bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.56k stars 510 forks source link

Preloader mode terminating unexpectedly #1166

Closed Dr4g0nWr4th closed 1 week ago

Dr4g0nWr4th commented 1 month ago

On a Fire HD 10 (uses a MT8186A according to official specs, or a MT8169 according to ADB getprop):

[10:13:58]: Device detected :) [10:13:58]: Device is unprotected. [10:13:58]: Device is in Preloader-Mode. [10:13:58]: No da_loader config set up

On terminal logs:

Preloader - CPU: () Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x200000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x1169 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x0 Preloader - ME_ID: 00000000000000000000000000000000 None

I've also tried mtk brute:

Port - Device detected :) Preloader - Get Target info Mtk - We're not in bootrom, trying to crash da... Exploitation - Crashing da... Preloader Preloader - [LIB]: upload_data failed with error: DAA_SIG_VERIFY_FAILED (0x7024) Preloader Preloader - [LIB]: Error on uploading da data Preloader - Jumping to 0x0 DeviceClass DeviceClass - [LIB]: Device disconnected

Any ideas?

R0rt1z2 commented 2 weeks ago

Completely expected behavior. Amazon Preloader is not vulnerable to the DA crash and even if you were able to upload it, bootrom mode is disabled.

TL;DR: mtkclient is useless on new (latest) Amazon devices (for now, hopefully).

Dr4g0nWr4th commented 2 weeks ago

That's unfortunate :(

bkerler commented 1 week ago

You can still try using the --stock option .... the problem is that amazon devices always report that sbc is disabled although it is enabled.