Repository: bkerler/mtkclient

Issue #74: sej - HACC init stuck
Created: 2021-09-29T06:31:28Z
E:\mtkclient-main>python mtk xflash seccfg unlock
MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
...........
Port - Device detected :)
Preloader -     CPU:                    MT6755/MT6750/M/T/S(Helio P10/P15/P18)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212c00
Preloader -     Var1:                   0xa
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x326
Preloader - Target config:              0x1
Preloader -     SBC enabled:            True
Preloader -     SLA enabled:            False
Preloader -     DAA enabled:            False
Preloader -     SWJTAG enabled:         False
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          False
Preloader -     Mem write auth:         False
Preloader -     Cmd 0xC8 blocked:       False
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xcb00
Preloader -     SW Ver:                 0x1
Preloader - ME_ID:                      5636FD6EB5F5D5C8723BEC0713B26A3B
Main - Device is unprotected.
PLTools - Loading payload from E:\mtkclient-main\mtkclient\payloads\mt6755_payload.bin, 0x258 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: E:\mtkclient-main\mtkclient\payloads\mt6755_payload.bin
Port - Device detected :)
Main
Main - [LIB]: �[33mDevice is in BROM mode. No preloader given, trying to dump preloader from ram.�[0m
DAXFlash - Uploading stage 1...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - EMMC FWVer:      0x0
DAXFlash - EMMC ID:         RC14MB
DAXFlash - EMMC CID:        150100524331344d42071a92d0ae9353
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size:   0x0
DAXFlash - EMMC GP2 Size:   0x0
DAXFlash - EMMC GP3 Size:   0x0
DAXFlash - EMMC GP4 Size:   0x0
DAXFlash - EMMC RPMB Size:  0x400000
DAXFlash - EMMC USER Size:  0xe8f800000
DAXFlash - Reconnecting to preloader
DAXFlash - Connected to preloader
DAXFlash - DA-CODE      : 0x50B76
DAXFlash
DAXFlash - [LIB]: �[31mError on sending data: DA hash mismatch (0xc0070004)�[0m
DAXFlash
DAXFlash - [LIB]: �[33mDA Extensions failed to enable�[0m
sej - HACC init
Traceback (most recent call last):
File "E:\mtkclient-main\mtk", line 1704, in 
mtk = Main(args).run()
File "E:\mtkclient-main\mtk", line 1097, in run
mtk.daloader.seccfg(args.flag)
File "E:\mtkclient-main\mtkclient\Library\mtk_daloader.py", line 173, in seccfg
return self.xft.seccfg(lockflag)
File "E:\mtkclient-main\mtkclient\Library\xflash_ext.py", line 444, in seccfg
sc_new.create(prelock, hwtype)
File "E:\mtkclient-main\mtkclient\Library\xflash_ext.py", line 74, in create
enc_hash = self.hwc.sej.sej_sec_cfg_hw(dec_hash, True)
File "E:\mtkclient-main\mtkclient\Library\hwcrypto_sej.py", line 489, in sej_sec_cfg_hw
self.SEJ_Init(encrypt=encrypt)
File "E:\mtkclient-main\mtkclient\Library\hwcrypto_sej.py", line 281, in SEJ_Init
if self.reg.HACC_ACON2 > 0x80000000:
File "E:\mtkclient-main\mtkclient\Library\hwcrypto_sej.py", line 83, in getattribute
return self.read32(addr)
File "E:\mtkclient-main\mtkclient\Library\xflash_ext.py", line 278, in readmem
val = self.custom_read(addr + pos * 4, 4)
File "E:\mtkclient-main\mtkclient\Library\xflash_ext.py", line 247, in custom_read
if self.cmd(XCmd.CUSTOM_READ):
File "E:\mtkclient-main\mtkclient\Library\xflash_ext.py", line 237, in cmd
if self.xsend(self.xflash.Cmd.DEVICE_CTRL):
File "E:\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 185, in xsend
return self.usbwrite(data)
File "E:\mtkclient-main\mtkclient\Library\usblib.py", line 460, in usbwrite
res = self.write(data, pktsize)
File "E:\mtkclient-main\mtkclient\Library\usblib.py", line 391, in write
ctr = self.EP_OUT.write(command[pos:pos + pktsize])
File "C:\Users\Ryan\AppData\Local\Programs\Python\Python39\lib\site-packages\usb\core.py", line 408, in write
return self.device.write(self, data, timeout)
File "C:\Users\Ryan\AppData\Local\Programs\Python\Python39\lib\site-packages\usb\core.py", line 979, in write
return fn(
File "C:\Users\Ryan\AppData\Local\Programs\Python\Python39\lib\site-packages\usb\backend\libusb1.py", line 837, in bulk_write
return self.__write(self.lib.libusb_bulk_transfer,
File "C:\Users\Ryan\AppData\Local\Programs\Python\Python39\lib\site-packages\usb\backend\libusb1.py", line 930, in __write
retval = fn(dev_handle.handle,
KeyboardInterrupt
^C
E:\mtkclient-main>

