yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] Ikefix:
Please

Well, I reply to myself, you have not to install the driver as it is but the usb driver FILTER (do not let you mislead by some tutorials), after that, the message saying the bootloader is unlocked will appear. AND do not try the archlinux especial fireiso distro way if you are not a PRO, you are going to fall in any kind of problems, even installing python is going to be complicated, as it is a deprecated distro based (and the disco dingo ubuntu version same problems and others), and I have to say that I'm a linux fan, but sometimes windows is the way
[Miscellaneous Android Development] Ikefix:
Now that I have the cmd part completed, I'm running into 3 problems:

First: the SP flash tool does not appear to do anything, but I do not have a clear log of it, simply, it does not show any changes, I mean, even if I change the com port (you have to check it in devices, mediatek labeled) and the ELD mode is fine, the tool does not show anything?

Second, even if the tool shows something, apparently, after that I'd need a SCATTER file fo samsung A125f, which I do not have and you fall into obscure sites promising the file if you send your mail and so on WTF!!!

Third: even if you have the unlocked MTK security, true is that in my phone, in download mode screen, it is always active (mtk secure boot enabled [0] and sec crtl status [1]), I mean, nothing has changed from the smartphone side.

Please, gods of XDAforums, how can I possibly root this mediatek Samsung a12!!!

EDIT:not the DA but scatter file, sorry

EDIT 2: I got to get the scatter file! It is not the MTK-bypass/bypass_utility what you need for this but the MTK AUTH BYPASS TOOL ((MABT) V30), I was confused, the last one has a GUI, so no need to give my money to a ehhhh somebody

EDIT 3: and it is not the csc file from ODIN software, you can dowload it as soon as it matches the exact model of your phone, but I do NOT suggest you to use the SamFirm Tool, as it is probably going to annoy you with all kind of firmware not found messages, even if your reference is 100% right.

EDIT 4: now the flash utility shows some kind of trouble, I can't go beyond errors

status error (0xC0010001)​

and

Error 0xC0030004

Any help appreciated, thanks
[Miscellaneous Android Development] sdsboot:
this tool does not bypassing auth on my tecno camon 20, mt6768
[Miscellaneous Android Development] GL1TCH2928:
Will this thing work on a Amazon Fire Stick 3rd gen running mtk 8695???
[Miscellaneous Android Development] zerodaywild:
hi Guys i hope people still frequent this aweswome post. i need help i get error .

C:\Users\cintr\Downloads\bypass_utility-master\bypass_utility-master>python main.py
Traceback (most recent call last):
File "C:\Users\cintr\Downloads\bypass_utility-master\bypass_utility-master\main.py", line 237, in <module>
main()
File "C:\Users\cintr\Downloads\bypass_utility-master\bypass_utility-master\main.py", line 38, in main
raise RuntimeError("Default config is missing")
RuntimeError: Default config is missing

my device is T mobile RevvL v+ 5G.

i use a windows laptop.

im also having trounle in mtkclient with coundn't get handshake.

i have the mediatek drivers and the usbdk drivers installed.

edit: i learned that i had gto download the payload and extract it. see my follwing post about new error .
[Miscellaneous Android Development] DragonFire1024:
Great stuff! Finally there is light at the end of the tunnel for this LG LM-K500 (LG K51) with mediatek mt6765. Everything except for the last step completes. I am on a windows machine here.

C:\Users\DragonFire\Downloads\bypass_utility-1.4.1\bypass_utility-1.4.1>python main.py
[2021-02-22 00:51:12.326790] Waiting for device
[2021-02-22 00:51:21.486802] Found port = COM31

[2021-02-22 00:51:21.546802] Device hw code: 0x766
[2021-02-22 00:51:21.546802] Device hw sub code: 0x8a00
[2021-02-22 00:51:21.546802] Device hw version: 0xca00
[2021-02-22 00:51:21.546802] Device sw version: 0x0
[2021-02-22 00:51:21.556802] Device secure boot: True
[2021-02-22 00:51:21.556802] Device serial link authorization: False
[2021-02-22 00:51:21.556802] Device download agent authorization: True

[2021-02-22 00:51:21.556802] Disabling watchdog timer
[2021-02-22 00:51:21.556802] Disabling protection
Traceback (most recent call last):
File "main.py", line 213, in <module>
main()
File "main.py", line 58, in main
result = exploit(device, config.watchdog_address, config.payload_address, co
nfig.var_0, config.var_1, payload)
File "C:\Users\DragonFire\Downloads\bypass_utility-1.4.1\bypass_utility-1.4.1\
src\exploit.py", line 32, in exploit
udev = usb.core.find(idVendor=0x0E8D, idProduct=0x3)
File "C:\Users\DragonFire\AppData\Local\Programs\Python\Python38\lib\site-pack
ages\usb\core.py", line 1299, in find
raise NoBackendError('No backend available')
usb.core.NoBackendError: No backend available
[Miscellaneous Android Development] wentaas:
wdym bootrom mode? fastboot? i'm just plugging my turned off device whilst holding volume down. it turns on into fastboot in a few seconds and plays the usb plugged in sound
[Miscellaneous Android Development] XRed_CubeX:
Device?
[Miscellaneous Android Development] wentaas:
redmi note 8 pro global as i've said
[Miscellaneous Android Development] XRed_CubeX:
To put your device in BRom mode you may need a different key combination or a test point, find out on the internet how to put the device in BRom mode or ask various devs of that device
[Miscellaneous Android Development] DragonFire1024:
No one?
[Miscellaneous Android Development] wentaas:
i cant really find anything for bootrom online, do you mean the recovery menu you get with up and power? or bootloader mode which i have to unlock for anyway, is there some way to do it through adb maybe?
[Miscellaneous Android Development] wentaas:
sorry just saw it, its an error with the usb library so im p sure something went wrong there, have you installed libusb filters?
[Miscellaneous Android Development] DragonFire1024:
Installed lsusb PROPERLY now...it worked!

C:\Users\DragonFire\Downloads\bypass_utility-1.4\bypass_utility-1.4>python main.py
[2021-02-22 07:43:08.859921] Waiting for device
[2021-02-22 07:43:17.221933] Found port = COM31

[2021-02-22 07:43:17.291933] Device hw code: 0x766
[2021-02-22 07:43:17.291933] Device hw sub code: 0x8a00
[2021-02-22 07:43:17.291933] Device hw version: 0xca00
[2021-02-22 07:43:17.291933] Device sw version: 0x0
[2021-02-22 07:43:17.291933] Device secure boot: True
[2021-02-22 07:43:17.291933] Device serial link authorization: False
[2021-02-22 07:43:17.291933] Device download agent authorization: True

[2021-02-22 07:43:17.291933] Disabling watchdog timer
[2021-02-22 07:43:17.291933] Disabling protection
[2021-02-22 07:43:17.331933] Protection disabled

Now what? lol. I know it says run SP Flash tool...but to do what? Up until now, I haven't even gotten firmware to flash (also failed some sort of authentication. LG K51/LM-K500 here from Boost Mobile). There is no fastboot and I cannot boot to a bootloader. Only standard Android recovery, and I can't even wipe cache. If TWRP is any hope, or root, SP flash tool is currently my only option i believe.
[Miscellaneous Android Development] wentaas:
to my knowledge you can do whatever you want in sp flash tool its v low level
[Miscellaneous Android Development] DragonFire1024:
Which here in lies the problem...it doesn't do me the least bit of good without a working scatter file. I say working because in firmware from other carriers of the same exact device, there is a "scatter" file inside the firmware, but SP Flash tool won''t recognize it as proper. When viewing it in Notepad++, it's very much f**ked. If it's to even come close to working, all the text needs to be re written as its gutted. Not even sure all the information is even available as text inside that file to even consider it.
[Miscellaneous Android Development] wentaas:
well you have sp flash tools access, its up to what you wanna install to support it. i'd give it some time first
[Miscellaneous Android Development] harshad_kp:
is it possible to get support for MT6750 devices...
[Miscellaneous Android Development] wentaas:
i feel dumb now, turns out i did have to hold down volume up on xiaomi too (contrary to the guide), so i installed the filter driver this time for serial, and plugged it in but it gave me blue screen with wkey invalid driver or smth so i booted fireiso live usb on my mac and it seemed to work, i've yet to try sp flash tools on it but that'd be p useless if i cant use fastboot, so can i use fastboot this way? since cfw requires fastboot flash
[Miscellaneous Android Development] Darkdrium:
Hello guys, thank you for giving me hope to unbrick my RN8P. I completed almost every step, but I am not able to install SP_Flash_Tool on Linux. The error I get when I try to start the flash tool is sudo: error while loading shared libraries: libpng12.so.0: cannot open shared object file: No such file or directory.

I am not sure if this the right thread for Linux questions because today is a first time for many things, please correct me if I do anything wrong.
[Miscellaneous Android Development] Rortiz2:
As you said, this is not the right place to ask these types of questions (not related to the unlock itself). Google is always your friend in solving such problems.
[Miscellaneous Android Development] razers211:
to put your device in brom mode you can try holding all buttons together (volume + volume - and power button) untill it shows that the security is disabled on the cmd then you can flash with sp flash tool
[Miscellaneous Android Development] k4y0z:
Use a more recent version of SP Flash...
[Miscellaneous Android Development] wentaas:
apparently it was vol + and plus so i got that security disabled prompt but i cant do much w it since i need fastboot for cfw and cfw for twrp, is there a way to gain fastboot access using this method?
[Miscellaneous Android Development] k4y0z:
As you've said yourself, this utility allows you to use SP Flash Tool to flash anything you want without the need for authentication.

And that's really all it does.

Anything beyond that, such as obtaining a compatible scatter-file or unlocking your bootloader i.e. to get fastboot-access is better to be discussed in your device-specific forums.
[Miscellaneous Android Development] yalik07:
Indeed, it works. Performed on MT 6761 Windows 7x64 + Python 3.8.8 BUT! this is only access to the SP Flash Tool, if there is no exclusive DA and Auth. If the bootloader is locked, then you can only merge BackUp. Which is not bad either. Further, with the help of Wwr MTK, it is possible to cut the Dump and create a Scatter. Thank!
[Miscellaneous Android Development] wentaas:
i see thanks, just gotta wait till someone that knows this stuff does it
[Miscellaneous Android Development] HemanthJabalpuri:
Sorry for going off-topic.

Why don't you use WwR MTK tool to generate scatter file? See https://forum.hovatek.com/thread-21970.html
[Miscellaneous Android Development] DragonFire1024:
There is no device specific forum for my device. I can confirm however it does flash a boot image and a recovery image however it appears nothing changes. I unpacked both, made some simple edits such as making ro.adb.secure=0, repack both, loaded a scatter file from a generic mt6765, entered manually the start address for the boot image, along with the path of the newly packed Boot and recovery images, pressed download then put the device into boot ROM, images successfully flash but nothing appears to have changed and ADB is still secure. I am using images from the same exact OTA the device is on but not from the same carrier. in the instance of this device that should not matter.
[Miscellaneous Android Development] DragonFire1024:
Duplicate
[Miscellaneous Android Development] k4y0z:
Then please create a new thread and people can try to help you there.

This is not a discussion that belongs here.

Either way, I hope you made a backup, before writing boot/recovery images to random locations.

If the locations were correct your device probably wouldn't boot anymore, since I assume your bootloader is still locked.
[Miscellaneous Android Development] DragonFire1024:
I very much would like to do that but where is what I don't know. From what I can understand based on the properties I can see on the device itself and the boot images I have:

ro.oem_unlock_supported=1
sys.oem_unlock_allowed=1

the thing the device lacks is a method to actually perform the unlock procedure which is fastboot. And I cannot reboot the bootloader because all it does is reboot the device. At the moment the only viable method I have right now in an attempt to flash anything is sp flash tool. Otherwise all other various security lockouts stop me from doing so.at least now I know I'm able to flash something whether it works after the device boots or not is an entirely different story.
[Miscellaneous Android Development] mrvirtual503:
i'm new here. can this methode be done on a mi a3?
[Miscellaneous Android Development] wentaas:
i dont recommend you to do this if you dont know what you're doing, but you can check the supported SoCs in the main reply and see if your phone's SoC is in them
[Miscellaneous Android Development] mrvirtual503:
i meant that i'm new to this page, but not new to rooting and flashing custom roms. the reason i'm asking , is because my mi a3 is in lock state. and this new methode seems promising
[Miscellaneous Android Development] k4y0z:
Xiaomi Mi A3 is a Qualcomm device :rolleyes:
[Miscellaneous Android Development] mrvirtual503:
i know , but is there anything simular for Qualcomm devices?
[Miscellaneous Android Development] abodoma:
REDMI 6A MT6765_Android no luck

C:\Users\*****\AppData\Local\Programs\Python\Python37>python main.py

Traceback (most recent call last):

File "main.py", line 213, in <module>

main()

File "main.py", line 37, in main

raise RuntimeError("Default config is missing")

RuntimeError: Default config is missing
[Miscellaneous Android Development] XRed_CubeX:
Extract the exploit collection
[Miscellaneous Android Development] jasonmerc:
Figured id pop in here and see if anyone else is having a similar problem.

I've got an AT&T Radiant Core, aka the Tinno U304AA with an MTK6739. I've also got a windows machine that has SPFT 5.2104 and the bypass tool. I know for a fact the bypass tool is working because SPFT used to complain about needing an auth file and now it's not. Now however, SPFT is complaining about a bad preloader, error code 0xC0030004, whenever I try to read back anything at all.

By the way, there is no other stock firmware dump for the U304AA here. No preloaders, no scatter files, no nothing. I've been (trying to be) operating on preexisting scatters for this chipset. I've never had a problem using scatters from other phones before. Like when I used SPFT on the Blu R1HD (6735) we used the scatter from another phone and it worked just fine. So just for context, there is literally nothing else out there for my U304AA, if I succeed I will be the first to make any sort of dump which is part of the reason why I want to do it.

Has anyone else had this problem, and if so can you share some tips to maybe help me bypass it?

Thanks in advance!

EDIT: I should mention too that I can't get into fastboot at all. There's an option to enable OEM unlocking in the developer settings but no way to enter fastboot/download mode to actually unlock the bootloader. That's part of the reason why I want to try SPFT to make things happen on my U304AA here, because there doesn't seem to be any other option.
[Miscellaneous Android Development] Tarutarosu:
How to download?
[Miscellaneous Android Development] k4y0z:
On some devices/newer SP versions, you need a compatible preloader for DRAM configuration, you might be able to use a preloader from a similar device for Readback.
[Miscellaneous Android Development] jasonmerc:
Thanks for the quick response. So I'll need to find a similar device and get the preloader from there. Where do I put it in SPFT? The only options I see are Download Agent, Scatter File, and Auth File. I apologize for the noob questions, it's just been a while since I've done MediaTek hacking and I'd like to get back in the game
[Miscellaneous Android Development] k4y0z:
With an appropriate Scatter File, the preloader can be selected in the Download Tab.

For further generic questions regarding SP I suggest you create a new thread.
[Miscellaneous Android Development] jasonmerc:
Thank you for the help. My apologies for derailing the thread, I just wanted to get that quick clarification before I tried again.
[Miscellaneous Android Development] Last_Sage:
I flashed Redmi note 8 pro (begonia) with this utility and the flashing was completed successfully. But the device is not booting. It is stuck on logo and restarts after few seconds. Only fastboot can be accessed.

Tired 3 stock rom versions. Same result. The logo is changing when installing older version.

Thanks for the bypass utility...
[Miscellaneous Android Development] MEGAFON929:
Ready set of files. The archive has a very detailed setup instructions in Russian, Ukrainian and English. https://megafon929.github.io/mtk

Also in this archive there are drivers that have been tested for performance with this method
[Miscellaneous Android Development] shantorana:
Can I use it in android..?
[Miscellaneous Android Development] MEGAFON929:
All versions
[Miscellaneous Android Development] Last_Sage:
It didn't work. Flashing was successfully completed but the phone (redmi note 8 pro) is still stuck on logo.

Is there any way to check if the internal storage is healthy or not?
[Miscellaneous Android Development] abodoma:
sorry my bad

my device xaiomi redmi 6a mtk is back to life thanks to this method
[Miscellaneous Android Development] abodoma:
xaiomi redmi 6a

flash successfully without mi authorised account
[Miscellaneous Android Development] MEGAFON929:
log please
[Miscellaneous Android Development] MEGAFON929:
Log brom.bat, please
[Miscellaneous Android Development] XRed_CubeX:
Try to flash a recovery rom
[Miscellaneous Android Development] HemanthJabalpuri:
Someone tell me what is this error.

I am trying to make scatter file for Realme C12 having Helio G35 MT6765 using WwR MTK.

Installed Python 3.8.8 in Windows 7 64bit

Is this MTK-bypass error or SPFlash tool one?

Thanks
[Miscellaneous Android Development] MEGAFON929:
Use this Download Agent
[Miscellaneous Android Development] HemanthJabalpuri:
Sir, it is not working. Same error repeats.

It seems like I need to place the preloader file in the folder as Scatter file.

When I am doing multiple read backs, only first read back is working. After that is struck with Stop icon only. To do second readback I have to boot to device and then power off and connect again. Am I doing something wrong?

Thanks
[Miscellaneous Android Development] zelipukin:
Anyone to explain:

Does it 100% mean that this bricked device (F150 [sub of Oukitel] B2021, mt6765) is totally insecure with no protection at all ?

Can't flash any xxx-verified.img :

Thank you !
[Miscellaneous Android Development] zelipukin:
del
[Miscellaneous Android Development] bdx°:
mt6360 redmi note 8 pro (begonia)

is not on the list 😭😭

I got hard brick , only vibrate also led on,,

my screen is not responded

somebody help me pls
[Miscellaneous Android Development] borys235:
Redmi 6, cereus is connected to Debian

0e8d:0003 MediaTek Inc. MT6227 phone

Log from main.py looks like this:

[2021-03-12 10:02:27.517621] Waiting for device
[2021-03-12 10:02:31.117445] Found port = /dev/ttyACM0

[2021-03-12 10:02:31.164193] Device hw code: 0x766
[2021-03-12 10:02:31.164324] Device hw sub code: 0x8a00
[2021-03-12 10:02:31.164394] Device hw version: 0xca00
[2021-03-12 10:02:31.164474] Device sw version: 0x0
[2021-03-12 10:02:31.164540] Device secure boot: True
[2021-03-12 10:02:31.164605] Device serial link authorization: True
[2021-03-12 10:02:31.164783] Device download agent authorization: True

[2021-03-12 10:02:31.164884] Disabling watchdog timer
[2021-03-12 10:02:31.165692] Disabling protection
[Errno 5] Input/Output Error
[2021-03-12 10:02:32.188630] Payload did not reply

What's the problem? For debug purpose I've also added a log in 'exploit' method. Payload was loaded properly, but the method wasn't even invoked.

Sorry,

I missed current runnig kernel out. It should be this from kamakiri (https://github.com/amonet-kamakiri)
[Miscellaneous Android Development] HemanthJabalpuri:
@k4y0z

When we take multiple read backs in SPFlashTool, then we have to put the device again in MTK-bypass mode to keep it working(i.e., boot key + Power for 15 secs when it is connected to be detected by MTK-bypass).

Any solution to overcome this?

Thanks
[Miscellaneous Android Development] CXZa:
If the scatter file is all you want then why don't you use the scatter.txt from the update to make one...

Software Update - realme (India)

Update the latest software version on your realme phone.

www.realme.com

https://xdaforums.com/t/q-does-anyone-have-a-mt6737-scatter-file.3727743/#post-84627193
[Miscellaneous Android Development] Qwerty_in_me:
@k4y0z

since MT6762 isn't officially supported yet and I've bricked mine, here's the bootrom file for it.

I have no idea how to reverse engineer an exploit for it so could you please lend me a hand?

Honestly, even a schotty guide will do, I'm persistent enought that I could probably make one myself; I just don't know where to start
[Miscellaneous Android Development] k4y0z:
This is not related to BROM authentication, make sure you are using the right images for your device or try using manual write mode.

AFAIK begonia uses mt6785, which is already supported.

This is a limitation of SP Flash Tool.

0x766 is mt6765 which is already supported.

mt6762 should be the same as mt6761 (0x717) which is also supported.
[Miscellaneous Android Development] XRed_CubeX:
Sorry for the trouble but MT6753 is not supported and comes from some other soc or does it need porting?
[Miscellaneous Android Development] k4y0z:
Compare the hw_codes in the default_config to see if it's supported.

Mt6753 would be 0x337 I believe, which is not currently supported.
[Miscellaneous Android Development] Yoss Roness:
Sorry for the delay, but here's a bootrom-dump

It didn't seem to work though, here's the result

[Errno 110] Operation timed out

[2021-03-14 23:38:23.126636] Found send_dword, dumping bootrom to bootrom_766.bin
[Miscellaneous Android Development] Adamsong:
I followed the steps provded and get this

Can help anyone why is stack waiting for device?

This can help:

PS C:\bypass_utility-1.4.1> python .\main.py

[2021-03-25 19:09:05.553829] Waiting for device

Traceback (most recent call last):

File "C:\bypass_utility-1.4.1\main.py", line 213, in <module>

main()

File "C:\bypass_utility-1.4.1\main.py", line 42, in main

device = Device().find()

File "C:\bypass_utility-1.4.1\src\device.py", line 38, in find

time.sleep(0.25)

KeyboardInterrupt

PS C:\bypass_utility-1.4.1>
[Miscellaneous Android Development] XRed_CubeX:
Ok so keep the bootrom file, good job!
[Miscellaneous Android Development] aangelowww:
pls help already filtered the mtk using libusb my phone is lg k5 x220
[Miscellaneous Android Development] k4y0z:
What's the issue?

This device doesn't have any security enabled, so there's nothing to bypass.
[Miscellaneous Android Development] aangelowww:
thanks! but after changing the connection to uarf 921600

i got this problem, tried trying another com port but still. pls help
[Miscellaneous Android Development] aangelowww:
should i unfilter the mtk from libusb? or no?
[Miscellaneous Android Development] k4y0z:
Try using USB instead of UART and DON'T RUN the bypass-utility.
[Miscellaneous Android Development] Shlivko:
On MT6765(62) I'm getting stuck on the "Found Port: COM"

Am I only one who have this problem?

I'm using Win10*64, I also tryed Win7*64. Installed all drivers(libusb/old device driver) and Python too.