bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.57k stars 511 forks source link

Stuck in recovery mode loop after trying to unlock bootloader #825

Closed sokka0620040 closed 3 months ago

sokka0620040 commented 10 months ago

I tried following the process two times. The output was the same. The first time I was able to open my mobile, but the bootloader was not unlocked. So I tried again but now my phone is stuck in a recovery mode loop. I can turn it off but when I try to open it by pressing the power button it goes into recovery mode loop.

I basically tried the following two commands:

(myenv) C:\Users\keshab\Desktop\mtkclient-main>python mtk e metadata,userdata,md_udc

MTK Flash/Exploit Client V1.6.3 (c) B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

.Port - Device detected :) Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x788 Preloader - Target config: 0xe5 Preloader - SBC enabled: True Preloader - SLA enabled: False Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 4325BE3DB7AF382BF1EE9BCDD28DB4BD Preloader - SOC_ID: A8F82177D1F4BA34BB3740B495F77416DD8495B2359E99504DD7B4699294425F PLTools - Loading payload from mt6771_payload.bin, 0x264 bytes Exploitation - Kamakiri Run Exploitation - Done sending payload... PLTools - Successfully sent payload: C:\Users\keshab\Desktop\mtkclient-main\mtkclient\payloads\mt6771_payload.bin Port - Device detected :) DA_handler - Device is protected. DA_handler - Device is in BROM mode. Trying to dump preloader. DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2228.bin xflashext - Patching da1 ... Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "hash_check" in preloader xflashext xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "get_vfy_policy" in preloader xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - Sending emi data ... DAXFlash - DRAM setup passed. DAXFlash - Sending emi data succeeded. DAXFlash - Uploading stage 2... DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - Successfully uploaded stage 2 DAXFlash - EMMC FWVer: 0x0 DAXFlash - EMMC ID: DV6DMB DAXFlash - EMMC CID: 150100445636444d420219cf6a853619 DAXFlash - EMMC Boot1 Size: 0x400000 DAXFlash - EMMC Boot2 Size: 0x400000 DAXFlash - EMMC GP1 Size: 0x0 DAXFlash - EMMC GP2 Size: 0x0 DAXFlash - EMMC GP3 Size: 0x0 DAXFlash - EMMC GP4 Size: 0x0 DAXFlash - EMMC RPMB Size: 0x1000000 DAXFlash - EMMC USER Size: 0x1d1ec00000 DAXFlash - HW-CODE : 0x788 DAXFlash - HWSUB-CODE : 0x8A00 DAXFlash - HW-VERSION : 0xCA00 DAXFlash - SW-VERSION : 0x0 DAXFlash - CHIP-EVOLUTION : 0x0 DAXFlash - DA-VERSION : 1.0 DAXFlash - Extensions were accepted. Jumping to extensions... DAXFlash - DA Extensions successfully added DAXFlash - Formatting addr 0x13f88000 with length 0x2000000, please standby.... Progress: |██████████████████████████████████████████████████| 100.0% Erasing (Sector 0x10000 of 0x10000, ) 240.30 MB/s DAXFlash - Successsfully formatted addr 0x13f88000 with length 33554432. Formatted sector 654400 with sector count 65536. DAXFlash - Formatting addr 0x1eb800000 with length 0x1b2f8fbe00, please standby.... Progress: |██████████████████████████████████████████████████| 100.0% Erasing (Sector 0xD97C7DF of 0xD97C7DF, ) 86145.49 MB/s DAXFlash - Successsfully formatted addr 0x1eb800000 with length 116762066432. Formatted sector 16105472 with sector count 228050911. DA_handler DA_handler - [LIB]: ←[31mError: Couldn't detect partition: md_udc Available partitions:←[0m DA_handler - boot_para DA_handler - recovery DA_handler - para DA_handler - opporeserve1 DA_handler - opporeserve2 DA_handler - opporeserve3 DA_handler - oppo_custom DA_handler - expdb DA_handler - frp DA_handler - nvcfg DA_handler - nvdata DA_handler - metadata DA_handler - protect1 DA_handler - protect2 DA_handler - seccfg DA_handler - persist DA_handler - sec1 DA_handler - proinfo DA_handler - md1img DA_handler - spmfw DA_handler - scp1 DA_handler - scp2 DA_handler - sspm_1 DA_handler - sspm_2 DA_handler - cam_vpu1 DA_handler - cam_vpu2 DA_handler - cam_vpu3 DA_handler - gz1 DA_handler - gz2 DA_handler - nvram DA_handler - lk DA_handler - lk2 DA_handler - boot DA_handler - logo DA_handler - dtbo DA_handler - tee1 DA_handler - tee2 DA_handler - odm DA_handler - vendor DA_handler - system DA_handler - cache DA_handler - userdata DA_handler - otp DA_handler - flashinfo Failed to format all partitions.

