search

bkerler / mtkclient

MTK reverse engineering and flash tool
GNU General Public License v3.0
2.5k stars 502 forks source link

TCL A509DL: "Device is unprotected" but issues "DAA_SIG_VERIFY_FAILED". #868

Closed userse31 closed 2 weeks ago

userse31 commented 8 months ago

Man I hate Tracfone and Straighttalk. Hopefully they and their friend's private RSA keys used for issuing OTA updates and signing bootloaders get leaked sometime soon. I will happily drink all of their capitalist tears!

Log from running "./mtk printgpt".

Port - Device detected :) Preloader - CPU: MT6765/MT8768t(Helio P35/G35) Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0x25 Preloader - Disabling Watchdog... Preloader - HW code: 0x766 Preloader - Target config: 0x7 Preloader - SBC enabled: True Preloader - SLA enabled: True Preloader - DAA enabled: True Preloader - SWJTAG enabled: True Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca00 Preloader - SW Ver: 0x0 Preloader - ME_ID: 8C8C583A66C35442EA14B9589CB5CB8D Preloader - SOC_ID: 86744DB93593E62BCC303B622DD5EF6728CB3147B76F641BC8FB7166C41444C2 DA_handler - Device is unprotected. Preloader Preloader - [LIB]: Error on da_write32, addr 0x1001a100, CRYPTO_DEINIT_FAIL (0x1001) Preloader Preloader - [LIB]: Error on da_write32, addr 0x1001a108, CRYPTO_DEINIT_FAIL (0x1001) Preloader Preloader - [LIB]: Error on da_write32, addr 0x1001a100, CRYPTO_DEINIT_FAIL (0x1001) Preloader Preloader - [LIB]: Error on da_write32, addr 0x1001a0e0, CRYPTO_DEINIT_FAIL (0x1001) DA_handler - Device is in Preloader-Mode. DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin Preloader Preloader - [LIB]: upload_data failed with error: DAA_SIG_VERIFY_FAILED (0x7024) Preloader Preloader - [LIB]: Error on uploading da data DAXFlash DAXFlash - [LIB]: Error on sending DA.

Strange how DA_Handler says the device is unprotected, but uploading the things results in the verify failed thing. Some sort of erroneous result?

There is an XDA thread where someone claims they rooted this phone by shuffling some of the files in mtkclient around. It would NOT be a surprise to me if Tracfone caught wind, patched the bootloaders, and might of even forcefully recalled the existing stock. That company is more evil than Hitler tbh.

This specimen is manufactured 2022-04-15. The post claiming a root is from a couple months back.

This is under Debian 6.1.66-1

userse31 commented 8 months ago

Updates!

Tried the premade linux iso. Results in handshake fail error.

But, I have OTHER mediatek phones! What about those?

Both my Stratus C5 "Elite" and Hotpepper Serrano work!

But only in mtk_gui, for... some reason. The cli tool only reads zeros for the nand dumps.

Also, the "connection settings" button doesn't work.

bkerler commented 8 months ago

Should be fixed with commit 9c7db52

github-actions[bot] commented 3 weeks ago

Stale issue message