search

bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.7k stars 528 forks source link

Can't unlock bootloader on MT6752 meizu #449

Closed andr0id365 closed 5 months ago

andr0id365 commented 2 years ago

t........... Port - Device detected :) Preloader - CPU: MT6752() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212c00 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x6752 Preloader - Target config: 0x7 Preloader - SBC enabled: True Preloader - SLA enabled: True Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x1 Preloader - ME_ID: 6F2E2D3638F136B04BE86C529304EF00 PLTools - Loading payload from generic_patcher_payload.bin, 0x56c bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Traceback (most recent call last): File "mtk", line 814, in mtk = Main(args).run(parser) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient\ Library\mtk_main.py", line 583, in run self.cmd_payload(mtk=mtk, payloadfile=payloadfile) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient\ Library\mtk_main.py", line 645, in cmd_payload plt.runpayload(filename=payloadfile) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient\ Library\pltools.py", line 102, in runpayload if self.kama.payload(payload, addr, True, exploittype): File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient\ Library\kamakiri.py", line 139, in payload if self.exploit2(payload, addr): File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient\ Library\kamakiri.py", line 117, in exploit2 ptr_send = unpack("<I", self.da_read(self.mtk.config.chipconfig.send_ptr

[0][ 1], 4))[0] + 8 TypeError: 'NoneType' object is not subscriptable brom_6752.zip

XRedCubeX commented 2 years ago

Which meizu is it? I've tried several meizu but none worked. (M2 Note, M3s, M5c) They give me other errors.

andr0id365 commented 2 years ago

m1 m1note

XRedCubeX commented 2 years ago

m1 m1note

The odds are even less that it will work, it matters that many other devices also have similar problems and have never been fixed

LolekLiam commented 2 years ago

t........... Port - Device detected :) Preloader - CPU: MT6752() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212c00 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x6752 Preloader - Target config: 0x7 Preloader - SBC enabled: True Preloader - SLA enabled: True Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x1 Preloader - ME_ID: 6F2E2D3638F136B04BE86C529304EF00 PLTools - Loading payload from generic_patcher_payload.bin, 0x56c bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Traceback (most recent call last): File "mtk", line 814, in mtk = Main(args).run(parser) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\mtk_main.py", line 583, in run self.cmd_payload(mtk=mtk, payloadfile=payloadfile) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\mtk_main.py", line 645, in cmd_payload plt.runpayload(filename=payloadfile) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\pltools.py", line 102, in runpayload if self.kama.payload(payload, addr, True, exploittype): File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\kamakiri.py", line 139, in payload if self.exploit2(payload, addr): File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\kamakiri.py", line 117, in exploit2 ptr_send = unpack("<I", self.da_read(self.mtk.config.chipconfig.send_ptr

[0][ 1], 4))[0] + 8 TypeError: 'NoneType' object is not subscriptable brom_6752.zip

try re-installing python and mtkclient

Johce-Chi commented 1 year ago

t........... Port - Device detected :) Preloader - CPU: MT6752() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212c00 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x6752 Preloader - Target config: 0x7 Preloader - SBC enabled: True Preloader - SLA enabled: True Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x1 Preloader - ME_ID: 6F2E2D3638F136B04BE86C529304EF00 PLTools - Loading payload from generic_patcher_payload.bin, 0x56c bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Traceback (most recent call last): File "mtk", line 814, in mtk = Main(args).run(parser) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\mtk_main.py", line 583, in run self.cmd_payload(mtk=mtk, payloadfile=payloadfile) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\mtk_main.py", line 645, in cmd_payload plt.runpayload(filename=payloadfile) File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\pltools.py", line 102, in runpayload if self.kama.payload(payload, addr, True, exploittype): File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\kamakiri.py", line 139, in payload if self.exploit2(payload, addr): File "D:\Program Files (x86)\IDA_Pro_7.7\python38\lib\site-packages

\mtkclient Library\kamakiri.py", line 117, in exploit2 ptr_send = unpack("<I", self.da_read(self.mtk.config.chipconfig.send_ptr

[0][ 1], 4))[0] + 8 TypeError: 'NoneType' object is not subscriptable brom_6752.zip

My meizu note5 has the same wrong,and now it can't switch on T_T

LolekLiam commented 1 year ago

My meizu note5 has the same wrong,and now it can't switch on T_T

Try using mtkclient on ubuntu. Be careful on meizu devices, because if you change something in the system and then update, you have a chance of bricking or soft bricking your device. I bricked my Meizu M3 Max and first it would just hang at the meizu logo, but after trying some roms and flashing, i am now stuck at the flyme logo, meaning i am soft bricked. i tried updating through recovery, but it doesnt fix the soft brick.