Bricked Nokia TA-1188

Pages (2): 1 2 Next

qla
Enthusiastic Member

10-10-2022, 11:18 AM

I've been looking for help on the Internet and I don't know how I couldn't see this forum.

I use Linux.
My problem: - bricked Nokia TA-1188

Screenshot_20221009_190949.png
Size: 50.86 KB / Downloads: 10

I try to upload new rom to my Nokia TA-1188 via SP_Flash_Tool-5.1916_Linux.
firmware: https://drive.google.com/uc?id=1ORCq7T2H...t=download

I want get STOCK firmware via https://www.hovatek.com/forum/thread-26928.html but I don't have password and login

Now telephone is locked and nothing can be done.
Fastboot mode cannot be enabled and the phone cannot be turned on.

After how SP flash tool show error - I try unlock tel.
- https://www.hovatek.com/forum/thread-808.html
- https://www.hovatek.com/forum/thread-286.html

- via Bypas utility:

Quote:# python3 ./main.py
[2022-10-09 23:10:29.137308] Waiting for device
[2022-10-09 23:10:41.969952] Found device = 0e8d:2000

[2022-10-09 23:10:42.052289] Device hw code: 0x717
[2022-10-09 23:10:42.052480] Device hw sub code: 0x8a00
[2022-10-09 23:10:42.052636] Device hw version: 0xca01
[2022-10-09 23:10:42.052768] Device sw version: 0x200
[2022-10-09 23:10:42.052899] Device secure boot: True
[2022-10-09 23:10:42.053028] Device serial link authorization: False
[2022-10-09 23:10:42.053154] Device download agent authorization: False

[2022-10-09 23:10:42.053287] Found device in preloader mode, trying to crash...

[2022-10-09 23:10:42.054264] status is 7024

[2022-10-09 23:10:43.976736] Waiting for device
[2022-10-09 23:10:43.977879] Found device = 0e8d:0003

[2022-10-09 23:10:44.056015] Device hw code: 0x717
[2022-10-09 23:10:44.056196] Device hw sub code: 0x8a00
[2022-10-09 23:10:44.056302] Device hw version: 0xca01
[2022-10-09 23:10:44.056400] Device sw version: 0x200
[2022-10-09 23:10:44.056497] Device secure boot: True
[2022-10-09 23:10:44.056627] Device serial link authorization: False
[2022-10-09 23:10:44.056734] Device download agent authorization: False

[2022-10-09 23:10:44.056846] Disabling watchdog timer
[2022-10-09 23:10:44.057470] Insecure device, sending payload using send_da
[2022-10-09 23:10:44.096292] Found send_dword, dumping bootrom to bootrom_717.bin

Still error - look pic up

and:

Quote:$ mtk reset
MTK Flash/Exploit Client V1.6.0 © B.Kerler 2018-2022

DAXFlash - HW-CODE : 0x717
DAXFlash - HWSUB-CODE : 0x8A00
DAXFlash - HW-VERSION : 0xCA01
DAXFlash - SW-VERSION : 0x200
DAXFlash - CHIP-EVOLUTION : 0x0
DAXFlash - DA-VERSION : 1.0
DeviceClass - [Errno 2] Entity not found
Reset command was sent. Disconnect usb cable to power off.

Still error - look pic up - and the phone cannot be turned on.

Any help please - how to unbrick my phone - PLEASE Big Grin

justshez
Senior Member

2,505

10-10-2022, 04:53 PM

(10-10-2022, 11:18 AM)qla I've been looking for help on the Internet and I don't know how I couldn't see this forum.

I use Linux.
My problem: - bricked Nokia TA-1188

I try to upload new rom to my Nokia TA-1188 via SP_Flash_Tool-5.1916_Linux.
firmware: https://drive.google.com/uc?id=1ORCq7T2H...t=download

I want get STOCK firmware via https://www.hovatek.com/forum/thread-26928.html but I don't have password and login

Now telephone is locked and nothing can be done.
Fastboot mode cannot be enabled and the phone cannot be turned on.

After how SP flash tool show error - I try unlock tel.
- https://www.hovatek.com/forum/thread-808.html
- https://www.hovatek.com/forum/thread-286.html

- via Bypas utility:

Quote:# python3 ./main.py
[2022-10-09 23:10:29.137308] Waiting for device
[2022-10-09 23:10:41.969952] Found device = 0e8d:2000

[2022-10-09 23:10:42.052289] Device hw code: 0x717
[2022-10-09 23:10:42.052480] Device hw sub code: 0x8a00
[2022-10-09 23:10:42.052636] Device hw version: 0xca01
[2022-10-09 23:10:42.052768] Device sw version: 0x200
[2022-10-09 23:10:42.052899] Device secure boot: True
[2022-10-09 23:10:42.053028] Device serial link authorization: False
[2022-10-09 23:10:42.053154] Device download agent authorization: False

[2022-10-09 23:10:42.053287] Found device in preloader mode, trying to crash...