(myenv) C:\Users\keshab\Desktop\mtkclient-main>

(myenv) C:\Users\keshab\Desktop\mtkclient-main>python mtk da seccfg unlock

MTK Flash/Exploit Client V1.6.3 (c) B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

Port - Device detected :) Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x788 Preloader - Target config: 0xe5 Preloader - SBC enabled: True Preloader - SLA enabled: False Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 4325BE3DB7AF382BF1EE9BCDD28DB4BD Preloader - SOC_ID: A8F82177D1F4BA34BB3740B495F77416DD8495B2359E99504DD7B4699294425F PLTools - Loading payload from mt6771_payload.bin, 0x264 bytes Exploitation - Kamakiri Run Exploitation - Done sending payload... PLTools - Successfully sent payload: C:\Users\keshab\Desktop\mtkclient-main\mtkclient\payloads\mt6771_payload.bin Port - Device detected :) DA_handler - Device is protected. DA_handler - Device is in BROM mode. Trying to dump preloader. DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2228.bin xflashext - Patching da1 ... Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "hash_check" in preloader xflashext xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m Mtk - Patched "Patched loader msg" in preloader Mtk - Patched "get_vfy_policy" in preloader xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - Sending emi data ... DAXFlash - DRAM setup passed. DAXFlash - Sending emi data succeeded. DAXFlash - Uploading stage 2... DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - Successfully uploaded stage 2 DAXFlash - EMMC FWVer: 0x0 DAXFlash - EMMC ID: DV6DMB DAXFlash - EMMC CID: 150100445636444d420219cf6a853619 DAXFlash - EMMC Boot1 Size: 0x400000 DAXFlash - EMMC Boot2 Size: 0x400000 DAXFlash - EMMC GP1 Size: 0x0 DAXFlash - EMMC GP2 Size: 0x0 DAXFlash - EMMC GP3 Size: 0x0 DAXFlash - EMMC GP4 Size: 0x0 DAXFlash - EMMC RPMB Size: 0x1000000 DAXFlash - EMMC USER Size: 0x1d1ec00000 DAXFlash - HW-CODE : 0x788 DAXFlash - HWSUB-CODE : 0x8A00 DAXFlash - HW-VERSION : 0xCA00 DAXFlash - SW-VERSION : 0x0 DAXFlash - CHIP-EVOLUTION : 0x0 DAXFlash - DA-VERSION : 1.0 DAXFlash - Extensions were accepted. Jumping to extensions... DAXFlash - DA Extensions successfully added xflashext - Detected V4 Lockstate sej - HACC init sej - HACC run sej - HACC terminate sej - HACC init sej - HACC run sej - HACC terminate DA_handler DA_handler - [LIB]: ←[31mDevice has is either already unlocked or algo is unknown. Aborting.←[0m

kirino-kousaka9901 commented 9 months ago

Some devices require a factory reset before theyll boot again after doing this. Reset from recovery and try again. And no,relocking will not undo this,ive tried. LGs are notorious for this in my experience