bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.55k stars 510 forks source link

My Device cannot Connect #101

Closed Linssang closed 2 years ago

Linssang commented 2 years ago

Already put USB no button usb with power up (Handshake failure) usb with power down and up (Handshake failure) what the problem?

`C:\MTK>python mtk e backup --preloader=preloader_k65v1_64_bsp.bin MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb.`

ghost commented 2 years ago

Have you tested the command

UsbDkController -n

I don't use windows because I prefer linux but I think there is an issue on comunication Whats does means "Already put USB no button"? You should run before the command and after connect the device. Usually I detach the battery and I use only usb power.

Linssang commented 2 years ago

Have you tested the command

UsbDkController -n

I don't use windows because I prefer linux but I think there is an issue on comunication Whats does means "Already put USB no button"? You should run before the command and after connect the device. Usually I detach the battery and I use only usb power.

this command i use, the result C:\Program Files\UsbDk Runtime Library>UsbDkController -n Enumerate USB devices Found 5 USB devices:

  1. FilterID: 1, Port: 5, ID: 046d:c534, Configs: 1, Speed: 2 USB\VID_046D&PID_C534 5 Descriptor for configuration #0: size 59
  2. FilterID: 1, Port: 6, ID: 05e3:0608, Configs: 1, Speed: 3 USB\VID_05E3&PID_0608 6 Descriptor for configuration #0: size 25
  3. FilterID: 1, Port: 4, ID: 04f2:b5c5, Configs: 1, Speed: 3 USB\VID_04F2&PID_B5C5 200901010001 Descriptor for configuration #0: size 542
  4. FilterID: 3, Port: 3, ID: 1c7a:0570, Configs: 1, Speed: 2 USB\VID_1C7A&PID_0570 3 Descriptor for configuration #0: size 32
  5. FilterID: 3, Port: 4, ID: 04ca:3016, Configs: 1, Speed: 2 USB\VID_04CA&PID_3016 4 Descriptor for configuration #0: size 177

did i miss some step?

ghost commented 2 years ago

If windows detect correctly the serial port the tool should work. Have you an exception or the tool remaing in waiting state?

Linssang commented 2 years ago

If windows detect correctly the serial port the tool should work. Have you an exception or the tool remaing in waiting state?

dont have it sir already installing new mtk usb driver but result still same.

did UsbDkController not working properly? already reinstall but the result same

i use new windows, the result still same if i use another bypass program. the program work properly

Linssang commented 2 years ago

Mtk Bypass tool by: Mofadal Waiting for mtk usb device... ok BootMode : BootLoader[COM3] USBDriver : wdm_usb:3.0.1504.0:01/22/2015 Connecting to BootROM...... ● Chipset MT6765 ● Identifier Helio P35 ● Info 8A00_CA00_0000_cervino Switch preloader to bootrom...crash succeed! Waiting for mtk usb device... ok BootMode : BootRom[COM4] USBDriver : wdm_usb:10.0.19041.1202:06/21/2006 Connecting to BootROM...... ● Chipset MT6765 ● Identifier Helio P35 ● Info 8A00_CA00_0000_cervino ● MEID:EF0E2820A963DF7DBB50AE63A8FB677E ● SecCFG SBC+SDA Disabling watchdog.. Latching powerkey for WDT... Transferring control to BRom... Claiming custom memory area! MTK Auth Disable(SLA/DAA) success! now you can use SP Flash Tool or any MTK Tool

then i use this, showing error like this

C:\mtk>python mtk e backup MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile Preloader Preloader - [LIB]: ←[31mStatus: Handshake failed, retrying...←[0m Port - Device detected :) Preloader - CPU: MT6765(Helio P35/G35) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0x25 Preloader - Disabling Watchdog... Preloader - HW code: 0x766 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: EF0E2820A963DF7DBB50AE63A8FB677E Preloader - SOC_ID: 4C1C7CBAEA02C96754DC6F04BE64C5EB785FA2B74509BE5E240F1392712D7D93 Main - Device is unprotected. PLTools - Loading payload from mt6765_payload.bin, 0x264 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Error, payload answered instead: Mtk Mtk - [LIB]: ←[31mError on running kamakiri payload←[0m Main Main - [LIB]: ←[33mDevice is in BROM mode. No preloader given, trying to dump preloader from ram.←[0m Main Main - [LIB]: ←[31mFailed to dump preloader from ram.←[0m DAXFlash - Uploading stage 1 from MTK_AllInOne_DA_5.1824.bin Preloader Preloader - [LIB]: ←[31mError on DA_Send cmd←[0m DAXFlash DAXFlash - [LIB]: ←[31mError on sending DA.←[0m Main Main - [LIB]: ←[31mError uploading `da←[0m

did i miss some step on installing?

ghost commented 2 years ago

Try to follow this suggestion from @bkerler Seem which MTK_AllInOne_DA_5.1824.bin on Windows has some issue.

