RabbitHoleEscapeR1 / r1_escape

321 stars 32 forks source link

Myriad of errors when trying to restore from Proton Drive zip #73

Open WPTK opened 2 weeks ago

WPTK commented 2 weeks ago

I'm following the restore guide for Windows, as my rabbit just got stuck bootlooping during the initial flash process. Now the device says it's untrusted and can't run. So when I try to run

python -m mtk wl "c:/r1/" --serialport

it will run fine...

...DeviceClass - Warning !
Port - Device detected :)
Port - Handshake successful.
Preloader -     CPU:                    MT6765/MT8768t(Helio P35/G35)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212000
Preloader -     Var1:                   0x25
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x766
Preloader - Target config:              0x0
Preloader -     SBC enabled:            False
Preloader -     SLA enabled:            False
Preloader -     DAA enabled:            False
Preloader -     SWJTAG enabled:         False
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          False
Preloader -     Mem write auth:         False
Preloader -     Cmd 0xC8 blocked:       False
Preloader - Get Target info
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xca00
Preloader -     SW Ver:                 0x0
Preloader - ME_ID:                      4CB679C12FCEB9738E567C3B87815313
Preloader - SOC_ID:                     26102020517F841D1758DA36D978024393D1E5F0EB2118079ECF90E6EED0ED97
DaHandler - Device is unprotected.
DaHandler - Device is in Preloader-Mode.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - EMMC FWVer:      0x0
DAXFlash - EMMC ID:         DV6DAB
DAXFlash - EMMC CID:        15010044563644414202c5326a474915
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size:   0x0
DAXFlash - EMMC GP2 Size:   0x0
DAXFlash - EMMC GP3 Size:   0x0
DAXFlash - EMMC GP4 Size:   0x0
DAXFlash - EMMC RPMB Size:  0x1000000
DAXFlash - EMMC USER Size:  0x1d1ec00000
DAXFlash - HW-CODE         : 0x766
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCA00
DAXFlash - SW-VERSION      : 0x0
DAXFlash - CHIP-EVOLUTION  : 0x0
DAXFlash - DA-VERSION      : 1.0

then I get these errors.

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\BK\Downloads\mtkclient\mtk.py", line 1000, in <module>
    mtk = Main(args).run(parser)
          ^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\mtk_main.py", line 662, in run
    mtk = da_handler.configure_da(mtk, preloader)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\DA\mtk_da_handler.py", line 162, in configure_da
    if not mtk.daloader.upload_da(preloader=preloader):
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\DA\mtk_daloader.py", line 297, in upload_da
    return self.da.upload_da()
           ^^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\DA\xflash\xflash_lib.py", line 1242, in upload_da
    if self.boot_to(addr=0x68000000, da=daextdata):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\DA\xflash\xflash_lib.py", line 286, in boot_to
    if self.send_data(da):
       ^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\DA\xflash\xflash_lib.py", line 272, in send_data
    status = self.status()  # 0xC0070004
             ^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\DA\xflash\xflash_lib.py", line 134, in status
    hdr = self.usbread(4 + 4 + 4)
          ^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\Downloads\mtkclient\mtkclient\Library\Connection\seriallib.py", line 214, in usbread
    self.device.timeout = timeout
    ^^^^^^^^^^^^^^^^^^^
  File "C:\Users\BK\AppData\Local\Programs\Python\Python312\Lib\site-packages\serial\serialutil.py", line 372, in timeout
    self._reconfigure_port()
  File "C:\Users\BK\AppData\Local\Programs\Python\Python312\Lib\site-packages\serial\serialwin32.py", line 222, in _reconfigure_port
    raise SerialException(
serial.serialutil.SerialException: Cannot configure port, something went wrong. Original message: PermissionError(13, 'A device attached to the system is not functioning.', None, 31)

How can I get the device back to the factory image from here? I am using the ZIP from Proton Drive as my restoration files.

WPTK commented 2 weeks ago

Now I just get these screens (in order)

image

image

image

image

scatteredbra1n commented 2 weeks ago

I am running into similar issues as you, and while I have not been successful yet, this is the closet I've gotten and I'm just waiting for the process to finish:

I recently soft-bricked my device and found only bits of information here and there, so I combined everything together to get to this point.

This process assumes you have downloaded the backup ZIP from the README.md

  1. duplicate r1.ps1 and rename it revert.ps1
  2. open the script and at the very bottom, DELETE the following lines:
    fastboot reboot-fastboot
    fastboot flash system system.img
    fastboot reboot
  3. Open a Powershell window in Admin mode
  4. Run .\revert.ps1
  5. Follow all of the prompts to unplug your device, hit enter, replug your device in. This should happen 3 times
  6. After the script completes, run fastboot reboot
  7. Change directories into the r1_escape/mtkclient/ folder
  8. Unplug your device
  9. Run python mtk wl "\path\to\r1\backup\folder\" --serialport
  10. Plug your device back in, and the process should start

I'll reply back with my findings after the process completes.

WPTK commented 2 weeks ago

Thanks @scatteredbra1n, but it is now presenting a different issue.

I'm getting the error:

Preloader - [LIB]: ←[31mStatus: Handshake failed, retrying...←[0m

The device does not power on at any point during the process.

If the device powers on, it now just sits at a screen with => FASTBOOT mode... and has to be reset via the SIM card button.