Duplicate issue #77: Stuck at sej - HACC init while trying to unlock a Nokia 5.1 (CO2)
Created: 2021-09-29T20:57:45Z
I'm running this currently on a old Asus laptop (UX31A) with Ubuntu 20.10, But I've also tried to use it on a Raspberry Pi 4 running Ubuntu 20.04 and a custom desktop running Windows 10 to no success
Extracted preloader: (I see that there's already a preloader_CO2.bin in the loader folder, is that file named incorrectly?)
preloader_co2.zip
Logs:
jack@jack-UX31A:~/mtkclient$ python3 mtk e metadata,userdata
MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Port - Device detected :)
Preloader - 	CPU:			MT6755/MT6750/M/T/S(Helio P10/P15/P18)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212c00
Preloader - 	Var1:			0xa
Preloader - Disabling Watchdog...
Preloader - HW code:			0x326
Preloader - Target config:		0x1
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		False
Preloader - 	SWJTAG enabled:		False
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xcb00
Preloader - 	SW Ver:			0x1
Preloader - ME_ID:			5B022942D7A643C5911E0A263D8ED3B6
Main - Device is unprotected.
PLTools - Loading payload from /home/jack/mtkclient/mtkclient/payloads/mt6755_payload.bin, 0x258 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /home/jack/mtkclient/mtkclient/payloads/mt6755_payload.bin
Port - Device detected :)
Main
Main - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.
Successfully extracted preloader for this device to: /home/jack/mtkclient/mtkclient/Loader/Preloader/preloader_co2.bin
DAXFlash - Uploading stage 1...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - EMMC FWVer:      0x0
DAXFlash - EMMC ID:         QE63MB
DAXFlash - EMMC CID:        150100514536334d4203b18cc68b752d
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size:   0x0
DAXFlash - EMMC GP2 Size:   0x0
DAXFlash - EMMC GP3 Size:   0x0
DAXFlash - EMMC GP4 Size:   0x0
DAXFlash - EMMC RPMB Size:  0x400000
DAXFlash - EMMC USER Size:  0x3a3e00000
DAXFlash - Reconnecting to preloader
DAXFlash - Connected to preloader
DAXFlash - DA-CODE      : 0x50B76
DAXFlash - DA Extensions successfully added
DAXFlash - Formatting addr 0x5bc8000 with length 0x2000000, please standby....
DAXFlash - Successsfully formatted addr 0x5bc8000 with length 33554432.
Formatted sector 187968 with sector count 65536.
DAXFlash - Formatting addr 0x198800000 with length 0x20a5fbe00, please standby....
DAXFlash - Successsfully formatted addr 0x198800000 with length 8763981312.
Formatted sector 13385728 with sector count 17117151.
jack@jack-UX31A:~/mtkclient$ python3 mtk xflash seccfg unlock
MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021

sej - HACC init
^CTraceback (most recent call last):
  File "/home/jack/mtkclient/mtk", line 1704, in <module>
    mtk = Main(args).run()
  File "/home/jack/mtkclient/mtk", line 1097, in run
    mtk.daloader.seccfg(args.flag)
  File "/home/jack/mtkclient/mtkclient/Library/mtk_daloader.py", line 173, in seccfg
    return self.xft.seccfg(lockflag)
  File "/home/jack/mtkclient/mtkclient/Library/xflash_ext.py", line 444, in seccfg
    sc_new.create(prelock, hwtype)
  File "/home/jack/mtkclient/mtkclient/Library/xflash_ext.py", line 74, in create
    enc_hash = self.hwc.sej.sej_sec_cfg_hw(dec_hash, True)
  File "/home/jack/mtkclient/mtkclient/Library/hwcrypto_sej.py", line 489, in sej_sec_cfg_hw
    self.SEJ_Init(encrypt=encrypt)
  File "/home/jack/mtkclient/mtkclient/Library/hwcrypto_sej.py", line 281, in SEJ_Init
    if self.reg.HACC_ACON2 > 0x80000000:
  File "/home/jack/mtkclient/mtkclient/Library/hwcrypto_sej.py", line 83, in __getattribute__
    return self.read32(addr)
  File "/home/jack/mtkclient/mtkclient/Library/xflash_ext.py", line 278, in readmem
    val = self.custom_read(addr + pos * 4, 4)
  File "/home/jack/mtkclient/mtkclient/Library/xflash_ext.py", line 247, in custom_read
    if self.cmd(XCmd.CUSTOM_READ):
  File "/home/jack/mtkclient/mtkclient/Library/xflash_ext.py", line 241, in cmd
    status = self.status()
  File "/home/jack/mtkclient/mtkclient/Library/mtk_daxflash.py", line 215, in status
    tmp = self.usbread(length)
  File "/home/jack/mtkclient/mtkclient/Library/usblib.py", line 417, in usbread
    extend(epr(resplen))
  File "/usr/local/lib/python3.9/dist-packages/pyusb-1.2.1-py3.9.egg/usb/core.py", line 423, in read
    return self.device.read(self, size_or_buffer, timeout)
  File "/usr/local/lib/python3.9/dist-packages/pyusb-1.2.1-py3.9.egg/usb/core.py", line 1021, in read
    intf, ep = self._ctx.setup_request(self, endpoint)
  File "/usr/local/lib/python3.9/dist-packages/pyusb-1.2.1-py3.9.egg/usb/core.py", line 113, in wrapper
    return f(self, *args, **kwargs)
  File "/usr/local/lib/python3.9/dist-packages/pyusb-1.2.1-py3.9.egg/usb/core.py", line 229, in setup_request
    self.managed_claim_interface(device, intf)
  File "/usr/local/lib/python3.9/dist-packages/pyusb-1.2.1-py3.9.egg/usb/core.py", line 113, in wrapper
    return f(self, *args, **kwargs)
KeyboardInterrupt

jack@jack-UX31A:~/mtkclient$ ^C
jack@jack-UX31A:~/mtkclient$

Closing comment (2021-09-30T01:26:33Z): This is probably a duplicate of #74 so I put my stuff in there and I'm gonna close this issue