Skip to content

Instantly share code, notes, and snippets.

@javashin
Created December 27, 2022 18:13
Show Gist options
  • Save javashin/8cc0e147f92604797fbdb28e6a868661 to your computer and use it in GitHub Desktop.
Save javashin/8cc0e147f92604797fbdb28e6a868661 to your computer and use it in GitHub Desktop.
[javashin@igloo ~]$ sudo su
[root@igloo javashin]# cd /root/mtkclient/
[root@igloo mtkclient]# python mtk e metadata,userdata,md_udc
MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
.......Port - Device detected :)
Preloader - CPU: MT6765/MT8768t(Helio P35/G35)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x766
Preloader - Target config: 0x5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Mtk - We're not in bootrom, trying to crash da...
PLTools - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: DAA_SIG_VERIFY_FAILED (0x7024)
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Jumping to 0x0
DeviceClass - USBError(19, 'No such device (it may have been disconnected)')
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
DeviceClass
DeviceClass - [LIB]: Couldn't get device configuration.
Port - Device detected :)
Preloader - CPU: MT6765/MT8768t(Helio P35/G35)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x766
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 969E54D01246234FEF784175E755B78D
Preloader - SOC_ID: 28E1F4096CBDB601F1DCF97DD20EEB4A01ACC1BEF528C0E20B0E069D8D8161D0
PLTools - Loading payload from mt6765_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /root/mtkclient/mtkclient/payloads/mt6765_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from .MTK_AllInOne_DA_5.1824.bin.
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
xflashext
xflashext - [LIB]: Error on patching da1 version check...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 1501004758364241
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - EMMC FWVer: 0x0
DAXFlash - EMMC ID: GX6BAB
DAXFlash - EMMC CID: 15010047583642414200af50079b59c3
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size: 0x0
DAXFlash - EMMC GP2 Size: 0x0
DAXFlash - EMMC GP3 Size: 0x0
DAXFlash - EMMC GP4 Size: 0x0
DAXFlash - EMMC RPMB Size: 0x1000000
DAXFlash - EMMC USER Size: 0x747c00000
DAXFlash - HW-CODE : 0x766
DAXFlash - HWSUB-CODE : 0x8A00
DAXFlash - HW-VERSION : 0xCA00
DAXFlash - SW-VERSION : 0x0
DAXFlash - CHIP-EVOLUTION : 0x0
DAXFlash - DA-VERSION : 1.0
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - DA Extensions successfully added
DAXFlash - Formatting addr 0x13c00000 with length 0x2000000, please standby....
Progress: |██████████████████████████████████████████████████| 100.0% Erasing (Sector 0x10000 of 0x10000, ) 209.77 MB/s
DAXFlash - Successsfully formatted addr 0x13c00000 with length 33554432.
Formatted sector 647168 with sector count 65536.
DAXFlash - Formatting addr 0x1c2a00000 with length 0x584e00000, please standby....
Progress: |██████████████████████████████████████████████████| 100.0% Erasing (Sector 0x2C27000 of 0x2C27000, ) 82194.06 MB/s
DAXFlash - Successsfully formatted addr 0x1c2a00000 with length 23704109056.
Formatted sector 14766080 with sector count 46297088.
DAXFlash - Formatting addr 0x17c00000 with length 0x169a000, please standby....
Progress: |██████████████████████████████████████████████████| 100.0% Erasing (Sector 0xB4D0 of 0xB4D0, ) 144.58 MB/s
DAXFlash - Successsfully formatted addr 0x17c00000 with length 23699456.
Formatted sector 778240 with sector count 46288.
All partitions formatted.
[root@igloo mtkclient]#
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment