Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MT6789 da2 patching results in TypeError / Support for newer V6 / bootrom patched based devices (MT68xx/MT69xx) #758

Closed
JamiKettunen opened this issue Aug 18, 2023 · 194 comments
Closed

MT6789 da2 patching results in TypeError / Support for newer V6 / bootrom patched based devices (MT68xx/MT69xx) #758

JamiKettunen opened this issue Aug 18, 2023 · 194 comments
Assignees
@bkerler
Labels
bug Something isn't working enhancement New feature or request

Comments

@JamiKettunen
Copy link

I see 81694c4 at least may be relevant, I ran mtkclient from commit 4549fdc. Let me know if I can help in any way. The device is a Gigaset GX4

$ mtk printgpt
MTK Flash/Exploit Client V1.6.3 (c) B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


Port - Device detected :)
Preloader - 	CPU:			MT6789(MTK Helio G99)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	Var1:			0xa
Preloader - Disabling Watchdog...
Preloader - HW code:			0x1208
Preloader - Target config:		0x0
Preloader - 	SBC enabled:		False
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		False
Preloader - 	SWJTAG enabled:		False
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca00
Preloader - 	SW Ver:			0x0
DA_handler - Device is unprotected.
DA_handler - Device is in Preloader-Mode :(
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_mt6789.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
xflashext
xflashext - [LIB]: Error on patching da1 version check...
Mtk - Patched "Patched loader msg" in preloader
xflashext - Patching da2 ...
Traceback (most recent call last):
  File "/usr/bin/mtk", line 855, in <module>
    mtk = Main(args).run(parser)
          ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mtkclient/Library/mtk_main.py", line 635, in run
    mtk = da_handler.configure_da(mtk, preloader)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mtkclient/Library/mtk_da_cmd.py", line 119, in configure_da
    if not mtk.daloader.upload_da(preloader=preloader):
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mtkclient/Library/mtk_daloader.py", line 211, in upload_da
    return self.da.upload_da()
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mtkclient/Library/mtk_daxflash.py", line 1170, in upload_da
    if self.upload():
       ^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mtkclient/Library/mtk_daxflash.py", line 1092, in upload
    da2 = self.xft.patch_da2(da2)
          ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mtkclient/Library/xflash_ext.py", line 193, in patch_da2
    da2patched[is_security_enabled:is_security_enabled + 2] = b"\x00\x23"
                                   ~~~~~~~~~~~~~~~~~~~~^~~
TypeError: unsupported operand type(s) for +: 'NoneType' and 'int'
@bkerler
Copy link
Owner

bkerler commented Sep 1, 2023

Thanks, I will have a look :)

@bkerler bkerler self-assigned this Sep 1, 2023
@bkerler bkerler added the bug Something isn't working label Sep 1, 2023
@bkerler
Copy link
Owner

bkerler commented Sep 1, 2023

The MT6789 da has a complete different command structure using xml commands. In order to support the mt6789 DA, please try to use sp flash v6 for reading back data and try to sniff the usb connection (for example using wireshark) and upload the pcapng over here.

@JamiKettunen
Copy link
Author

Hope this helps, used spflash v6 readback with read pt and captured the following with wireshark (had to zip due to github upload rules):
gx4-readback-read-pt.pcapng.zip

@bkerler
Copy link
Owner

bkerler commented Sep 4, 2023

Yes, that helps a lot. Which files did you use for the V6 spflash tool ?

@bkerler bkerler added the enhancement New feature or request label Sep 4, 2023
@JamiKettunen
Copy link
Author

These should be everything relevant: DA_BR.zip MT6789_Android_scatter.xml.txt

This was referenced Sep 6, 2023
Closed
Closed
Closed
This was referenced Sep 12, 2023
Closed
Closed
@Shakib-BD
Copy link

Is there any way to contact with you? @JamiKettunen

@Shakib-BD Shakib-BD mentioned this issue Sep 25, 2023
Closed
@Bossrd
Copy link

Bossrd commented Sep 25, 2023

These should be everything relevant: DA_BR.zip MT6789_Android_scatter.xml.txt

hi bro, you still work on its ?

@hopez13
Copy link

hopez13 commented Sep 26, 2023

Have Attached Following Files In Issue #789 If Required
rock

Thanks A Lot For Your Great Work 👍🙏

@Shakib-BD
Copy link

issue fixed?

@hopez13
Copy link

hopez13 commented Sep 29, 2023

not yet

issue fixed?

@hopez13 hopez13 mentioned this issue Sep 29, 2023
Closed
@hopez13
Copy link

hopez13 commented Oct 4, 2023

@bkerler any updates regarding this issue?

This was referenced Oct 9, 2023
Closed
Closed
Closed
Closed
@bkerler bkerler changed the title MT6789 da2 patching results in TypeError MT6789 da2 patching results in TypeError / Support for newer V6 / bootrom patched based devices (MT68xx/MT69xx) Oct 9, 2023
@davidlip123
Copy link

is mt6789 supported now? @bkerler

@hopez13
Copy link

hopez13 commented Oct 9, 2023

is mt6789 supported now? @bkerler

not yet

@zeigfred
Copy link

zeigfred commented Oct 9, 2023

is mt6789 supported now? @bkerler

not yet

is it done?

@zeigfred
Copy link

zeigfred commented Oct 9, 2023

is mt6789 supported now? @bkerler

not yet

can this fix realme 10?

@fayaz-modz
Copy link

any updates?

Why? You bricked your Redmi Pad (Yunluo)?

Yes. It's a hard brick, can you help me somehow

@Shakib-BD
Copy link

any updates?

Why? You bricked your Redmi Pad (Yunluo)?

