralis0912
Copy link
Author 

python mtk stage

Port - Device detected :)
Preloader -     CPU:                    MT6853(Dimensity 720 5G)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212000
Preloader -     Var1:                   0xa
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xca00
Preloader -     SW Ver:                 0x0
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x996
Preloader - Target config:              0xe7
Preloader -     SBC enabled:            True
Preloader -     SLA enabled:            True
Preloader -     DAA enabled:            True
Preloader -     SWJTAG enabled:         True
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          True
Preloader -     Mem write auth:         True
Preloader -     Cmd 0xC8 blocked:       True
Preloader - ME_ID:                      XXXXXXXXXXXXXX
Preloader - SOC_ID:                     XXXXXXXXXXXXXX
PLTools - Loading payload from D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin
Port - Device detected :)
Main - Device is protected.
Main - Device is in BROM mode. Trying to dump preloader.
Successfully extracted preloader for this device to: D:\APP\mtkclient\mtkclient\Loader\Preloader\preloader_cannong.bin
DAXFlash - Uploading stage 1...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 0000000000000000
DAXFlash - Uploading stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - UFS FWVer:    0x32
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS CID:      XXXXXXXXXXXXXX
DAXFlash - UFS LU0 Size: 0xee5800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DA-CODE      : 0x969F0


python stage2 seccfg unlock

sej - HACC init
sej - HACC run
sej - HACC terminate
Successfully wrote seccfg to seccfg.bin. You need to write seccfg.bin to partition seccfg.

python mtk w seccfg seccfg.bin

Port - Device detected :)
Preloader -     CPU:                    MT6853(Dimensity 720 5G)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212000
Preloader -     Var1:                   0xa
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xca00
Preloader -     SW Ver:                 0x0
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x996
Preloader - Target config:              0xe7
Preloader -     SBC enabled:            True
Preloader -     SLA enabled:            True
Preloader -     DAA enabled:            True
Preloader -     SWJTAG enabled:         True
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          True
Preloader -     Mem write auth:         True
Preloader -     Cmd 0xC8 blocked:       True
Preloader - ME_ID:                      XXXX
Preloader - SOC_ID:                     XXXX
PLTools - Loading payload from D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin
Port - Device detected :)
Main - Device is protected.
Main - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading stage 1...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 0000000000000000
DAXFlash - Uploading stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - UFS FWVer:    0x32
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS CID:      XXXX
DAXFlash - UFS LU0 Size: 0xee5800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DA-CODE      : 0x969F0
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: Write data not allowed (0xc002000c)
Failed to write seccfg.bin to sector 104448 with sector count 2048.

python mtk stage
python stage2 seccfg unlock
python stage2 memwrite 0x18000000 seccfg.bin

Successfully wrote data to 0x18000000.

but can't unlock device.

@soralis0912
Copy link
Author

sorry missing preloader url

https://github.com/soralis0912/xiaomi_preloader_collection/blob/main/preloader_cannong.bin

@fayharinn
Copy link

fayharinn commented Sep 9, 2021 •
edited
Loading

U need to flash eng rom, after - generate seccfg, flash via fastboot seccfg, and check bl status

Hello you mean with sp flash tool ? I tried to flash the same device to restore imei (I have a full backup except userdata) with format all+download but it stucked at download DA 100%, now my device is dead even if I have backup and stock rom. Cannot write with mtkclient because no partitions are found (which is normal since SP flash tool formated everything)

@fayharinn
Copy link

You need try other versions of SPFT. And try to reinstall drivers and other. @fayharinn

Thank you for the reply. I tried with SP_Flash_Tool_v5.2124_Win. I alors installed the drivers one more time. Reading data is still working but not writing...

@soralis0912
Copy link
Author

i can't found cannong eng rom....

@Warlockguitarman
Copy link

Warlockguitarman commented Sep 10, 2021 •
edited
Loading

I tried also these commands with the k51
python mtk stage
python stage2 seccfg unlock
python stage2 memwrite 0xe800000 seccfg.bin

and the unlocked seccfg is not correct, I will read the seccfg and get the modified one and then I'll unlock the bootloader with chimera and get that seccfg and then you'll see where things aren't correct, I'll zip them up and label them so you can check out what is wrong with the script

@Warlockguitarman
Copy link

https://drive.google.com/file/d/17t_UVUOJJyy87koEFWe5ZM5M3zDEQFuU/view?usp=drivesdk

@Warlockguitarman
Copy link

One thing I still notice chimera correctly reads the phone as mt6762 where on here it reads it as mt6765, I'm gonna attempt this with my k61 and stylo 6 which are 6765

@bkerler
Copy link
Owner

bkerler commented Oct 1, 2021

Please try latest commit 05833f1, should work now.

@ghost ghost deleted a comment Nov 3, 2021
@ghost ghost deleted a comment Nov 3, 2021
@ghost ghost deleted a comment Nov 3, 2021
@ghost ghost deleted a comment Nov 3, 2021
@bkerler bkerler changed the title please add bootloader unlock Redmi note 9t UFS flash based unlock issues (example: Redmi note 9t) Nov 30, 2021
@bkerler bkerler self-assigned this Nov 30, 2021
@bkerler bkerler added the enhancement New feature or request label Nov 30, 2021
This was referenced Nov 30, 2021
Closed
Closed
@MlgmXyysd
Copy link
Contributor

Please try latest commit 05833f1, should work now.

Still Device has is either already unlocked or algo is unknown. Aborting. on MT6893.

@MlgmXyysd
Copy link
Contributor

tried

python mtk stage
python stage2 seccfg unlock
python mtk w seccfg seccfg.bin

write success, still locked

@komenkHp
Copy link

@bkerler Check For Erase Partition UFS... Erase Sucess But Not Done

@soralis0912
Copy link
Author

@bkerler thanks! unlock sucessed

@bkerler bkerler mentioned this issue Dec 29, 2021
Closed
@walleyegg
Copy link

Please help me? What command should I enter to unlock？

@walleyegg
Copy link

@bkerler ，mDevice has is either already unlocked or algo is unknown. Aborting.�[0m
How can I do this? I am a novice

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bkerler bkerler

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@bkerler @MlgmXyysd @soralis0912 @komenkHp @Warlockguitarman @fayharinn @walleyegg