[Android General] Rortiz2:
This guide is only for the BQ Aquaris M8 codenamed "aquaris_m8/karin" with mt8163.

NO, this WILL NOT WORK ON ANY BQ M10.

This will flash correct partitions to debrick it.

I am not responsable of any damage in your device, YOU choose to make this modifications.

MATERIAL NEEDED:

Linux based system

USB Cable

Something conductive to short

Install Python3, PySerial, adb, fastboot:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot

Uninstall modemmanager:

sudo apt remove modemmanager

AVAILABLE OPTIONS:

sudo ./dump-bootrom.sh

Will dump the bootrom of the device (Probably will crash, don't worry, the bootrom will be dumped in dumps folder)

sudo ./boot-recovery.sh

This will do the device to boot into recovery (if has working one).

sudo ./boot-fastboot.sh

This will boot the device to fastboot mode using Preloader.

sudo ./gpt-fix.sh

This will restore the gpt of your device using bootROM.

sudo ./bootrom-step.sh

This will basically unbrick the device by flashing his correct partitions (Preloader/TZ/LK). Instructions to unbrick above.

HOW-TO UNBRICK:

1. Download amonet-mt8163-aquaris_m8 from downloads and unpack it.

2. Open the unpacked folder of amonet, open a terminal inside it and type:

sudo ./bootrom-step.sh

3. When you see something like:

[2019-02-07 14:35:59.478924] Waiting for bootrom

You will have two options.

If your tablet has a working Preloader from version 2.1 to 2.9.0 you can just connect the tablet while you press volume +.

If your Preloader version is not inside 2.1-2.9.0 or you have a wrong Preloader, short DAT0 in the attatched picture with GND and at same time connect the tablet.

4. The script will say to remove the short. When this happens, stop pressing the Volume + button or remove the cable that is shorting and press enter.

5. Now just wait until finishes, it should output something like:

r0rtiz2@r0rtiz2-X540LA:~/amonet_bq/amonet$ sudo ./bootrom-step.sh
[sudo] contraseña para r0rtiz2:
[2019-12-20 22:53:05.110947] Waiting for bootrom
[2019-12-20 22:53:24.973079] Found port = /dev/ttyACM0
[2019-12-20 22:53:24.974198] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *

[2019-12-20 22:53:27.981825] Init crypto engine
[2019-12-20 22:53:28.002180] Disable caches
[2019-12-20 22:53:28.003140] Disable bootrom range checks
[2019-12-20 22:53:28.016551] Load payload from ../brom-payload/build/payload.bin = 0x48D8 bytes
[2019-12-20 22:53:28.020237] Send payload
[2019-12-20 22:53:28.684542] Let's rock
[2019-12-20 22:53:28.686183] Wait for the payload to come online...
[2019-12-20 22:53:29.406543] all good
[2019-12-20 22:53:29.407323] Check GPT
[2019-12-20 22:53:29.739682] gpt_parsed = {'proinfo': (1024, 6144), 'nvram': (7168, 10240), 'protect1': (17408, 20480), 'protect2': (37888, 20480), 'persist': (58368, 98304), 'seccfg': (156672, 512), 'lk': (157184, 768), 'boot': (157952, 32768), 'recovery': (190720, 32768), 'secro': (223488, 12288), 'para': (235776, 1024), 'logo': (236800, 16384), 'expdb': (253184, 20480), 'frp': (273664, 2048), 'tee1': (275712, 10240), 'tee2': (285952, 10240)}
[2019-12-20 22:53:29.740037] Check boot0
[2019-12-20 22:53:29.982147] Clear preloader header
[8 / 8]
[2019-12-20 22:53:30.496089] Flashing TEE..
[4569 / 4569]
[2019-12-20 22:55:08.902230] Flashing bootloader..
[537 / 537]
[2019-12-20 22:55:20.719667] Flashing preloader..
[312 / 312]
[2019-12-20 22:55:31.905118] Reboot..
r0rtiz2@r0rtiz2-X540LA:~/amonet_bq/amonet$

6. The device should reboot now.

NOTES:

In lsusb boot-rom shows up as:

Bus 001 Device 009: ID 0e8d:0003 MediaTek Inc. MT6227 phone

If you see:

Bus 001 Device 013: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader

means you're in preloader mode. Try shorting again.

THANKS:

- [MENTION=295159]xyz[/MENTION] for the original exploit.

- [MENTION=7104332]k4y0z[/MENTION] for his messages in the original amonet thread that helped me a lot with porting it to my device:)

- [MENTION=9325417]t0x1cSH[/MENTION] and his patience for finding out the trick to make amonet work in my tab;)

DOWNLOAD:

amonet-mt8163-aquaris_m8