search

bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.56k stars 510 forks source link

write offset without reading gpt #546

Closed oakieville closed 1 month ago

oakieville commented 1 year ago

is it possible to write offset (wo) without reading gpt my device gives error Error on sending parameter: Read parttbl failed (0xc0040007) but i do know the offset i need to write to. i am able to read partitions on it but not write. the deviced is an a32 samsung and also to point out other tools are able to write to it however i highly perfer mtk client, i tried adding --gpt_file=a32pgpt.img but same result

python mtk wo 0x29d80000 0x400000 a32param.img --preloader=a32preloader.img --gpt_file=a32pgpt.img MTK Flash/Exploit Client V1.5.9 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Device detected :) Preloader - CPU: MT6853(Dimensity 720 5G) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x996 Preloader - Target config: 0xe5 Preloader - SBC enabled: True Preloader - SLA enabled: False Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: CF439AD136BD01B88A7BB04BEDCFA014 Preloader - SOC_ID: 0C9CB9FFA8165661C7E549643A66260B5D50AF9F3E9FA6B0165053EF3536DC71 PLTools - Loading payload from mt6853_payload.bin, 0x264 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Successfully sent payload: C:\2bunlocked\mtk\mtkclient\payloads\mt6853_payload.bin Port - Device detected :) DA_handler - Device is protected. DA_handler - Device is in BROM mode. Trying to dump preloader. DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin xflashext - Patching da1 ... Mtk - Patched "Patched loader msg" in preloader xflashext xflashext - [LIB]: Error on patching da1 version check... Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "get_vfy_policy" in preloader xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - UFS FWVer: 0x34 DAXFlash - UFS Blocksize:0x1000 DAXFlash - UFS ID: KM5P8001DM-B42 DAXFlash - UFS CID: ce014b4d355038303031444d2d423432 DAXFlash - UFS LU0 Size: 0xee5800000 DAXFlash - UFS LU1 Size: 0x400000 DAXFlash - UFS LU2 Size: 0x400000 DAXFlash - DRAM config needed for : ce014b4d355038303031444d2d423432 DAXFlash - Sending emi data ... DAXFlash - DRAM setup passed. DAXFlash - Sending emi data succeeded. DAXFlash - Uploading stage 2... DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - Successfully uploaded stage 2 DAXFlash - UFS FWVer: 0x34 DAXFlash - UFS Blocksize:0x1000 DAXFlash - UFS ID: KM5P8001DM-B42 DAXFlash - UFS CID: ce014b4d355038303031444d2d423432 DAXFlash - UFS LU0 Size: 0xee5800000 DAXFlash - UFS LU1 Size: 0x400000 DAXFlash - UFS LU2 Size: 0x400000 DAXFlash - HW-CODE : 0x996 DAXFlash - HWSUB-CODE : 0x8A00 DAXFlash - HW-VERSION : 0xCA00 DAXFlash - SW-VERSION : 0x0 DAXFlash - CHIP-EVOLUTION : 0x1 DAXFlash - DA-VERSION : 1.0 DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - DA Extensions successfully added DA_handler - Writing offset 0x29d80000 with length 0x400000 DAXFlash DAXFlash - [LIB]: Error on sending parameter: Read parttbl failed (0xc0040007) Failed to write a32param.img to offset 0x29d80000 with length 0x400000

github-actions[bot] commented 1 month ago

Stale issue message