Closed DavidBuchanan314 closed 1 month ago
same for me
and similar to https://github.com/bkerler/mtkclient/issues/947
It seems that the issue is caused by the self.da_write(ptr_send, 4, pack("<I", payloadaddr), False)
line in the exploit() function of kamakiri2.py.
mtk dumppreloader
worked as-ismtk dumpbrom
failed with the following backtrace:(note, I patched
kamakiri2.py
to add in araise e
to actually get the backtrace instead of just logging the error)So, I tried
mtk brute
, which succeeded withFound 0xc28c, dumping bootrom to brom_766.bin
(attached)brom_766.bin.zip