search

bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.7k stars 528 forks source link

Oppo A16-E ( Mediatek MT6762D Helio P22 (12 nm) ) Can't unlock bootloader from TEST POINT #632

Closed RaghuVarma331 closed 5 months ago

RaghuVarma331 commented 1 year ago

Port - Device detected :) Preloader - CPU: MT6765/MT8768t(Helio P35/G35) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0x25 Preloader - Disabling Watchdog... Preloader - HW code: 0x766 Preloader - Target config: 0xe5 Preloader - SBC enabled: True Preloader - SLA enabled: False Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 415CD49F1A051D705BC65ED5A686A17C Preloader - SOC_ID: B6005B8C3D1620E35B81C478809B2C04E887831898ADF6E9B54A6747EAF8E2B0 PLTools - Loading payload from mt6765_payload.bin, 0x264 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Successfully sent payload: C:\mtkclient-main\mtkclient\payloads\mt6765_payload.bin Port - Device detected :) DA_handler - Device is protected. DA_handler - Device is in BROM mode. Trying to dump preloader. DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin xflashext - Patching da1 ... Mtk - Patched "Patched loader msg" in preloader xflashext xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "get_vfy_policy" in preloader xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash DAXFlash - [LIB]: ←[31mxread error: unpack requires a buffer of 12 bytes←[0m DAXFlash DAXFlash - [LIB]: ←[31mError jumping to DA: -1←[0m

RaghuVarma331 commented 1 year ago

On top of it mtkclient unable to dump the preloader. So i used --preloader with stock rom preloader file. But no luck.

Below is the preloader file from stock rom.

preloader_oppo6762.zip

RaghuVarma331 commented 1 year ago

@bkerler

King12689 commented 1 year ago

Port - Device detected :) Preloader - CPU: MT6765/MT8768t(Helio P35/G35) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0x25 Preloader - Disabling Watchdog... Preloader - HW code: 0x766 Preloader - Target config: 0xe5 Preloader - SBC enabled: True Preloader - SLA enabled: False Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 415CD49F1A051D705BC65ED5A686A17C Preloader - SOC_ID: B6005B8C3D1620E35B81C478809B2C04E887831898ADF6E9B54A6747EAF8E2B0 PLTools - Loading payload from mt6765_payload.bin, 0x264 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Successfully sent payload: C:\mtkclient-main\mtkclient\payloads\mt6765_payload.bin Port - Device detected :) DA_handler - Device is protected. DA_handler - Device is in BROM mode. Trying to dump preloader. DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin xflashext - Patching da1 ... Mtk - Patched "Patched loader msg" in preloader xflashext xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "get_vfy_policy" in preloader xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash DAXFlash - [LIB]: ←[31mxread error: unpack requires a buffer of 12 bytes←[0m DAXFlash DAXFlash - [LIB]: ←[31mError jumping to DA: -1←[0m

itt happens to me too but i fixed by reinstalling all from the start same situation cant unlock but i just rreset everything from the start and it works well