[2022-10-09 23:10:42.054264] status is 7024

[2022-10-09 23:10:43.976736] Waiting for device
[2022-10-09 23:10:43.977879] Found device = 0e8d:0003

[2022-10-09 23:10:44.056015] Device hw code: 0x717
[2022-10-09 23:10:44.056196] Device hw sub code: 0x8a00
[2022-10-09 23:10:44.056302] Device hw version: 0xca01
[2022-10-09 23:10:44.056400] Device sw version: 0x200
[2022-10-09 23:10:44.056497] Device secure boot: True
[2022-10-09 23:10:44.056627] Device serial link authorization: False
[2022-10-09 23:10:44.056734] Device download agent authorization: False

[2022-10-09 23:10:44.056846] Disabling watchdog timer
[2022-10-09 23:10:44.057470] Insecure device, sending payload using send_da
[2022-10-09 23:10:44.096292] Found send_dword, dumping bootrom to bootrom_717.bin

Still error - look pic up

and:

Quote:$ mtk reset
MTK Flash/Exploit Client V1.6.0 © B.Kerler 2018-2022

DAXFlash - HW-CODE : 0x717
DAXFlash - HWSUB-CODE : 0x8A00
DAXFlash - HW-VERSION : 0xCA01
DAXFlash - SW-VERSION : 0x200
DAXFlash - CHIP-EVOLUTION : 0x0
DAXFlash - DA-VERSION : 1.0
DeviceClass - [Errno 2] Entity not found
Reset command was sent. Disconnect usb cable to power off.

Still error - look pic up - and the phone cannot be turned on.

Any help please - how to unbrick my phone - PLEASE

Refer to https://www.hovatek.com/blog/my-experien...-5g-china/

qla
Enthusiastic Member

11-10-2022, 02:32 PM

Quote:Refer to https://www.hovatek.com/blog/my-experien...-5g-china/

More about my tel.
----------------------------
Model: TA-1188
CODE: HQ5020DF74000
FCC ID: 2AJOTTA-1188

in left down:
1670-M V2.0 SPD

without using preloader file

Code:

# mtk da seccfg unlock

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

.......Port - Device detected :)

Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212000

Preloader -     Var1:                   0x25

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x717

Preloader - Target config:              0xe1

Preloader -     SBC enabled:            True

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          True

Preloader -     Mem write auth:         True

Preloader -     Cmd 0xC8 blocked:       True

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xca01

Preloader -     SW Ver:                 0x200

Preloader - ME_ID:                      AC46FAA180A9A5A6287F0FECCD90DE31

Preloader - SOC_ID:                     635F9A58573CA11F8D9C1B3E046B66827EF7555A2A3F9019409449C6B957C6F6

DA_handler - Device is unprotected.

DA_handler - Device is in BROM-Mode. Bypassing security.

PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes

PLTools - Kamakiri / DA Run

Kamakiri - Trying kamakiri2..

Kamakiri - Done sending payload...

PLTools - Successfully sent payload: /usr/local/lib/python3.10/site-packages/mtkclient-1.6.0-py3.10.egg/mtkclient/payloads/mt6761_payload.bin

Port - Device detected :)

DA_handler

DA_handler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.

DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin

xflashext - Patching da1 ...

Mtk - Patched "Patched loader msg" in preloader

xflashext

xflashext - [LIB]: Error on patching da1 version check...

Mtk - Patched "Patched loader msg" in preloader

Mtk - Patched "get_vfy_policy" in preloader

xflashext - Patching da2 ...

DAXFlash - Successfully uploaded stage 1, jumping ..

Preloader - Jumping to 0x200000

Preloader - Jumping to 0x200000: ok.

DAXFlash - Successfully received DA sync

DAXFlash - DRAM config needed for : 7001005442323831

DAXFlash - Sending emi data ...

DAXFlash - DRAM setup passed.

DAXFlash - Sending emi data succeeded.

DAXFlash - Uploading stage 2...

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - Successfully uploaded stage 2

DAXFlash - EMMC FWVer:      0x0

DAXFlash - EMMC ID:         TB2816

DAXFlash - EMMC CID:        70010054423238313620195a833a563f

DAXFlash - EMMC Boot1 Size: 0x400000

DAXFlash - EMMC Boot2 Size: 0x400000

DAXFlash - EMMC GP1 Size:   0x0

DAXFlash - EMMC GP2 Size:   0x0

DAXFlash - EMMC GP3 Size:   0x0

DAXFlash - EMMC GP4 Size:   0x0

DAXFlash - EMMC RPMB Size:  0x400000

DAXFlash - EMMC USER Size:  0x3a8000000

DAXFlash - HW-CODE         : 0x717

DAXFlash - HWSUB-CODE      : 0x8A00using preloader file

DAXFlash - HW-VERSION      : 0xCA01

DAXFlash - SW-VERSION      : 0x200

DAXFlash - CHIP-EVOLUTION  : 0x0

DAXFlash - DA-VERSION      : 1.0

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - DA Extensions successfully added

DA_handler

DA_handler - [LIB]: Unknown seccfg partition header. Aborting unlock.

using preloader file

Code:

# mtk da seccfg unlock --preloader="/home/TA-1188/Nokia 2.2 TA-1188 Firmware [MT6761]/preloader_wasp.bin"

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

..........

