MT6789 boot rom

[Mavigsm]

brom_v6_1208.zip

[Shakib-BD]

Wow. we still can hope for MT6789 . Thanks #758

[Mavigsm]

I managed to get a bootrom backup. but it is not like the previous bootroms. This is an exploit from bootrom, only @bkerler can fix it

[hopez13]

from which device you extracted it?

[Mavigsm]

from which device you extracted it?

Xiaomi Poco M5 (rock)

[rijp]

I managed to get a bootrom backup. but it is not like the previous bootroms. This is an exploit from bootrom, only @bkerler can fix it

Good work! I am researching brom_v6 on RMX3630 now. Can you send how to get brom dump on V6 devices? Probably, there are
similar vulnerabilities that can be exploited in brom mode, like CVE-2024-20042. If I can do it, a new fix from me.

[hopez13]

@bkerler please check this and also please reopen this issue and #758

[hopez13]

MT6789 is affected by these recent ones
CVE-2023-20819 ( EoP CDMA PPP )
CVE-2023-32823 ( EoP rpmb )
CVE-2023-32824 ( EoP rpmb )
CVE-2023-32834 ( EoP secmem )
CVE-2023-32853 ( EoP rpmb )
CVE-2023-32859 (EoP meta )
CVE-2023-32874 (RCE Modem IMS )

CVE-2024-20005 ( EoP da )
CVE-2024-20022 ( EoP lk )
CVE-2024-20032 ( EoP aee )
CVE-2024-20033 ( ID nvram )
CVE-2024-20037 ( EoP pq )
CVE-2024-20038 ( ID pq )
CVE-2024-20039 ( RCE modem )
CVE-2024-20040 ( EoP wlan firmware)
CVE-2024-20041 ( ID da )
there's are many EoP in DA but MT6789 is not affected by all as per MTK security Bulletins

this is not exhaustive list but I think these are more relevant

@bkerler

[hopez13]

da related but mt6789 may not be affected by all
CVE-2024-20041
CVE-2024-20042
CVE-2024-20043
CVE-2024-20044
CVE-2024-20005
CVE-2024-20025
CVE-2024-20026
CVE-2024-20027
CVE-2024-20028
CVE-2024-20030
CVE-2024-20031

[bkerler]

None of these affects the bootrom nor da1. Da2 is useless without da1 signed loaders which aren't available.

[hopez13]

@bkerler any luck with mt6789 brom dump?

this tool might be helpful in detection of CWE-787 etc
https://github.com/fkie-cad/cwe_checker

[hopez13]

from which device you extracted it?

Xiaomi Poco M5 (rock)

i have same device but it's not possible to extract bootrom from it as it has SLA DAA SBC etc all enabled I want to understand the process you followed to extract it !!!

[hopez13]

@bkerler bro atleast please can you share Brom dump if you have extracted it from your GIGASET GX4

[Shakib-BD]

@bkerler bro atleast please can you share Brom dump if you have extracted it from your GIGASET GX4

We almost succeeded to made an engineering rom for our device Poco M5 & Redmi 11 Prime 4G (Rock). Now we can unbrick our device without mi auth. But, we have to flash patched preloader.bin ‘including some other images/files’ before brick our device. (We made a script for it). It's still in experimental conditions, not public yet. #757

[hopez13]

CVE-2024-20056 ( EoP preloader ) affects Mt6789

@bkerler can it be helpful in dumping brom

check here for more https://github.com/advisories?query=preloader+mediatek