search

bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.58k stars 516 forks source link

Error when unlocking bootloader: DA_handler - [LIB]: Unknown seccfg partition header. Aborting unlock. #844

Closed mrmickel closed 1 month ago

mrmickel commented 10 months ago

Hello, i tried unlocking bootloader of my phone S23 Ultra Clone using mtkclient on windows and on Linux Live CD, but i always get this error: DA_handler - [LIB]: Unknown seccfg partition header. Aborting unlock. please find below the logs:

user@livedvd:/opt/mtkclient$ python mtk da seccfg unlock MTK Flash/Exploit Client V1.57 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb.

........Port - Device detected :) Preloader - CPU: MT6735/T() Preloader - HW version: 0x0 Preloader - WDT: 0x10212000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10217c00 Preloader - Var1: 0x28 Preloader - Disabling Watchdog... Preloader - HW code: 0x321 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xcc00 Preloader - SW Ver: 0x0 Preloader - ME_ID: C049A79E5A37BC51E04B36C0C70B9553 DA_handler - Device is unprotected. DA_handler - Device is in BROM-Mode. Bypassing security. PLTools - Loading payload from mt6735_payload.bin, 0x258 bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Kamakiri - Done sending payload... PLTools - Successfully sent payload: /opt/mtkclient/mtkclient/payloads/mt6735_payload.bin Port - Device detected :) DA_handler DA_handler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram. DALegacy - Uploading legacy da... DALegacy - Uploading legacy stage 1 from MTK_AllInOne_DA_5.2152.bin legacyext - Legacy DA2 is patched. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DALegacy - Got loader sync ! DALegacy - Reading nand info DALegacy - Reading emmc info DALegacy - ACK: 04029b DALegacy - Setting stage 2 config ... DALegacy - DRAM config needed for : 470001154d423650700c0142d58c32aa DALegacy - Reading dram nand info ... DALegacy - Sending dram info ... DALegacy - RAM-Length: 0xbc DALegacy - Checksum: 72A3 DALegacy - M_EXT_RAM_RET : 0 DALegacy - M_EXT_RAM_TYPE : 0x2 DALegacy - M_EXT_RAM_CHIP_SELECT : 0x0 DALegacy - M_EXT_RAM_SIZE : 0xc0000000 DALegacy - Uploading stage 2... DALegacy - Successfully uploaded stage 2 DALegacy - Connected to preloader DALegacy - Reconnecting to preloader DALegacy - Connected to preloader DALegacy - m_int_sram_ret = 0x0 m_int_sram_size = 0x20000 m_ext_ram_ret = 0x0 m_ext_ram_type = 0x2 m_ext_ram_chip_select = 0x0 m_int_sram_ret = 0x0 m_ext_ram_size = 0xc0000000 randomid = 0xB34C2CCBC019F939FDDC623629263603

m_emmc_ret = 0x0 m_emmc_boot1_size = 0x400000 m_emmc_boot2_size = 0x400000 m_emmc_rpmb_size = 0x1000000 m_emmc_gp_size[0] = 0x0 m_emmc_gp_size[1] = 0x0 m_emmc_gp_size[2] = 0x0 m_emmc_gp_size[3] = 0x0 m_emmc_ua_size = 0xe8f800000 m_emmc_cid = 5036424d15010047aa3295d542010c70 m_emmc_fwver = 0100000000000000

Done |--------------------------------------------------| 0.0% Read (Sector 0x0 Done |--------------------------------------------------| 0.0% Read (Sector 0x0 Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x400) 0.00 MB/sDA_handler DA_handler - [LIB]: Unknown seccfg partition header. Aborting unlock. user@livedvd:/opt/mtkclient$ python mtk da seccfg unlock MTK Flash/Exploit Client V1.57 (c) B.Kerler 2018-2022

Done |--------------------------------------------------| 0.0% Read (Sector 0x0 of 0x400) 0.00 MB/sDA_handler DA_handler - [LIB]: Unknown seccfg partition header. Aborting unlock. user@livedvd:/opt/mtkclient$

mrmickel commented 10 months ago

Anyone can help me out here?

mrmickel commented 9 months ago

@bkerler help plz

mrmickel commented 9 months ago

help please

bkerler commented 9 months ago

Upload your seccfg and preloader so I can have a look at the structure.

mrmickel commented 9 months ago

Hi, it seems that i can't add the files to my post!! i uploaded them online, link: https://file.io/90lVU6HAjxNY thank you

mrmickel commented 8 months ago

Any update my friend?

bkerler commented 8 months ago

Not yet, pretty busy right now. But I will have a look.

mrmickel commented 6 months ago

Hi @bkerler did you manage to take a look? i'd really use your help, currently not able to use my phone! thanks in advance

mrmickel commented 3 months ago

any update please?

bkerler commented 3 months ago

sorry, the uploaded files do no longer exist. Can you reupload them ?

github-actions[bot] commented 1 month ago

Stale issue message