Port - Device detected :)

Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212000

Preloader -     Var1:                   0x25

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x717

Preloader - Target config:              0xe1

Preloader -     SBC enabled:            True

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          True

Preloader -     Mem write auth:         True

Preloader -     Cmd 0xC8 blocked:       True

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xca01

Preloader -     SW Ver:                 0x200

Preloader - ME_ID:                      AC46FAA180A9A5A6287F0FECCD90DE31

Preloader - SOC_ID:                     635F9A58573CA11F8D9C1B3E046B66827EF7555A2A3F9019409449C6B957C6F6

DA_handler - Device is unprotected.

DA_handler - Device is in BROM-Mode. Bypassing security.

PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes

PLTools - Kamakiri / DA Run

Kamakiri - Trying kamakiri2..

Kamakiri - Done sending payload...

PLTools - Successfully sent payload: /usr/local/lib/python3.10/site-packages/mtkclient-1.6.0-py3.10.egg/mtkclient/payloads/mt6761_payload.bin

Port - Device detected :)

DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin

xflashext - Patching da1 ...

Mtk - Patched "Patched loader msg" in preloader

xflashext

xflashext - [LIB]: Error on patching da1 version check...

Mtk - Patched "Patched loader msg" in preloader

Mtk - Patched "get_vfy_policy" in preloader

xflashext - Patching da2 ...

DAXFlash - Successfully uploaded stage 1, jumping ..

Preloader - Jumping to 0x200000

Preloader - Jumping to 0x200000: ok.

DAXFlash - Successfully received DA sync

DAXFlash - DRAM config needed for : 7001005442323831

DAXFlash - Sending emi data ...

DAXFlash - DRAM setup passed.

DAXFlash - Sending emi data succeeded.

DAXFlash - Uploading stage 2...

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - Successfully uploaded stage 2

DAXFlash - EMMC FWVer:      0x0

DAXFlash - EMMC ID:         TB2816

DAXFlash - EMMC CID:        70010054423238313620195a833a563f

DAXFlash - EMMC Boot1 Size: 0x400000

DAXFlash - EMMC Boot2 Size: 0x400000

DAXFlash - EMMC GP1 Size:   0x0

DAXFlash - EMMC GP2 Size:   0x0

DAXFlash - EMMC GP3 Size:   0x0

DAXFlash - EMMC GP4 Size:   0x0

DAXFlash - EMMC RPMB Size:  0x400000

DAXFlash - EMMC USER Size:  0x3a8000000

DAXFlash - HW-CODE         : 0x717

DAXFlash - HWSUB-CODE      : 0x8A00

DAXFlash - HW-VERSION      : 0xCA01

DAXFlash - SW-VERSION      : 0x200

DAXFlash - CHIP-EVOLUTION  : 0x0

DAXFlash - DA-VERSION      : 1.0

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - DA Extensions successfully added

DA_handler

DA_handler - [LIB]: Unknown seccfg partition header. Aborting unlock.

payload command

Code:

# mtk payload

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Preloader

Preloader - [LIB]: Status: Handshake failed, retrying...

Preloader

Preloader - [LIB]: Status: Handshake failed, retrying...

Preloader

Preloader - [LIB]: Status: Handshake failed, retrying...

Preloader

Preloader - [LIB]: Status: Handshake failed, retrying...

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

Port - Device detected :)

Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212000

Preloader -     Var1:                   0x25

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x717

Preloader - Target config:              0xe1

Preloader -     SBC enabled:            True

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          True

Preloader -     Mem write auth:         True

Preloader -     Cmd 0xC8 blocked:       True

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xca01

Preloader -     SW Ver:                 0x200

Preloader - ME_ID:                      AC46FAA180A9A5A6287F0FECCD90DE31

Preloader - SOC_ID:                     635F9A58573CA11F8D9C1B3E046B66827EF7555A2A3F9019409449C6B957C6F6

PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes

PLTools - Kamakiri / DA Run

Kamakiri - Trying kamakiri2..

Kamakiri - Done sending payload...

PLTools - Successfully sent payload: /usr/local/lib/python3.10/site-packages/mtkclient-1.6.0-py3.10.egg/mtkclient/payloads/mt6761_payload.bin

SP flash - two errors:

click Download

1 - BROM Exception! ( ERROR : STATUS_BROM_CMD_SEND_DA_FAIL (-1073348605) , MSP ERROE CODE : 0x00.

and again click Download

2 - verified boot is enabled

Code:

sysname:Linux

 nodename:localhost.localdomain

 release:5.19.12-pclos1

 version:#1 SMP PREEMPT_DYNAMIC Wed Sep 28 12:14:22 CDT 2022

 machine:x86_64

  domainame:(none)

 cur_kernel_version = 5.19.12

QObject::moveToThread: Cannot move objects with a parent

support_dl_cert_to_storage: 0

Application asked to unregister timer 0xc00001b which is not registered in this thread. Fix application.

