Repository: bkerler/mtkclient

Issue #1435: Device Disconnect on Crashing da: MT6739/MT6731/MT8765()
Created: 2025-04-03T14:56:13Z
Chipset of device is: MT6739WW
If I run:
python mtk.py payload
I get:
.........Port - Device detected :)
Preloader - CPU: MT6739/MT6731/MT8765()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xb4
Preloader - Disabling Watchdog...
Preloader - HW code: 0x699
Preloader - Target config: 0x1
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: False
Preloader - SWJTAG enabled: False
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 4A69...A5F0
Preloader - SOC_ID: 3681...401F
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with errors: Unknown: 0x1d18
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode
Then it re-tries:
.........Port - Device detected :)
Preloader - CPU: MT6739/MT6731/MT8765()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xb4
Preloader - Disabling Watchdog...
Preloader - HW code: 0x699
Preloader - Target config: 0x1
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: False
Preloader - SWJTAG enabled: False
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 4A69...A5F0
Preloader - SOC_ID: 3681...401F
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: Device disconnected

I see that there is a chipset matching MT6739 in the mtkclient payloads, but still receive the error when specifying it via:
python mtk.py payload --payload=mtkclient/payloads/mt6739_payload.bin
After the last device disconnected, the battery must be removed and put back in. Trying to re-run without taking the battery out results in a handshake failed message.
I'm not sure if it's related, but running fastboot getvar all shows that off-mode charge is set to 1. Per this article, AOSP mentions having it at 0 for special modes. Not sure if that's the norm / correct.
Tried to find a key combo for brom, but not sure what to expect. Attempted a test point method, but didn't seem to change the modes when turning on.
Any thoughts?

Duplicate issue #1455: MTK6761 - upload_data failed with error: DAA_SIG_VERIFY_FAILED (0x7024)
Created: 2025-04-30T22:29:03Z
I'm attempting to root a Kyocera KY-42C (Mediatek Helio A22), but when I attempt to run mtkclient, I get this error each time.
Verified this same behavior on

MacOS 15.4 (aarch64)
Ubuntu LiveCD on two different computers

After this occurs, the phone remains unresponsive until I remove the battery, similar to what was reported in #1435.
Is this forced disconnection a known problem with certain types of devices? Are there any known workarounds?
.........Port - Device detected :)
Preloader - 	CPU:			MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x717
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca01
Preloader - 	SW Ver:			0x200
Preloader - ME_ID:			1EAB07BA5E2895CE9792C9FA3CC054AE
Preloader - SOC_ID:			45DB503A362F5AF9AC7CF9E9FB8307DF8F2F6AC4AD19101521D290D9F9887862
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: DAA_SIG_VERIFY_FAILED (0x7024)
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


.....Port - Device detected :)
Preloader - 	CPU:			MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x717
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca01
Preloader - 	SW Ver:			0x200
Preloader - ME_ID:			1EAB07BA5E2895CE9792C9FA3CC054AE
Preloader - SOC_ID:			45DB503A362F5AF9AC7CF9E9FB8307DF8F2F6AC4AD19101521D290D9F9887862
Exploitation - Crashing da...
DeviceClass
DeviceClass - [LIB]: Device disconnected
(mtk_venv)

Closing comment (2025-05-02T01:34:18Z): I'm attempting to root a Kyocera KY-42C (Mediatek Helio A22), but when I attempt to run mtkclient, I get this error each time.
Verified this same behavior on

MacOS 15.4 (aarch64)
Ubuntu LiveCD on two different computers

After this occurs, the phone remains unresponsive until I remove the battery, similar to what was reported in #1435.
Is this forced disconnection a known problem with certain types of devices? Are there any known workarounds?
.........Port - Device detected :)
Preloader - 	CPU:			MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x717
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca01
Preloader - 	SW Ver:			0x200
Preloader - ME_ID:			1EAB07BA5E2895CE9792C9FA3CC054AE
Preloader - SOC_ID:			45DB503A362F5AF9AC7CF9E9FB8307DF8F2F6AC4AD19101521D290D9F9887862
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: DAA_SIG_VERIFY_FAILED (0x7024)
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


.....Port - Device detected :)
Preloader - 	CPU:			MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x717
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca01
Preloader - 	SW Ver:			0x200
Preloader - ME_ID:			1EAB07BA5E2895CE9792C9FA3CC054AE
Preloader - SOC_ID:			45DB503A362F5AF9AC7CF9E9FB8307DF8F2F6AC4AD19101521D290D9F9887862
Exploitation - Crashing da...
DeviceClass
DeviceClass - [LIB]: Device disconnected
(mtk_venv) 


You are in preloader mode.And your preloader may be patched.So crashing da does not work.You need to go to brom mode by  shorting the testpoint.
And another method is exploiting preloader mode to bypass DAA.