bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.71k stars 528 forks source link

DA hash mismatch for MT6761 on Y6 2019 Huawei #863

Closed g0rg0n3 closed 5 months ago

g0rg0n3 commented 10 months ago

Hello,

Thank you for all your hard work on mediatek SoC. I managed to backup the entire flash of my Y6 2019 with your tool, also flashing looks like working properly since I can write and read back the same value and brick my phone and restore it back.

i wanted to unlock my bootloader since Huawei does not provide code anymore... but I have some issues with DA extensions not being able to be added. I am using ubuntu 22.04 as base machine.

the dump of my seccfg.img is :

00000000 4d 4d 4d 4d 04 00 00 00 3c 00 00 00 01 00 00 00 |MMMM....<.......| 00000010 00 00 00 00 00 00 00 00 45 45 45 45 e6 64 97 54 |........EEEE.d.T| 00000020 41 e4 5d c4 ea 97 95 f8 b7 fb 5e 46 7c af 5d d7 |A.].......^F|.].| 00000030 94 4d 75 74 89 c3 d5 45 ca 55 93 f4 00 00 00 00 |.Mut...E.U......| 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00800000

The dump of the mtk tool :

python3 mtk da seccfg unlock --preloader=preloader_k61v1_64_mexico.bin MTK Flash/Exploit Client Public V2.0.0 Beta (c) B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting. For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb. For preloader mode, don't press any hw button and connect usb. If it is already connected and on, hold power for 10 seconds to reset.

............Port - Device detected :) Preloader - CPU: MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0x25 Preloader - Disabling Watchdog... Preloader - HW code: 0x717 Preloader - Target config: 0xe5 Preloader - SBC enabled: True Preloader - SLA enabled: False Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x200 Preloader - ME_ID: 6F7446D8F0EC81486AD03784FA05154F Preloader - SOC_ID: 77CCCEEE55A81B923049D456D5A235E9FE455329CFFD728262E2AAF419DD0687 PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes Exploitation - Kamakiri Run Exploitation - Done sending payload... PLTools - Successfully sent payload: /home/nicolas/Desktop/mtkclient/mtkclient/payloads/mt6761_payload.bin Port - Device detected :) DA_handler - Device is protected. DA_handler - Device is in BROM mode. Trying to dump preloader. DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - Sending emi data ... DAXFlash - DRAM setup passed. DAXFlash - Sending emi data succeeded. DAXFlash - Uploading stage 2... DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - Successfully uploaded stage 2 DAXFlash - EMMC FWVer: 0x0 DAXFlash - EMMC ID: hB8aP> DAXFlash - EMMC CID: 90014a68423861503e014248de74a619 DAXFlash - EMMC Boot1 Size: 0x400000 DAXFlash - EMMC Boot2 Size: 0x400000 DAXFlash - EMMC GP1 Size: 0x0 DAXFlash - EMMC GP2 Size: 0x0 DAXFlash - EMMC GP3 Size: 0x0 DAXFlash - EMMC GP4 Size: 0x0 DAXFlash - EMMC RPMB Size: 0x1000000 DAXFlash - EMMC USER Size: 0x747c00000 DAXFlash - HW-CODE : 0x717 DAXFlash - HWSUB-CODE : 0x8A00 DAXFlash - HW-VERSION : 0xCA01 DAXFlash - SW-VERSION : 0x200 DAXFlash - CHIP-EVOLUTION : 0x0 DAXFlash - DA-VERSION : 1.0 DAXFlash DAXFlash - [LIB]: Error on sending data: DA hash mismatch (0xc0070004) DAXFlash DAXFlash - [LIB]: DA Extensions failed to enable xflashext - Detected V4 Lockstate sej - HACC init xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Legacy Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej - HACC run xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej - HACC terminate xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej - HACC init xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej - HACC run xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej sej - [LIB]: SEJ Hardware seems not to be configured correctly. Results may be wrong. xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code sej - HACC terminate xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code xflashext xflashext - [LIB]: Unsupported ctrl code DA_handler DA_handler - [LIB]: Device has is either already unlocked or algo is unknown. Aborting.

I also tried to use the files from : https://disk.yandex.ru/d/rQ4e72f1FhbuWg

I mean the DA and the preloader given, it works but does not change anything from using my own preloader and your loader MTK_V5_DA.bin.

Do have any ideas why I have a hash mismatch ?

Kind regards

bkerler commented 10 months ago

That means that the DA isn't stock but was patched before, thus the patches for da cannot be applied. Be aware that there are malicious loaders out there and make sure to always use properly signed and stock loaders.

bkerler commented 10 months ago

Or alternatively it means that you didn't run the device in brom mode using kamakiri, as it won't work this way on preloader if daa/sla/sbc fuses are set.