Connecting to BROM...

Scanning USB port...

Search usb, timeout set as 3600000 ms

add@/devices/pci0000:00/0000:00:14.0/usb3/3-1

add@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.1

add@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.0

bind@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.1

add@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.0/tty/ttyACM0

vid is 0e8d

device vid = 0e8d

pid is 2000

device pid = 2000

com portName is: /dev/ttyACM0

Total wait time = -1665492150.000000

USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)

USB port detected: /dev/ttyACM0

BROM connected

Downloading & Connecting to DA...

connect DA end stage: 2, enable DRAM in 1st DA: 0

Failed to Connect DA: STATUS_BROM_CMD_SEND_DA_FAIL(-1073348605)

Disconnect!

BROM Exception! ( ERROR : STATUS_BROM_CMD_SEND_DA_FAIL (-1073348605) , MSP ERROE CODE : 0x00. 

[HINT]:

)((ConnectDA,../../../flashtool/Conn/Connection.cpp,147))

Connecting to BROM...

Scanning USB port...

Search usb, timeout set as 3600000 ms

remove@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.0/tty/ttyACM0

open VID device failed!

unbind@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.1

unbind@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.0

remove@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.0

remove@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.1

unbind@/devices/pci0000:00/0000:00:14.0/usb3/3-1

remove@/devices/pci0000:00/0000:00:14.0/usb3/3-1

Connecting to BROM...

Scanning USB port...

Search usb, timeout set as 3600000 ms

add@/devices/pci0000:00/0000:00:14.0/usb3/3-1

add@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.0-1073348605

add@/devices/pci0000:00/0000:00:14.0/usb3/3-1/3-1:1.0/tty/ttyACM0

vid is 0e8d

device vid = 0e8d

pid is 0003

device pid = 0003

com portName is: /dev/ttyACM0

Total wait time = -1665492185.000000

USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)

USB port detected: /dev/ttyACM0

BROM connected

Downloading & Connecting to DA...

connect DA end stage: 2, enable DRAM in 1st DA: 0

Warning: not valid DA SLA version, skip DA SLA flow.

DA Connected

executing DADownloadAll...

Stage: 

[0] WRITE TO PARTITION [ preloader ]

Stage: 

[4] WRITE TO PARTITION [ custom_a ]

Download failed.

Disconnect!

BROM Exception! ( ERROR : STATUS_SEC_IMG_TYPE_MISMATCH (-1073610710) , MSP ERROE CODE : 0x00. 

[HINT]:

Verified boot is enabled.

Please download signed image(custom_a-verified.img) or disable verified boot.)((exec,../../../flashtool/Cmd/DADownloadAll.cpp,84))

comboTimeout index(3) saved.

Logger deinited.

mtk reset says: DA_handler - Device is unprotected.

Does this mean that the tel is unlocked?

Code:

# mtk reset

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

......Port - Device detected :)

Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212000

Preloader -     Var1:                   0x25

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x717

Preloader - Target config:              0xe1

Preloader -     SBC enabled:            True

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          True

Preloader -     Mem write auth:         True

Preloader -     Cmd 0xC8 blocked:       True

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xca01

Preloader -     SW Ver:                 0x200

Preloader - ME_ID:                      AC46FAA180A9A5A6287F0FECCD90DE31

Preloader - SOC_ID:                     635F9A58573CA11F8D9C1B3E046B66827EF7555A2A3F9019409449C6B957C6F6

DA_handler - Device is unprotected.

DA_handler - Device is in BROM-Mode. Bypassing security.

PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes

PLTools - Kamakiri / DA Run

Kamakiri - Trying kamakiri2..

Kamakiri - Done sending payload...

PLTools - Successfully sent payload: /usr/local/lib/python3.10/site-packages/mtkclient-1.6.0-py3.10.egg/mtkclient/payloads/mt6761_payload.bin

Port - Device detected :)

DA_handler

DA_handler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.

DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin

xflashext - Patching da1 ...

Mtk - Patched "Patched loader msg" in preloader

xflashext

xflashext - [LIB]: Error on patching da1 version check...

Mtk - Patched "Patched loader msg" in preloader

Mtk - Patched "get_vfy_policy" in preloader

xflashext - Patching da2 ...

DAXFlash - Successfully uploaded stage 1, jumping ..

Preloader - Jumping to 0x200000

Preloader - Jumping to 0x200000: ok.

DAXFlash - Successfully received DA sync

DAXFlash - DRAM config needed for : 7001005442323831

DAXFlash - Sending emi data ...

DAXFlash - DRAM setup passed.

DAXFlash - Sending emi data succeeded.

DAXFlash - Uploading stage 2...