Linssang commented 2 years ago

Try to follow this suggestion from @bkerler Seem which MTK_AllInOne_DA_5.1824.bin on Windows has some issue.

then whathappen on my driver then? why i cant connect my phone without bypass tool? i think my driver working fine did the mtkclient have some issue?

ghost commented 2 years ago

On my device I must run mtk payload before start to use mtkclient. mtk payload do the same operations of bypass tool. Try

Linssang commented 2 years ago

On my device I must run mtk payload before start to use mtkclient. mtk payload do the same operations of bypass tool. Try

  • to delete the file MTK_AllInOne_DA_5.1824.bin
  • mtk payload
  • mtk e backup

mtk payload cannot detect my device sir i try mtk crash the port detect

what to do next? mtk payload? > Result Handshake failed

ghost commented 2 years ago

You have 2 issues:

for first issue you should wait @bkerler which has a big experience on that, for second issue it should solve with the remove of file MTK_AllInOne_DA_5.1824.bin . Try to execute the same steps which you have executed here after the file is deleted. Where is you find this tool "Mtk Bypass tool by: Mofadal"? I can't find it and I would like to try it.

Linssang commented 2 years ago

You have 2 issues:

  • detect device
  • execute operations

for first issue you should wait @bkerler which has a big experience on that, for second issue it should solve with the remove of file MTK_AllInOne_DA_5.1824.bin . Try to execute the same steps which you have executed here after the file is deleted. Where is you find this tool "Mtk Bypass tool by: Mofadal"? I can't find it and I would like to try it.

https://www.facebook.com/mofadal.96

here sir

bkerler commented 2 years ago

The answer is simple: The vid and pid isn't the generic mtk one, because you're not connecting in brom but preloader mode. You need to enter brom mode (keep vol up + down pressed while connecting usb) or add the device specific vid and pid to the usbids.py in mtkclient/config and hope that the device crashes to brom mode. There is no need to call "payload" at all if you're in brom mode.

bkerler commented 2 years ago

The other tools which also use our exploit just work because they aren't connecting via libusb but via serial instead, that's my best guess.

Linssang commented 2 years ago

The answer is simple: The vid and pid isn't the generic mtk one, because you're not connecting in brom but preloader mode. You need to enter brom mode (keep vol up + down pressed while connecting usb) or add the device specific vid and pid to the usbids.py in mtkclient/config and hope that the device crashes to brom mode. There is no need to call "payload" at all if you're in brom mode.

after do mtk e

then i want to mtk reset the device stop the device in device manager show "Unknown USB Device (Device Descriptor Request Failed)"

before that device manager show "USBDK?" did usb dk error? here the log C:\mtkclient-main>py mtk reset MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021

Traceback (most recent call last): File "C:\mtkclient-main\mtk", line 1709, in mtk = Main(args).run() File "C:\mtkclient-main\mtk", line 632, in run info=mtk.daloader.reinit() File "C:\mtkclient-main\mtkclient\Library\mtk_daloader.py", line 61, in reinit self.da.reinit() File "C:\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 994, in reinit self.sram, self.dram = self.get_ram_info() File "C:\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 482, in get_ram_info resp = self.send_devctrl(self.Cmd.GET_RAM_INFO) File "C:\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 260, in send_devctrl status[0] = self.status() File "C:\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 211, in status magic, datatype, length = unpack("<III", hdr) struct.error: unpack requires a buffer of 12 bytes

ghost commented 2 years ago

There is no need to call "payload" at all if you're in brom mode.

Thank you, I pressed vol up and was convinced that it entered brom mode, but without mtk payload nothing was working. It is vol down to enter brom on my nokia device, now I can execute only one command.

hlbomfim commented 2 years ago

For me, passed but I get: "usb_class - [LIB]: ←[31mCouldn't get device configuration.←[0m"

Windows 10

bkerler commented 2 years ago

@hlbomfim Make sure that you have installed the right mtk port driver for both stages and that there is no exclamation mark in the device manager.

bkerler commented 2 years ago

Closing this issue now, as no further questions were provided.

niuzaiSu commented 8 months ago

现在关闭此问题,因为没有提供进一步的问题。

Hello, can you help me to answer this question? Thank you so much!

https://github.com/bkerler/mtkclient/issues/876