easleycorey
commented
9 months ago I get these errors when I try using mtkclient with my device The only think useful thing about mtkclient so far has been in preboot mode I can use read mode and downling my image everything works from it besides it failing on userdata.
When I try unlocking the boot loader I get the errors above
On the pre-built image you have the UK keyboard as default not the US also it would be nice to get adb and fastboot installed on it as well for the next build
Thank You, Corey
ReLive DVD Linux
Preboot mode: ..........Port - Device detected :) Preloader - CPU: MT8168() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x8168 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x100 DA_handler - Device is unprotected. DA_handler - Device is in Preloader-Mode :( DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - Uploading stage 2... DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - Successfully uploaded stage 2 DAXFlash - EMMC FWVer: 0x0 DAXFlash - EMMC ID: ISOCOM DAXFlash - EMMC CID: 04010149534f434f4d249ca8e12437cd DAXFlash - EMMC Boot1 Size: 0x400000 DAXFlash - EMMC Boot2 Size: 0x400000 DAXFlash - EMMC GP1 Size: 0x0 DAXFlash - EMMC GP2 Size: 0x0 DAXFlash - EMMC GP3 Size: 0x0 DAXFlash - EMMC GP4 Size: 0x0 DAXFlash - EMMC RPMB Size: 0x400000 DAXFlash - EMMC USER Size: 0x73a000000 DAXFlash - HW-CODE : 0x8168 DAXFlash - HWSUB-CODE : 0x8A00 DAXFlash - HW-VERSION : 0xCA01 DAXFlash - SW-VERSION : 0x100 DAXFlash - CHIP-EVOLUTION : 0x0 DAXFlash - DA-VERSION : 1.0 DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - DA Extensions successfully added Traceback (most recent call last): File "/opt/mtkclient/mtk", line 740, in
mtk = Main(args).run()
File "/opt/mtkclient/mtkclient/Library/mtk_main.py", line 558, in run
da_handler.handle_da_cmds(mtk, cmd, self.args)
File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 719, in handle_da_cmds
v = mtk.daloader.seccfg(args.flag)
File "/opt/mtkclient/mtkclient/Library/mtk_daloader.py", line 244, in seccfg
return self.xft.seccfg(lockflag)
File "/opt/mtkclient/mtkclient/Library/xflash_ext.py", line 521, in seccfg
self.setotp(hwc)
File "/opt/mtkclient/mtkclient/Library/xflash_ext.py", line 406, in setotp
hwc.sej.sej_set_otp(otp)
File "/opt/mtkclient/mtkclient/Library/hwcrypto_sej.py", line 402, in sej_set_otp
self.reg.HACC_SW_OTP0 = pd[0]
File "/opt/mtkclient/mtkclient/Library/hwcrypto_sej.py", line 77, in setattr
addr = regval[key] + self.sej_base
TypeError: unsupported operand type(s) for +: 'int' and 'NoneType'
user@livedvd:/opt/mtkclient$
Brom mode Port - Device detected :) Preloader - CPU: MT8168() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x8168 Preloader - Target config: 0xe0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x100 Preloader - ME_ID: 18BCB1AE7F15B3A0CA97CF4BB1DD3630 DA_handler - Device is unprotected. DA_handler - Device is in BROM-Mode. Bypassing security. PLTools - Loading payload from generic_patcher_payload.bin, 0x56c bytes PLTools - Kamakiri / DA Run Kamakiri - Trying kamakiri2.. Traceback (most recent call last): File "/opt/mtkclient/mtk", line 740, in
mtk = Main(args).run()
File "/opt/mtkclient/mtkclient/Library/mtk_main.py", line 556, in run
mtk = da_handler.configure_da(mtk, preloader)
File "/opt/mtkclient/mtkclient/Library/mtk_da_cmd.py", line 101, in configure_da
mtk = mtk.bypass_security() # Needed for dumping preloader
File "/opt/mtkclient/mtkclient/Library/mtk.py", line 148, in bypass_security
if plt.runpayload(filename=self.config.payloadfile):
File "/opt/mtkclient/mtkclient/Library/pltools.py", line 102, in runpayload
if self.kama.payload(payload, addr, True, exploittype):
File "/opt/mtkclient/mtkclient/Library/kamakiri.py", line 139, in payload
if self.exploit2(payload, addr):
File "/opt/mtkclient/mtkclient/Library/kamakiri.py", line 117, in exploit2
ptr_send = unpack("<I", self.da_read(self.mtk.config.chipconfig.send_ptr[0][1], 4))[0] + 8
TypeError: 'NoneType' object is not subscriptable
Windows: ..........Preloader Preloader - [LIB]: ←[31mStatus: Handshake failed, retrying...←[0m Port - Device detected :) Preloader - CPU: MT8168/MT6357() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - Var1: 0xa Preloader - Disabling Watchdog... Preloader - HW code: 0x8168 Preloader - Target config: 0xe0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: True Preloader - Mem write auth: True Preloader - Cmd 0xC8 blocked: True Preloader - Get Target info Preloader - BROM mode detected. Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xca01 Preloader - SW Ver: 0x100 Preloader - ME_ID: 18BCB1AE7F15B3A0CA97CF4BB1DD3630 Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000 DA_handler - Device is unprotected. DA_handler - Device is in BROM-Mode. Bypassing security. PLTools - Loading payload from mt8168_payload.bin, 0x258 bytes Exploitation - Kamakiri Run Traceback (most recent call last): File "C:\Users\Admin\Downloads\mtkclient-main\mtk", line 949, in
mtk = Main(args).run(parser)
^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\mtk_main.py", line 652, in run
mtk = da_handler.configure_da(mtk, preloader)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\DA\mtk_da_handler.py", line 108, in configure_da
mtk = mtk.bypass_security() # Needed for dumping preloader
^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\mtk_class.py", line 202, in bypass_security
if plt.runpayload(filename=self.config.payloadfile):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\pltools.py", line 79, in runpayload
ack = self.exploit.runpayload(payload, ack, addr, dontack)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\Exploit\kamakiri2.py", line 206, in runpayload
if self.da_payload(payload, addr, True):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\exploit_handler.py", line 80, in da_payload
if self.exploit(payload, addr):
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\Exploit\kamakiri2.py", line 68, in exploit
self.da_write(payloadaddr, len(payload), payload)
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\exploit_handler.py", line 65, in da_write
return self.da_read_write(address, length, data, check_result)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\Exploit\kamakiri2.py", line 57, in da_read_write
return self.mtk.preloader.brom_register_access(address - 0x40, length, data, check_result)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\mtk_preloader.py", line 1021, in brom_register_access
raise RuntimeError("Kamakiri2 failed, cache issue :(")
RuntimeError: Kamakiri2 failed, cache issue :(
TypeError: unsupported operand type(s) for +: 'int' and 'NoneType' TypeError: 'NoneType' object is not subscriptable File "C:\Users\Admin\Downloads\mtkclient-main\mtkclient\Library\mtk_preloader.py", line 1021, in brom_register_access raise RuntimeError("Kamakiri2 failed, cache issue :(") RuntimeError: Kamakiri2 failed, cache issue :(