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - Successfully uploaded stage 2

DAXFlash - EMMC FWVer:      0x0

DAXFlash - EMMC ID:         TB2816

DAXFlash - EMMC CID:        70010054423238313620195a833a563f

DAXFlash - EMMC Boot1 Size: 0x400000

DAXFlash - EMMC Boot2 Size: 0x400000

DAXFlash - EMMC GP1 Size:   0x0

DAXFlash - EMMC GP2 Size:   0x0

DAXFlash - EMMC GP3 Size:   0x0

DAXFlash - EMMC GP4 Size:   0x0

DAXFlash - EMMC RPMB Size:  0x400000

DAXFlash - EMMC USER Size:  0x3a8000000

DAXFlash - HW-CODE         : 0x717

DAXFlash - HWSUB-CODE      : 0x8A00

DAXFlash - HW-VERSION      : 0xCA01

DAXFlash - SW-VERSION      : 0x200

DAXFlash - CHIP-EVOLUTION  : 0x0

DAXFlash - DA-VERSION      : 1.0

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - DA Extensions successfully added

DeviceClass - [Errno 2] Entity not found

Reset command was sent. Disconnect usb cable to power off.

The nokia still is bricked - I need any assistance further

maxpayne
Intern

4,448

12-10-2022, 11:22 PM

(11-10-2022, 02:32 PM)qla ..
The nokia still is bricked - I need any assistance further

Ensure you're running python 3.9 then run

Code:

py -3 mtk payload

share the log of the response
don't try to unlock bootloader anymore

This post was last modified: 12-10-2022, 11:23 PM by maxpayne.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

qla
Enthusiastic Member

13-10-2022, 04:49 PM

(12-10-2022, 11:22 PM)maxpayne Ensure you're running python 3.9 then run

share the log of the response

Quote:Python 3.10.6 (main, Aug 11 2022, 11:29:38) [GCC 12.1.0] on linux

Code:

mtk payload

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting.mtk rl /media/win_c/adb/all_partytion/

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

..Port - Device detected :)

Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000mtk rl /media/win_c/adb/all_partytion/

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212000

Preloader -     Var1:                   0x25

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x717

Preloader - Target config:              0x0

Preloader -     SBC enabled:            False

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          False

Preloader -     Mem write auth:         False

Preloader -     Cmd 0xC8 blocked:       False

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xca01

Preloader -     SW Ver:                 0x200

Preloader - ME_ID:                      AC46FAA180A9A5A6287F0FECCD90DE31

Preloader - SOC_ID:                     635F9A58573CA11F8D9C1B3E046B66827EF7555A2A3F9019409449C6B957C6F6

PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes

PLTools - Kamakiri / DA Run

Kamakiri - Trying kamakiri2..

Kamakiri - Done sending payload...

PLTools - Successfully sent payload: /usr/local/lib/python3.10/site-packages/mtkclient-1.6.0-py3.10.egg/mtkclient/payloads/mt6761_payload.bin

and phone still not possible to turn on

@maxpayne

Quote:don't try to unlock bootloader anymore

too late.

hmmm, the phone and so to the garbage probably so I did:

Code:

mtk w preloader,custom_a,elabel_a,logo,md1img_a,spmfw_a,scp_a,sspm_a,lk_a,boot_a,dtbo_a,tee_a,vendor_a,system_a,vbmeta_a,custom_b,elabel_b,md1img_b,spmfw_b,scp_b,sspm_b,lk_b,boot_b,dtbo_b,tee_b,vendor_b,system_b,vbmeta_b,userdata preloader_wasp.bin,custom.img,elabel.img,logo.bin,md1img.img,spmfw.img,scp.img,sspm.img,lk.img,boot.img,dtbo.img,tee.img,vendor.img,system.img,vbmeta.img,custom.img,elabel.img,md1img.img,spmfw.img,scp.img,sspm.img,lk.img,boot.img,dtbo.img,tee.img,vendor.img,system.img,vbmeta.img,userdata.img

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Device detected :)

Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212000

Preloader -     Var1:                   0x25

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x717

Preloader - Target config:              0xe1

Preloader -     SBC enabled:            True

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          True

Preloader -     Mem write auth:         True

Preloader -     Cmd 0xC8 blocked:       True

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xca01

Preloader -     SW Ver:                 0x200

Preloader - ME_ID:                      AC46FAA180A9A5A6287F0FECCD90DE31

Preloader - SOC_ID:                     635F9A58573CA11F8D9C1B3E046B66827EF7555A2A3F9019409449C6B957C6F6

DA_handler - Device is unprotected.

DA_handler - Device is in BROM-Mode. Bypassing security.

PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes

PLTools - Kamakiri / DA Run

Kamakiri - Trying kamakiri2..

Kamakiri - Done sending payload...

PLTools - Successfully sent payload: /usr/local/lib/python3.10/site-packages/mtkclient-1.6.0-py3.10.egg/mtkclient/payloads/mt6761_payload.bin

Port - Device detected :)

DA_handler

DA_handler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.

DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin

xflashext - Patching da1 ...

Mtk - Patched "Patched loader msg" in preloader

xflashext

xflashext - [LIB]: Error on patching da1 version check...

Mtk - Patched "Patched loader msg" in preloader

Mtk - Patched "get_vfy_policy" in preloader

xflashext - Patching da2 ...

