bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.74k stars 530 forks source link

MT6771 Unlock Bootloader Failed #1276

Open Folralorwns opened 2 weeks ago

Folralorwns commented 2 weeks ago

I tried to unlock the bootloader for my device using the latest version, but it reported an error. And I was able to successfully unlock it before when using the commit 1a1af871, but because of the vendor's update, the older version was unable to handshake and could not read or write partitions. When using the latest version I can read and write the partitions normally, but I can't unlock the bootloader.

C:\Users\Administrator\Downloads\Compressed\mtkclient-main_2\mtkclient-main>python mtk.py da seccfg unlock MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

........... Port - Device detected :) Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x788 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 35FB3F80FF7E15852A04D2433501A81D Preloader - SOC_ID: A2C85A82E4140074B095BF2664EA8CC2B202C0D5CAEB8C675C342860E4629A97 DaHandler - Device is unprotected. DaHandler - Device is in Preloader-Mode. DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin XFlashExt - Patching da1 ... Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "hash_check" in preloader Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "get_vfy_policy" in preloader XFlashExt - Patching da2 ... XFlashExt - Security check patched XFlashExt - DA version anti-rollback patched XFlashExt - SBC patched to be disabled XFlashExt - Register read/write not allowed patched DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - Uploading stage 2... DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - Boot to succeeded. DAXFlash - Successfully uploaded stage 2 DAXFlash - DA SLA is disabled DAXFlash - UFS Blocksize:0x1000 DAXFlash - UFS ID: MT128GAXAU2U22 DAXFlash - UFS MID: 0x2c DAXFlash - UFS CID: 2c014d54313238474158415532553232 DAXFlash - UFS FWVer: 30313031 DAXFlash - UFS Serial: 534e30303030303100000000 DAXFlash - UFS LU0 Size: 0x1dcb000000 DAXFlash - UFS LU1 Size: 0x400000 DAXFlash - UFS LU2 Size: 0x400000 DAXFlash - HW-CODE : 0x788 DAXFlash - HWSUB-CODE : 0x8A00 DAXFlash - HW-VERSION : 0xCA00 DAXFlash - SW-VERSION : 0x0 DAXFlash - CHIP-EVOLUTION : 0x0 DAXFlash - DA-VERSION : 1.0 DAXFlash - Extensions were accepted. Jumping to extensions... DAXFlash - Boot to succeeded. DAXFlash - DA Extensions successfully added XFlashExt - Detected V4 Lockstate Sej - HACC init Sej Sej - [LIB]: SEJ Legacy Hardware seems not to be configured correctly. Results may be wrong. Sej - HACC run Sej - HACC terminate Sej - HACC init Sej - HACC run Sej - HACC terminate Sej - HACC init Sej Sej - [LIB]: SEJ Legacy Hardware seems not to be configured correctly. Results may be wrong. Sej - HACC run Sej - HACC terminate DaHandler DaHandler - [LIB]: Device has is either already unlocked or algo is unknown. Aborting.

seccfg.zip