bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.56k stars 510 forks source link

Failed to unlock Huawei mya-l11 #658

Closed Bartolini1522 closed 1 month ago

Bartolini1522 commented 1 year ago

Hi, maybe i'm not the first guy with this issue but how can i unlock the bootloader of this device since i got this error? C:\Users\asaa0\Desktop\mtkclient-main>python mtk e metadata,userdata,md_udc MTK Flash/Exploit Client V1.6.1 (c) B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

..........Port - Device detected :) Preloader - CPU: MT6735/T,MT8735A() Preloader - HW version: 0x0 Preloader - WDT: 0x10212000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10217c00 Preloader - Var1: 0x28 Preloader - Disabling Watchdog... Preloader - HW code: 0x321 Preloader - Target config: 0x1 Preloader - SBC enabled: True Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xcc00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 127C3F8651BE21B708DB4A5E14364D77 DA_handler - Device is unprotected. DA_handler - Device is in BROM-Mode. Bypassing security. PLTools - Loading payload from mt6735_payload.bin, 0x258 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Successfully sent payload: C:\Users\asaa0\Desktop\mtkclient-main\mtkclient\payloads\mt6735_payload.bin Port - Device detected :) DA_handler DA_handler - [LIB]: ←[33mDevice is in BROM mode. No preloader given, trying to dump preloader from ram.←[0m DALegacy - Uploading legacy da... DALegacy - Uploading legacy stage 1 from MTK_AllInOne_DA_5.2136.bin legacyext - Legacy DA2 is patched. legacyext - Legacy DA2 CMD F0 is patched. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DALegacy - Got loader sync ! DALegacy - Reading nand info DALegacy - Reading emmc info DALegacy - ACK: 04029b DALegacy - Setting stage 2 config ... DALegacy - DRAM config needed for : 510001154d3331458f500d42833ffdd8 DALegacy - Reading dram nand info ... DALegacy - Sending dram info ... DALegacy - RAM-Length: 0xbc DALegacy - Checksum: 8B48 DALegacy - M_EXT_RAM_RET : 0 DALegacy - M_EXT_RAM_TYPE : 0x2 DALegacy - M_EXT_RAM_CHIP_SELECT : 0x0 DALegacy - M_EXT_RAM_SIZE : 0x80000000 DALegacy - Uploading stage 2... DALegacy - Successfully uploaded stage 2 DALegacy - Connected to preloader DALegacy - Reconnecting to preloader DALegacy - Connected to preloader DALegacy - m_int_sram_ret = 0x0 m_int_sram_size = 0x20000 m_ext_ram_ret = 0x0 m_ext_ram_type = 0x2 m_ext_ram_chip_select = 0x0 m_int_sram_ret = 0x0 m_ext_ram_size = 0x80000000 randomid = 0x28C11A477C8C206B721083877C0E0E50

m_emmc_ret = 0x0 m_emmc_boot1_size = 0x400000 m_emmc_boot2_size = 0x400000 m_emmc_rpmb_size = 0x400000 m_emmc_gp_size[0] = 0x0 m_emmc_gp_size[1] = 0x0 m_emmc_gp_size[2] = 0x0 m_emmc_gp_size[3] = 0x0 m_emmc_ua_size = 0x3a3e00000 m_emmc_cid = 4531334d15010051d8fdc483420d508f m_emmc_fwver = 0d00000000000000

Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x400) 0.00 MB/sFormatted sector 858112 with sector count 75776. Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x400) 0.00 MB/sFormatted sector 8454144 with sector count 22047744. Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x400) 0.00 MB/sDA_handler DA_handler - [LIB]: ←[31mError: Couldn't detect partition: md_udc Available partitions:←[0m DA_handler - proinfo DA_handler - nvram DA_handler - protect1 DA_handler - protect2 DA_handler - lk DA_handler - lk2 DA_handler - para DA_handler - boot DA_handler - recovery DA_handler - logo DA_handler - expdb DA_handler - ROOTM DA_handler - seccfg DA_handler - oemkeystore DA_handler - secro DA_handler - keystore DA_handler - tee1 DA_handler - tee2 DA_handler - log DA_handler - oeminfo DA_handler - erecovery DA_handler - frp DA_handler - nvdata DA_handler - metadata DA_handler - system DA_handler - cust DA_handler - cache DA_handler - userdata DA_handler - flashinfo Failed to format all partitions.

C:\Users\asaa0\Desktop\mtkclient-main>python mtk da seccfg lock MTK Flash/Exploit Client V1.6.1 (c) B.Kerler 2018-2023

Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x4000) 0.00 MB/sDA_handler DA_handler - [LIB]: ←[31mUnknown seccfg partition header. Aborting unlock.←[0m

C:\Users\asaa0\Desktop\mtkclient-main>python mtk da seccfg unlock MTK Flash/Exploit Client V1.6.1 (c) B.Kerler 2018-2023

Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x4000) 0.00 MB/sDA_handler DA_handler - [LIB]: ←[31mUnknown seccfg partition header. Aborting unlock.←[0m

C:\Users\asaa0\Desktop\mtkclient-main>python mtk da seccfg lock MTK Flash/Exploit Client V1.6.1 (c) B.Kerler 2018-2023

Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x4000) 0.00 MB/sDA_handler DA_handler - [LIB]: ←[31mUnknown seccfg partition header. Aborting unlock.←[0m

ghost commented 1 year ago

Look at how you type the command fucking retard. You're trying to RELOCK the bootloader. Not UNLOCK. Also, this device doesn't seem to be unlockable by this tool at this time

caiiiok254 commented 1 year ago

With Huawei devices you need to patch LK to get bootloader unlock

dragonpt commented 1 year ago

Huawei does add some 'in-house' extra code into bootable/bootloader and bootable/lk.

But ... In your case, you are trying to RELOCK so ...

FYI: With newer Huawei devices, this has even changed in an more extended way, to avoid people messing with exploits.

Good luck

github-actions[bot] commented 2 months ago

Stale issue message