בעיה | פתיחת בוטלואדר בנגן PA03

[yeh 0]

מישהו יכול לעזור בדחיפות לפתוח בוטלואדר בנגן PA03?
כמו שציינתי פה כל ההתמשקות עם הנגן בעייתית ורק עם הפקודה --noreconnect

הצלחתי לתקשר איתו, אבל בפתיחת הבוטלואדר נתקע באמצע בשני סוגי הפקודות

python mtk xflash seccfg unlock

python mtk da seccfg unlock

אשמח לעזרה
@10110000 @אלוף-תימן(כתבת במדריך לפתוח בוטלואדר-איך הצלחת? בתוכנות שציינת לא הלך בכלל) @מישהו12 @אני-אני-אני

[מה זה משנה אה]

@yeh-0
אפשר לפתוח בנגן הזה אפשרויות מפתחים?

[10110000]

@yeh-0 איפה הוא נתקע?
איזה מעבד זה?

[אני אני אני]

תעלה תמונות של פלט השגיאה

[אלוף תימן]

@yeh-0 https://mitmachim.top/post/1063983

[yeh 0]

@אלוף-תימן מה משם?
מה שיש בקישור (mtk root tool.7z) נכשל

[אלוף תימן]

@yeh-0 נכשל מה

[yeh 0]

@אלוף-תימן כרגע אין סוללה, חשבתי שנתקלת בזה, מה הכל הלך אצלך חלק?

[yeh 0]

הנה השגיאה @10110000 @אלוף-תימן @אני-אני-אני

mtk da seccfg unlock --noreconnect

MTK Flash/Exploit Client Public V2.0.0 Beta (c) B.Kerler 2018-2023



Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode


Port - Hint:



Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.





Port - Device detected :)

Preloader -     CPU:                    MT6755/MT6750/M/T/S(Helio P10/P15/P18)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212c00

Preloader -     Var1:                   0xa

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x326

Preloader - Target config:              0x0

Preloader -     SBC enabled:            False

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          False

Preloader -     Mem write auth:         False

Preloader -     Cmd 0xC8 blocked:       False

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xcb00

Preloader -     SW Ver:                 0x1

Preloader - ME_ID:                      A346643D0C6AB20CB882E9A55E195858

DA_handler - Device is unprotected.

DA_handler - Device is in BROM-Mode. Bypassing security.

PLTools - Loading payload from mt6755_payload.bin, 0x258 bytes

Exploitation - Kamakiri Run

Exploitation - Done sending payload...

PLTools - Successfully sent payload: C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\payloads\mt6755_payload.bin

Port - Device detected :)

DA_handler

DA_handler - [LIB]: ←[33mDevice is in BROM mode. No preloader given, trying to dump preloader from ram.←[0m

DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin

xflashext - Patching da1 ...

Mtk - Patched "Patched loader msg" in preloader

Mtk - Patched "hash_check2" in preloader

xflashext

xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m

Mtk - Patched "Patched loader msg" in preloader

xflashext - Patching da2 ...

DAXFlash - Successfully uploaded stage 1, jumping ..

Preloader - Jumping to 0x200000

Preloader - Jumping to 0x200000: ok.

DAXFlash - Successfully received DA sync

DAXFlash - Sending emi data ...

DAXFlash - DRAM setup passed.

DAXFlash - Sending emi data succeeded.

DAXFlash - Uploading stage 2...

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - Successfully uploaded stage 2

DAXFlash - EMMC FWVer:      0x0

DAXFlash - EMMC ID:         R311MB

DAXFlash - EMMC CID:        150100523331314d4205406034598993

DAXFlash - EMMC Boot1 Size: 0x400000

DAXFlash - EMMC Boot2 Size: 0x400000

DAXFlash - EMMC GP1 Size:   0x0

DAXFlash - EMMC GP2 Size:   0x0

DAXFlash - EMMC GP3 Size:   0x0

DAXFlash - EMMC GP4 Size:   0x0

DAXFlash - EMMC RPMB Size:  0x400000

DAXFlash - EMMC USER Size:  0x3a3e00000

DAXFlash - HW-CODE         : 0x6750

DAXFlash - HWSUB-CODE      : 0x8A00

DAXFlash - HW-VERSION      : 0xCB00

DAXFlash - SW-VERSION      : 0x1

DAXFlash - CHIP-EVOLUTION  : 0x0

DAXFlash - DA-VERSION      : 1.0

DAXFlash - Extensions were accepted. Jumping to extensions...

DAXFlash - DA Extensions successfully added

DAXFlash

DAXFlash - [LIB]: ←[31mStatus error: Wrong magic←[0m

xflashext - Detected V4 Lockstate

sej - HACC init

DeviceClass - USBError(5, 'Input/Output Error')

Traceback (most recent call last):

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtk", line 948, in <module>

    mtk = Main(args).run(parser)

          ^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\mtk_main.py", line 654, in run

    da_handler.handle_da_cmds(mtk, cmd, self.args)

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\DA\mtk_da_handler.py", line 806, in handle_da_cmds

    v = mtk.daloader.seccfg(args.flag)

        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\DA\mtk_daloader.py", line 387, in seccfg

    return self.xft.seccfg(lockflag)

           ^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\DA\xflash\extension\xflash.py", line 557, in seccfg

    if not sc_org.parse(seccfg_data):

           ^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\Hardware\seccfg.py", line 57, in parse

    dec_hash = self.hwc.sej.sej_sec_cfg_hw(self.hash, False)

               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\Hardware\hwcrypto_sej.py", line 700, in sej_sec_cfg_hw

    self.SEJ_V3_Init(ben=encrypt, iv=self.g_HACC_CFG_1, legacy=True)

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\Hardware\hwcrypto_sej.py", line 534, in SEJ_V3_Init

    self.reg.HACC_AKEY0 = 0  # 0x20

    ^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\Hardware\hwcrypto_sej.py", line 93, in __setattr__

    return self.write32(addr, value)

           ^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\DA\xflash\extension\xflash.py", line 343, in writeregister

    if not self.custom_writeregister(addr + pos, val):

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\DA\xflash\extension\xflash.py", line 309, in custom_writeregister

    if self.cmd(XCmd.CUSTOM_WRITEREGISTER):

       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\DA\xflash\extension\xflash.py", line 268, in cmd

    status = self.status()

             ^^^^^^^^^^^^^

  File "C:\Users\USER\Downloads\mtkclient\MtkClient\mtkclient\Library\DA\xflash\xflash_lib.py", line 129, in status

    magic, datatype, length = unpack("<III", hdr)

                              ^^^^^^^^^^^^^^^^^^^

struct.error: unpack requires a buffer of 12 bytes