bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.7k stars 528 forks source link

Error on DA sync #226

Closed dxgundam01 closed 5 months ago

dxgundam01 commented 2 years ago

hello, I want to unlock bootloader, I use the Download Re Live DVD V3 when I connect phone in preloader mode, it displayed .Port - Device detected :) Preloader - CPU: MT6592() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x111000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x6592 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 DA_handler - Device is unprotected. DALegacy - Uploading da... DALegacy - Uploading legacy stage 1 from MTK_AllInOne_DA_5.1824.bin legacyext legacyext - [LIB]: Legacy address check not patched. Preloader Preloader - [LIB]: upload_data failed with error: DA_IMAGE_SIG_VERIFY_FAIL (0x2001) Preloader Preloader - [LIB]: Error on uploading da data DA_handler DA_handler - [LIB]: Error uploading da Traceback (most recent call last): File "/opt/mtkclient/mtk", line 1375, in mtk = Main(args).run() File "/opt/mtkclient/mtk", line 651, in run da_handler.handle_da_cmds(mtk, cmd, args) File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 656, in handle_da_cmds mtk.daloader.seccfg(args.flag) AttributeError: 'NoneType' object has no attribute 'daloader'

when I connect phone in brom mode, it displayed ......Port - Device detected :) Preloader - CPU: MT6592() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x111000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x6592 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: E427BC0030CF9C623B0B832188198BEB DA_handler - Device is unprotected. PLTools - Loading payload from mt6592_payload.bin, 0x258 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Successfully sent payload: /opt/mtkclient/mtkclient/payloads/mt6592_payload.bin Port - Device detected :) DA_handler DA_handler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram. -8DALegacy - Uploading da... DALegacy - Uploading legacy stage 1 from MTK_AllInOne_DA_5.1824.bin legacyext legacyext - [LIB]: Legacy address check not patched. Preloader - Jumping to 0x110000 Preloader - Jumping to 0x110000: ok. DALegacy DALegacy - [LIB]: Error on DA sync DA_handler DA_handler - [LIB]: Error uploading da Traceback (most recent call last): File "/opt/mtkclient/mtk", line 1375, in mtk = Main(args).run() File "/opt/mtkclient/mtk", line 651, in run da_handler.handle_da_cmds(mtk, cmd, args) File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 620, in handle_da_cmds self.da_erase(partitions=partitions, parttype=parttype) File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 405, in da_erase res = self.mtk.daloader.detect_partition(partition, parttype) File "/opt/mtkclient/mtkclient/Library/mtk_daloader.py", line 157, in detect_partition data, guid_gpt = self.da.partition.get_gpt(self.mtk.config.gpt_settings, parttype) File "/opt/mtkclient/mtkclient/Library/partition.py", line 18, in get_gpt data = self.readflash(addr=0, length=2 * self.config.pagesize, filename="", parttype=parttype, display=False) File "/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py", line 1309, in readflash length, parttype = self.get_parttype(length, parttype) File "/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py", line 1284, in get_parttype length = min(length, self.emmc.m_emmc_ua_size) AttributeError: 'NoneType' object has no attribute 'm_emmc_ua_size'

Can somebody help me?

dxgundam01 commented 2 years ago

Hello ! I use other one DA file and now it displayed Port - Device detected :) Preloader - CPU: MT6592() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x111000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x6592 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 DA_handler - Device is unprotected. DALegacy - Uploading da... DALegacy - Uploading legacy stage 1 from MTK_AllInOne_DA_5.1824.bin legacyext legacyext - [LIB]: Legacy address check not patched. Preloader - Jumping to 0x110000 Preloader - Jumping to 0x110000: ok. DALegacy - Got loader sync ! DALegacy - Reading nand info DALegacy - Reading emmc info Traceback (most recent call last): File "/opt/mtkclient/mtk", line 1375, in mtk = Main(args).run() File "/opt/mtkclient/mtk", line 651, in run da_handler.handle_da_cmds(mtk, cmd, args) File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 518, in handle_da_cmds mtk=self.configure_da(mtk, preloader) File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 100, in configure_da if not mtk.daloader.upload_da(preloader=preloader): File "/opt/mtkclient/mtkclient/Library/mtk_daloader.py", line 192, in upload_da return self.da.upload_da() File "/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py", line 1065, in upload_da if self.upload(): File "/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py", line 1026, in upload if nandids[0] != 0: IndexError: list index out of range

in BRom mode Port - Device detected :) Preloader - CPU: MT6592() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x111000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x6592 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: E427BC0030CF9C623B0B832188198BEB DA_handler - Device is unprotected. PLTools - Loading payload from mt6592_payload.bin, 0x258 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Successfully sent payload: /opt/mtkclient/mtkclient/payloads/mt6592_payload.bin Port - Device detected :) DA_handler DA_handler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram. -8DALegacy - Uploading da... DALegacy - Uploading legacy stage 1 from MTK_AllInOne_DA_5.1824.bin legacyext legacyext - [LIB]: Legacy address check not patched. Preloader - Jumping to 0x110000 Preloader - Jumping to 0x110000: ok. DALegacy - Got loader sync ! DALegacy - Reading nand info usb_class - USBError(5, 'Input/Output Error') Traceback (most recent call last): File "/opt/mtkclient/mtk", line 1375, in mtk = Main(args).run() File "/opt/mtkclient/mtk", line 651, in run da_handler.handle_da_cmds(mtk, cmd, args) File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 518, in handle_da_cmds mtk=self.configure_da(mtk, preloader) File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 100, in configure_da if not mtk.daloader.upload_da(preloader=preloader): File "/opt/mtkclient/mtkclient/Library/mtk_daloader.py", line 192, in upload_da return self.da.upload_da() File "/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py", line 1065, in upload_da if self.upload(): File "/opt/mtkclient/mtkclient/Library/mtk_dalegacy.py", line 1011, in upload nandinfo = unpack(">I", self.usbread(4))[0] struct.error: unpack requires a buffer of 4 bytes

how to do next?

bkerler commented 2 years ago

You either need to boot the device into brom mode ( you're in preloader ) or you need a special signed da loader for your device (use --loader option for that).

dxgundam01 commented 2 years ago

You either need to boot the device into brom mode ( you're in preloader ) or you need a special signed da loader for your device (use --loader option for that).

I had special signed da loader, how to use --loader option ? I just replacement the MTK_AllInOne_DA_5.1824.bin file. it can go to Reading emmc info And end, no any error information display

bphd commented 1 year ago

DALegacy - [LIB]: Error on DA sync

I get that after

Subprocess output: DeviceClass - [LIB]: RX:0000
Subprocess output: Preloader - Jumping to 0x200000: ok.
Subprocess output: DeviceClass
Subprocess output: DeviceClass - [LIB]: Timed out
bkerler commented 5 months ago

you need to use the --iot option, older chipsets have a different protocol