DAXFlash - Successfully uploaded stage 1, jumping ..

Preloader - Jumping to 0x200000

Preloader - Jumping to 0x200000: ok.

DAXFlash - Successfully received DA sync

DAXFlash - DRAM config needed for : 7001005442323831

DAXFlash - Sending emi data ...

DAXFlash - DRAM setup passed.

DAXFlash - Sending emi data succeeded.

DAXFlash - Uploading stage 2...

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - Successfully uploaded stage 2

DAXFlash - EMMC FWVer:      0x0

DAXFlash - EMMC ID:         TB2816

DAXFlash - EMMC CID:        70010054423238313620195a833a563f

DAXFlash - EMMC Boot1 Size: 0x400000

DAXFlash - EMMC Boot2 Size: 0x400000

DAXFlash - EMMC GP1 Size:   0x0

DAXFlash - EMMC GP2 Size:   0x0

DAXFlash - EMMC GP3 Size:   0x0

DAXFlash - EMMC GP4 Size:   0x0

DAXFlash - EMMC RPMB Size:  0x400000

DAXFlash - EMMC USER Size:  0x3a8000000

DAXFlash - HW-CODE         : 0x717

DAXFlash - HWSUB-CODE      : 0x8A00

DAXFlash - HW-VERSION      : 0xCA01

DAXFlash - SW-VERSION      : 0x200

DAXFlash - CHIP-EVOLUTION  : 0x0

DAXFlash - DA-VERSION      : 1.0

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - DA Extensions successfully added

DA_handler

DA_handler - [LIB]: Error: Couldn't detect partition: preloader

Available partitions:

DA_handler - boot_para

DA_handler - para

DA_handler - custom_a

DA_handler - elabel_a

DA_handler - private

DA_handler - expdb

DA_handler - frp

DA_handler - nvcfg

DA_handler - nvdata

DA_handler - metadata

DA_handler - protect1

DA_handler - protect2

DA_handler - seccfg

DA_handler - sec1

DA_handler - proinfo

DA_handler - nvram

DA_handler - logo

DA_handler - md1img_a

DA_handler - spmfw_a

DA_handler - scp_a

DA_handler - sspm_a

DA_handler - gz_a

DA_handler - lk_a

DA_handler - boot_a

DA_handler - dtbo_a

DA_handler - tee_a

DA_handler - vendor_a

DA_handler - system_a

DA_handler - vbmeta_a

DA_handler - custom_b

DA_handler - elabel_b

DA_handler - md1img_b

DA_handler - spmfw_b

DA_handler - scp_b

DA_handler - sspm_b

DA_handler - gz_b

DA_handler - lk_b

DA_handler - boot_b

DA_handler - dtbo_b

DA_handler - tee_b

DA_handler - vendor_b

DA_handler - system_b

DA_handler - vbmeta_b

DA_handler - userdata

DA_handler - otp

DA_handler - flashinfo

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x19000 of 0x19000, ) 7.28 MB/s50 MB/s

Wrote custom.img to sector 3136 with sector count 102400.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x2800 of 0x2800, ) 6.25 MB/s

Wrote elabel.img to sector 105536 with sector count 10240.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x35B of 0x35B, ) 5.81 MB/s

Wrote logo.bin to sector 616448 with sector count 22528.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x32000 of 0x32000, ) 7.08 MB/s85 MB/s

Wrote md1img.img to sector 638976 with sector count 204800.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 6.90 MB/s

Wrote spmfw.img to sector 843776 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 6.52 MB/s

Wrote scp.img to sector 845824 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 6.07 MB/s

Wrote sspm.img to sector 847872 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 6.78 MB/s

Wrote lk.img to sector 882688 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x10000 of 0x10000, ) 6.82 MB/s7 MB/s

Wrote boot.img to sector 884736 with sector count 65536.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x4000 of 0x4000, ) 6.74 MB/s

Wrote dtbo.img to sector 950272 with sector count 16384.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x4000 of 0x4000, ) 6.80 MB/s

Wrote tee.img to sector 966656 with sector count 16384.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x180000 of 0x180000, ) 7.09 MB/s26 MB/sB/s

Wrote vendor.img to sector 983040 with sector count 1572864.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x600000 of 0x600000, ) 3.20 MB/s83 MB/sMB/s

Wrote system.img to sector 2555904 with sector count 6291456.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x4000 of 0x4000, ) 6.60 MB/s

Wrote vbmeta.img to sector 8847360 with sector count 16384.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x19000 of 0x19000, ) 6.88 MB/s07 MB/s

Wrote custom.img to sector 8863744 with sector count 102400.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x2800 of 0x2800, ) 6.84 MB/s

Wrote elabel.img to sector 8966144 with sector count 12288.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x32000 of 0x32000, ) 7.02 MB/s20 MB/s

Wrote md1img.img to sector 8978432 with sector count 204800.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 7.02 MB/s

Wrote spmfw.img to sector 9183232 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 6.84 MB/s

Wrote scp.img to sector 9185280 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 6.35 MB/s

