bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.57k stars 511 forks source link

mtk client failing to read from BV A90 #1157

Closed pi-dev500 closed 1 month ago

pi-dev500 commented 1 month ago

Running mtk client from Arch linux to root my phone output this:


[pi-dev500@ARCHLINUXPI-DEV500 mtkclient]$ python mtk.py r boot boot.img
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

Port - Device detected :)
Preloader -     CPU:            MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80)
Preloader -     HW version:     0x0
Preloader -     WDT:            0x10007000
Preloader -     Uart:           0x11002000
Preloader -     Brom payload addr:  0x100a00
Preloader -     DA payload addr:    0x201000
Preloader -     CQ_DMA addr:        0x10212000
Preloader -     Var1:           0xa
Preloader - Disabling Watchdog...
Preloader - HW code:            0x788
Preloader - Target config:      0x0
Preloader -     SBC enabled:        False
Preloader -     SLA enabled:        False
Preloader -     DAA enabled:        False
Preloader -     SWJTAG enabled:     False
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required: False
Preloader -     Mem read auth:      False
Preloader -     Mem write auth:     False
Preloader -     Cmd 0xC8 blocked:   False
Preloader - Get Target info
Preloader -     HW subcode:     0x8a00
Preloader -     HW Ver:         0xca00
Preloader -     SW Ver:         0x0
Preloader - ME_ID:          815549155C4FD9D42C2E2370625C6478
Preloader - SOC_ID:         6B8D0E10FB57B9F23C347E328BBEB2D2507A35195AE24ADD2D7784ED3023A121
DaHandler - Device is unprotected.
DaHandler - Device is in Preloader-Mode.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - EMMC FWVer:      0x0
DAXFlash - EMMC ID:         RH64AB
DAXFlash - EMMC CID:        15010052483634414205ac04c68c942d
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size:   0x0
DAXFlash - EMMC GP2 Size:   0x0
DAXFlash - EMMC GP3 Size:   0x0
DAXFlash - EMMC GP4 Size:   0x0
DAXFlash - EMMC RPMB Size:  0x400000
DAXFlash - EMMC USER Size:  0xe8f800000
DAXFlash - HW-CODE         : 0x788
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCA00
DAXFlash - SW-VERSION      : 0x0
DAXFlash - CHIP-EVOLUTION  : 0x0
DAXFlash - DA-VERSION      : 1.0
DAXFlash - Extensions were accepted. Jumping to extensions...
DeviceClass - USBError(5, 'Input/Output Error')
DAXFlash
DAXFlash - [LIB]: Stage was't executed. Maybe dram issue ?.
DAXFlash
DAXFlash - [LIB]: DA Extensions failed to enable
DaHandler - Requesting available partitions ....
DAXFlash
DAXFlash - [LIB]: Error on sending dev ctrl 262151:OK (0x0)
Traceback (most recent call last):
  File "/run/media/pi-dev500/Ventoy/recovery oses/Androids/Tablette/mtkclient/mtk.py", line 1000, in <module>
    mtk = Main(args).run(parser)
          ^^^^^^^^^^^^^^^^^^^^^^
  File "/run/media/pi-dev500/Ventoy/recovery oses/Androids/Tablette/mtkclient/mtkclient/Library/mtk_main.py", line 664, in run
    da_handler.handle_da_cmds(mtk, cmd, self.args)
  File "/run/media/pi-dev500/Ventoy/recovery oses/Androids/Tablette/mtkclient/mtkclient/Library/DA/mtk_da_handler.py", line 671, in handle_da_cmds
    self.da_read(partitionname=partitionname, parttype=parttype, filename=filename)
  File "/run/media/pi-dev500/Ventoy/recovery oses/Androids/Tablette/mtkclient/mtkclient/Library/DA/mtk_da_handler.py", line 210, in da_read
    if gptentry.name.lower() == partition.lower():
       ^^^^^^^^^^^^^
AttributeError: 'bool' object has no attribute 'name'

It could really help me to have access to it, to root it and get more performance, as the base software is quite bad.

bkerler commented 1 month ago

Duplicate of #1152