Yes. It's a hard brick, can you help me somehow

Yes. I'm Redmi 11 Prime 4G (rock) user. Same SoC as your Yunluo. I also bricked my rock few month ago. But i revived it to mi auth flash. But it's paid. I can you help. PM me (TG : @Shakib_BD)

@TechySkills
Copy link

I just got a device with this chip, my first interest is in dumping rom. Can I help in any way?

You said "can you help" while you actually need help yourself. There is no way to dump partitions with SP Flash Tool as well as Mtk client tool, as SP Flash tool is server auth protected, and mtk client tool is working on fix, which idk maybe could take months maybe years, or maybe... NEVER.... becaue of difference between OEM's and SLA and DAA being true or false on some devices with same chipset so it depends, tho, AMT Tool, has an option to backup nvram, or you could use maybe TWRP or OFRP, to make backup

@ari-s
Copy link

ari-s commented Feb 19, 2024

You said "can you help" while you actually need help yourself.

both can be true. I can code python, have debugging skills, can dump traffic ...

@syzminek
Copy link

Bricked realme 10 4G (rmx3630), does someone know how to fix this problem? Or do i need to wait for the app to support the V6

@Shakib-BD
Copy link

Bricked realme 10 4G (rmx3630), does someone know how to fix this problem? Or do i need to wait for the app to support the V6

I can help. But Paid.

@TechySkills
Copy link

Bricked realme 10 4G (rmx3630), does someone know how to fix this problem? Or do i need to wait for the app to support the V6

I can help. But Paid.

Hmm, which tool would you use?

@Shakib-BD
Copy link

Bricked realme 10 4G (rmx3630), does someone know how to fix this problem? Or do i need to wait for the app to support the V6

I can help. But Paid.

Hmm, which tool would you use?

Auth key. not tool. using auth key + msm download tool

@hopez13
Copy link

hopez13 commented Feb 25, 2024

@Mavigsm how did you dump MT6789 BOOT ROM ( #932 ) ?

#932 (comment)

@bkerler

@Shakib-BD Shakib-BD mentioned this issue Feb 25, 2024
Closed
@idanyas
Copy link

idanyas commented Feb 25, 2024

Hi @Shakib-BD, can you please help to remove Red State from my Infinix Note 12 2023?

@Shakib-BD
Copy link

Hi @Shakib-BD, can you please help to remove Red State from my Infinix Note 12 2023?

PM me in TG // @Shakib_BD

@zaiden33
Copy link

zaiden33 commented Mar 6, 2024

For the MT6789 Devices if you have troubles like bootloop, frp lock the easiest way is to have this tools : "ANDROID MULTI TOOL" and "TFM TOOL PRO"

@bkerler bkerler closed this as completed Mar 6, 2024
@Shakib-BD
Copy link

For the MT6789 Devices if you have troubles like bootloop, frp lock the easiest way is to have this tools : "ANDROID MULTI TOOL" and "TFM TOOL PRO"

Poco M5, Redmi 11 Prime 4G, Redmi Pad, Poco M6 Pro also MT6789 G99, those tools are not support for this devices.

@Leotaku-senpai
Copy link

Was it closed, does this mean that the unbrick of the poco m5 has already been implemented in the new update?

@TechySkills
Copy link

TechySkills commented Mar 8, 2024 via email

@embzhezh
Copy link

There were so many hopes..... :(

@hopez13
Copy link

hopez13 commented Mar 16, 2024 •
edited

solution is available I guess but not being made public ☹️

@TechySkills
Copy link

TechySkills commented Mar 19, 2024 via email

@Shakib-BD
Copy link

@bkerler I think you should not open source solution but should share solution through encrypted pre built package or something similar where solution cannot be reverse engineering but must be usable

No response, sir iz busy 😁

@hopez13
Copy link

hopez13 commented Mar 20, 2024

@bkerler It is advisable not to distribute the solution as open-source. Instead, it should be shared through an encrypted, pre-built package. This approach ensures the solution remains secure and non-reversible, yet fully functional for the end-user.

@TechySkills
Copy link

TechySkills commented Mar 20, 2024 via email

@hopez13
Copy link

hopez13 commented Mar 20, 2024 •
edited

just talking about mediatek new boot rom mt6789 solution if made public other tools will copy and sell solution so it's better to distribute it without open sourcing it

@Shakib-BD
Copy link

just talking about mediatek new boot rom mt6789 solution if made public other tools will copy and sell solution so it's better to distribute it without open sourcing it

Then, from where we can get this solution if private?

@hopez13
Copy link

hopez13 commented Mar 21, 2024

in form of prebuilt package here

@TechySkills
Copy link

TechySkills commented Mar 23, 2024 via email

@hopez13
Copy link

hopez13 commented Apr 9, 2024

any progress @bkerler ?

@jesushrek
Copy link

Bruh, Your logic is so dumb. Like if we open source it, which idiot will buy it? Let others copy and learn, at least some people will be able to look at the code and like learn about this new V6 patch which is not a hardware but a software patch. Regards TechySkills
…
On Thu, Mar 21, 2024 at 7:20 AM hopez13 @.> wrote: in form of prebuilt package here — Reply to this email directly, view it on GitHub <#758 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ATS23J2A4HQTDZV5PGNMA5LYZI7XFAVCNFSM6AAAAAA3VDJ5A6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJRGA3DQNRWHE . You are receiving this because you commented.Message ID: @.>

I think he is right if he doesn't reveal the exploit mediatek won't be able to fix it and it would work for a really long time. Its a win win if he keep the solution private :)

@TechySkills
Copy link

TechySkills commented Apr 11, 2024 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bkerler bkerler

Labels
bug Something isn't working enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests