MTK-bypass / exploits_collection

278 stars 97 forks source link

MT6771, Unihertz Titan (UFS-Memory) bricked dead, after flashing with wrong Stock-Rom #44

Open TommelTwo opened 1 year ago

TommelTwo commented 1 year ago

today with mtkclient mtk_gui mtk_gui log: [10:01:47]: Device is unprotected. [10:01:47]: Device is in BROM-Mode. Bypassing security. [10:01:47]: Loading payload from mt6771_payload.bin, 0x264 bytes [10:01:47]: Kamakiri / DA Run [10:01:47]: Trying kamakiri2.. [10:01:47]: Done sending payload... [10:01:47]: Successfully sent payload: C:\mtkclient-main\mtkclient\payloads\mt6771_payload.bin [10:01:47]: Device is in BROM mode. No preloader given, trying to dump preloader from ram. [10:01:48]: Patched "Patched loader msg" in preloader [10:01:48]: Patched "Patched loader msg" in preloader [10:01:48]: Patched "get_vfy_policy" in preloader

Phone detected: MT6771, Jumping to 0x200000: ok

...and stopped.

In same time terminal-log: Port - Device detected :) Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x788 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 5649224A4BD6F0263F7ABC130DCE05AA Preloader - SOC_ID: 67EB8D8456F3D36A30C5801507195F549290F216EF032600F78136D5E0D540D5 Port - Device detected :) DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA.bin xflashext - Patching da1 ... xflashext xflashext - [LIB]: Error on patching da1 version check... xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - UFS Blocksize:0x1000 DAXFlash - UFS ID: KM2V8001CM-B70 DAXFlash - UFS MID: 0xce DAXFlash - UFS CID: ce014b4d325638303031434d2d423730 DAXFlash - UFS FWVer: 31303030 DAXFlash - UFS Serial: 343963633266653031363164 DAXFlash - UFS LU0 Size: 0x1dcb000000 DAXFlash - UFS LU1 Size: 0x400000 DAXFlash - UFS LU2 Size: 0x400000 DAXFlash - DRAM config needed for : ce014b4d325638303031434d2d423730 DAXFlash - Sending emi data ... DAXFlash DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes None

What is the problem inside the Device?

rohit4989 commented 1 year ago

today with mtkclient mtk_gui mtk_gui log: [10:01:47]: Device is unprotected. [10:01:47]: Device is in BROM-Mode. Bypassing security. [10:01:47]: Loading payload from mt6771_payload.bin, 0x264 bytes [10:01:47]: Kamakiri / DA Run [10:01:47]: Trying kamakiri2.. [10:01:47]: Done sending payload... [10:01:47]: Successfully sent payload: C:\mtkclient-main\mtkclient\payloads\mt6771_payload.bin [10:01:47]: Device is in BROM mode. No preloader given, trying to dump preloader from ram. [10:01:48]: Patched "Patched loader msg" in preloader [10:01:48]: Patched "Patched loader msg" in preloader [10:01:48]: Patched "get_vfy_policy" in preloader

Phone detected: MT6771, Jumping to 0x200000: ok

...and stopped.

In same time terminal-log: Port - Device detected :) Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x788 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 5649224A4BD6F0263F7ABC130DCE05AA Preloader - SOC_ID: 67EB8D8456F3D36A30C5801507195F549290F216EF032600F78136D5E0D540D5 Port - Device detected :) DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA.bin xflashext - Patching da1 ... xflashext xflashext - [LIB]: Error on patching da1 version check... xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - UFS Blocksize:0x1000 DAXFlash - UFS ID: KM2V8001CM-B70 DAXFlash - UFS MID: 0xce DAXFlash - UFS CID: ce014b4d325638303031434d2d423730 DAXFlash - UFS FWVer: 31303030 DAXFlash - UFS Serial: 343963633266653031363164 DAXFlash - UFS LU0 Size: 0x1dcb000000 DAXFlash - UFS LU1 Size: 0x400000 DAXFlash - UFS LU2 Size: 0x400000 DAXFlash - DRAM config needed for : ce014b4d325638303031434d2d423730 DAXFlash - Sending emi data ... DAXFlash DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes None

What is the problem inside the Device?

Problem is the mtk client, if you can succesfully send the payload to your device then flash your phone with sp flash tools not with mtk client. MTK client is trash, sp flash tools for the win bro ! If your phone's still dead then feel free to message me but my instructions should be enough for you.

1) Send payload to the device. 2) Open sp flash tools and flash your device. 3) Shift delete mtk client. 4) Thank me later.

TommelTwo commented 1 year ago

Thank you. The device works again!!!

08.07.2023 18:06:38 Rohit Paniker @.***>:

today with mtkclient mtk_gui mtk_gui log: [10:01:47]: Device is unprotected. [10:01:47]: Device is in BROM-Mode. Bypassing security. [10:01:47]: Loading payload from mt6771_payload.bin, 0x264 bytes [10:01:47]: Kamakiri / DA Run [10:01:47]: Trying kamakiri2.. [10:01:47]: Done sending payload... [10:01:47]: Successfully sent payload: C:\mtkclient-main\mtkclient\payloads\mt6771_payload.bin [10:01:47]: Device is in BROM mode. No preloader given, trying to dump preloader from ram. [10:01:48]: Patched "Patched loader msg" in preloader [10:01:48]: Patched "Patched loader msg" in preloader [10:01:48]: Patched "get_vfy_policy" in preloader

Phone detected: MT6771, Jumping to 0x200000: ok

...and stopped.

In same time terminal-log: Port - Device detected :) Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x788 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 5649224A4BD6F0263F7ABC130DCE05AA Preloader - SOC_ID: 67EB8D8456F3D36A30C5801507195F549290F216EF032600F78136D5E0D540D5 Port - Device detected :) DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA.bin xflashext - Patching da1 ... xflashext xflashext - [LIB]: Error on patching da1 version check... xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - UFS Blocksize:0x1000 DAXFlash - UFS ID: KM2V8001CM-B70 DAXFlash - UFS MID: 0xce DAXFlash - UFS CID: ce014b4d325638303031434d2d423730 DAXFlash - UFS FWVer: 31303030 DAXFlash - UFS Serial: 343963633266653031363164 DAXFlash - UFS LU0 Size: 0x1dcb000000 DAXFlash - UFS LU1 Size: 0x400000 DAXFlash - UFS LU2 Size: 0x400000 DAXFlash - DRAM config needed for : ce014b4d325638303031434d2d423730 DAXFlash - Sending emi data ... DAXFlash DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes None

What is the problem inside the Device?

Problem is the mtk client, if you can succesfully send the payload to your device then flash your phone with sp flash tools not with mtk client. MTK client is trash, sp flash tools for the win bro !

— Reply to this email directly, view it on GitHub[https://github.com/MTK-bypass/exploits_collection/issues/44#issuecomment-1627389736], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AQVYZYD3BWI6UVIUFGRVWNLXPGAQ3ANCNFSM6AAAAAAZHQLN24]. You are receiving this because you authored the thread.[Verfolgungsbild][https://github.com/notifications/beacon/AQVYZYFP2PMB2SZCEDIHC73XPGAQ3A5CNFSM6AAAAAAZHQLN26WGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTTA777SQ.gif]

rohit4989 commented 1 year ago

Welcome 😄

On Sat, 8 Jul, 2023, 11:29 pm TommelTwo, @.***> wrote:

Thank you. The device works again!!!

08.07.2023 18:06:38 Rohit Paniker @.***>:

today with mtkclient mtk_gui mtk_gui log: [10:01:47]: Device is unprotected. [10:01:47]: Device is in BROM-Mode. Bypassing security. [10:01:47]: Loading payload from mt6771_payload.bin, 0x264 bytes [10:01:47]: Kamakiri / DA Run [10:01:47]: Trying kamakiri2.. [10:01:47]: Done sending payload... [10:01:47]: Successfully sent payload: C:\mtkclient-main\mtkclient\payloads\mt6771_payload.bin [10:01:47]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.

"Patched loader msg" in preloader [10:01:48]: Patched "get_vfy_policy" in preloader

Phone detected: MT6771, Jumping to 0x200000: ok

...and stopped.

In same time terminal-log: Port - Device detected :) Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x788 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 5649224A4BD6F0263F7ABC130DCE05AA Preloader - SOC_ID: 67EB8D8456F3D36A30C5801507195F549290F216EF032600F78136D5E0D540D5 Port - Device detected :) DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA.bin xflashext - Patching da1 ... xflashext xflashext - [LIB]: Error on patching da1 version check... xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - UFS Blocksize:0x1000 DAXFlash - UFS ID: KM2V8001CM-B70 DAXFlash - UFS MID: 0xce DAXFlash - UFS CID: ce014b4d325638303031434d2d423730 DAXFlash - UFS FWVer: 31303030 DAXFlash - UFS Serial: 343963633266653031363164 DAXFlash - UFS LU0 Size: 0x1dcb000000 DAXFlash - UFS LU1 Size: 0x400000 DAXFlash - UFS LU2 Size: 0x400000 DAXFlash - DRAM config needed for : ce014b4d325638303031434d2d423730 DAXFlash - Sending emi data ... DAXFlash DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes None

What is the problem inside the Device?

Problem is the mtk client, if you can succesfully send the payload to your device then flash your phone with sp flash tools not with mtk client. MTK client is trash, sp flash tools for the win bro !

— Reply to this email directly, view it on GitHub[ https://github.com/MTK-bypass/exploits_collection/issues/44#issuecomment-1627389736], or unsubscribe[ https://github.com/notifications/unsubscribe-auth/AQVYZYD3BWI6UVIUFGRVWNLXPGAQ3ANCNFSM6AAAAAAZHQLN24].

You are receiving this because you authored the thread.[Verfolgungsbild][ https://github.com/notifications/beacon/AQVYZYFP2PMB2SZCEDIHC73XPGAQ3A5CNFSM6AAAAAAZHQLN26WGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTTA777SQ.gif]

— Reply to this email directly, view it on GitHub https://github.com/MTK-bypass/exploits_collection/issues/44#issuecomment-1627447468, or unsubscribe https://github.com/notifications/unsubscribe-auth/AVJX4ZNJ2EE6YYL3SDWEEZDXPGNYHANCNFSM6AAAAAAZHQLN24 . You are receiving this because you commented.Message ID: @.***>