Wrote sspm.img to sector 9187328 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x800 of 0x800, ) 0.91 MB/s

Wrote lk.img to sector 9222144 with sector count 2048.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x10000 of 0x10000, ) 7.58 MB/s9 MB/s

Wrote boot.img to sector 9224192 with sector count 65536.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x4000 of 0x4000, ) 7.22 MB/s

Wrote dtbo.img to sector 9289728 with sector count 16384.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x4000 of 0x4000, ) 1.99 MB/s

Wrote tee.img to sector 9306112 with sector count 16384.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x180000 of 0x180000, ) 2.07 MB/s91 MB/sB/s

Wrote vendor.img to sector 9322496 with sector count 1572864.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x600000 of 0x600000, ) 7.64 MB/s07 MB/sMB/s

Wrote system.img to sector 10895360 with sector count 6291456.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x4000 of 0x4000, ) 7.40 MB/s

Wrote vbmeta.img to sector 17186816 with sector count 16384.

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x34F2C of 0x34F2C, ) 6.76 MB/s57 MB/s

Wrote userdata.img to sector 17203200 with sector count 13346783.

[root@localhost Nokia 2.2 TA-1188 Firmware [MT6761]]# mtk reset

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

DAXFlash - HW-CODE         : 0x717

DAXFlash - HWSUB-CODE      : 0x8A00

DAXFlash - HW-VERSION      : 0xCA01

DAXFlash - SW-VERSION      : 0x200

DAXFlash - CHIP-EVOLUTION  : 0x0

DAXFlash - DA-VERSION      : 1.0

DeviceClass - [Errno 2] Entity not found

Reset command was sent. Disconnect usb cable to power off.

and ..... mtk reset: WOW! Phone turned on Smile

but not so good.

Now I have loop:

Quote:Red state
Your device has failed veryfication and may not work properly.
Please download boot image with correct signature or disable verified boot.
Your device will reboot in 5 seconds.

I looking for what to do next.

QUESTION.

qla
Enthusiastic Member

13-10-2022, 06:59 PM

I can't edit previous post.

Now - fastboot mode I can turn on but computer not see phone

And,
QUESTION.

I have firmware where there are files in the zip archive:

Quote:image_wasp_ppr1.180610.011_all.zip
rom.json

and I have ota firmware - with what can be uploaded to the phone?

qla
Enthusiastic Member

15-10-2022, 09:51 AM

I managed, now I can turn on the phone, but it does not load the system (it stopped at the logo) and there is no Red Alert

In fastboot mode, computer still don't see the phone Sad

The phone now I can normally turn on.

Turn on, (pressing power button ~3s) usb cable not connected do computer :

- shows the logo and stuck!

- press power button ~10s - Turn off the phone and it automatically turns on by itself

Now the phone works like this:

- I remove the battery

- I put the battery in the phone

- I connect the power adapter - and:

after several seconds the logo shows for a few seconds,

and then after a few seconds the changing to icon battery,

after a few seconds the screen goes dark.

lsusb -v, fastboot mode:

Quote:Bus 003 Device 018: ID 0e8d:201c MediaTek Inc. Android
Couldn't open device, some information will be missing
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0e8d MediaTek Inc.
idProduct 0x201c
bcdDevice 1.00
iManufacturer 1 MediaTek
iProduct 2 Android
iSerial 3 0123456789ABCDEF
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0020
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 256mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 66
bInterfaceProtocol 3
iInterface 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type BulkMediaTek
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 1

lsusb - phone on

-----------------

- no MediaTek

dmesg - phone on

Quote:[ 3982.338229] usb 3-1: USB disconnect, device number 28

lsusb - phone off, pluge usb cable:

Code:

Bus 003 Device 025: ID 0e8d:20ff MediaTek Inc.

dmesg:

Quote:[ 3148.886287] cdc_acm 3-1:1.1: Zero length descriptor references

[ 3148.886295] cdc_acm: probe of 3-1:1.1 failed with error -22

[ 3148.966493] cdc_acm 3-1:1.0: ttyACM0: USB ACM device

[ 3151.534544] usb 3-1: USB disconnect, device number 24

[ 3164.052649] usb 3-1: new high-speed USB device number 25 using xhci_hcd

[ 3164.179091] usb 3-1: New USB device found, idVendor=0e8d, idProduct=20ff, bcdDevice= 2.23

[ 3164.179094] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3

[ 3164.179096] usb 3-1: SerialNumber: 0123456789ABCDEF

[ 3164.180622] hid-generic 0003:0E8D:20FF.0008: No inputs registered, leaving

[ 3164.180691] hid-generic 0003:0E8D:20FF.0008: hidraw2: USB HID v1.01 Device [HID 0e8d:20ff] on usb-0000:00:14.0-1/input0

dmesg after pres Vol- and put usb to computer:

----------------------------------------------

Quote:[ 1663.310701] usb 3-6: new high-speed USB device number 13 using xhci_hcd
[ 1663.436818] usb 3-6: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[ 1663.436829] usb 3-6: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1663.439605] cdc_acm 3-6:1.0: ttyACM0: USB ACM device
[ 1668.029688] usb 3-6: USB disconnect, device number 13
[ 1668.992687] usb 3-6: new high-speed USB device number 14 using xhci_hcd
[ 1669.119477] usb 3-6: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice= 1.00
[ 1669.119487] usb 3-6: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1669.119492] usb 3-6: Product: MT65xx Preloader
[ 1669.119495] usb 3-6: Manufacturer: MediaTek

dmesg - fasboot mode:

Quote:[ 3472.954656] usb 3-1: new high-speed USB device number 27 using xhci_hcd
[ 3473.081458] usb 3-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice= 1.00
[ 3473.081470] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 3473.081476] usb 3-1: Product: MT65xx Preloader
[ 3473.081480] usb 3-1: Manufacturer: MediaTek
[ 3473.104394] cdc_acm 3-1:1.1: Zero length descriptor references
[ 3473.104401] cdc_acm: probe of 3-1:1.1 failed with error -22
[ 3473.184652] cdc_acm 3-1:1.0: ttyACM0: USB ACM device
[ 3475.753022] usb 3-1: USB disconnect, device number 27
[ 3488.365700] usb 3-1: new high-speed USB device number 28 using xhci_hcd
[ 3488.492126] usb 3-1: New USB device found, idVendor=0e8d, idProduct=20ff, bcdDevice= 2.23
[ 3488.492137] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 3488.492142] usb 3-1: SerialNumber: 0123456789ABCDEF
[ 3488.494459] hid-generic 0003:0E8D:20FF.0009: No inputs registered, leaving
[ 3488.494498] hid-generic 0003:0E8D:20FF.0009: hidraw2: USB HID v1.01 Device [HID 0e8d:20ff] on usb-0000:00:14.0-1/input0

Now I can unlock the phone.

Code:

# mtk da seccfg unlock

MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

........Port - Device detected :)

Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)

Preloader -     HW version:             0x0

Preloader -     WDT:                    0x10007000

Preloader -     Uart:                   0x11002000

Preloader -     Brom payload addr:      0x100a00

Preloader -     DA payload addr:        0x201000

Preloader -     CQ_DMA addr:            0x10212000

Preloader -     Var1:                   0x25

Preloader - Disabling Watchdog...

Preloader - HW code:                    0x717

Preloader - Target config:              0xe1

Preloader -     SBC enabled:            True

Preloader -     SLA enabled:            False

Preloader -     DAA enabled:            False

Preloader -     SWJTAG enabled:         False

Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False

Preloader -     Root cert required:     False

Preloader -     Mem read auth:          True

Preloader -     Mem write auth:         True

Preloader -     Cmd 0xC8 blocked:       True

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader -     HW subcode:             0x8a00

Preloader -     HW Ver:                 0xca01

Preloader -     SW Ver:                 0x200

Preloader - ME_ID:                      AC46FAA180A9A5A6287F0FECCD90DE31

Preloader - SOC_ID:                     635F9A58573CA11F8D9C1B3E046B66827EF7555A2A3F9019409449C6B957C6F6

DA_handler - Device is unprotected.

DA_handler - Device is in BROM-Mode. Bypassing security.

PLTools - Loading payload from mt6761_payload.bin, 0x264 bytes

PLTools - Kamakiri / DA Run

Kamakiri - Trying kamakiri2..

Kamakiri - Done sending payload...

PLTools - Successfully sent payload: /usr/local/lib/python3.10/site-packages/mtkclient-1.6.0-py3.10.egg/mtkclient/payloads/mt6761_payload.bin

Port - Device detected :)

DA_handler

DA_handler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.

DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin

xflashext - Patching da1 ...

Mtk - Patched "Patched loader msg" in preloader

xflashext

xflashext - [LIB]: Error on patching da1 version check...

Mtk - Patched "Patched loader msg" in preloader

Mtk - Patched "get_vfy_policy" in preloader

xflashext - Patching da2 ...

DAXFlash - Successfully uploaded stage 1, jumping ..

Preloader - Jumping to 0x200000

Preloader - Jumping to 0x200000: ok.

DAXFlash - Successfully received DA sync

DAXFlash - DRAM config needed for : 7001005442323831

DAXFlash - Sending emi data ...

DAXFlash - DRAM setup passed.

DAXFlash - Sending emi data succeeded.

DAXFlash - Uploading stage 2...

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - Successfully uploaded stage 2

DAXFlash - EMMC FWVer:      0x0

DAXFlash - EMMC ID:         TB2816

DAXFlash - EMMC CID:        70010054423238313620195a833a563f

DAXFlash - EMMC Boot1 Size: 0x400000

DAXFlash - EMMC Boot2 Size: 0x400000

DAXFlash - EMMC GP1 Size:   0x0

DAXFlash - EMMC GP2 Size:   0x0

DAXFlash - EMMC GP3 Size:   0x0

DAXFlash - EMMC GP4 Size:   0x0

DAXFlash - EMMC RPMB Size:  0x400000

DAXFlash - EMMC USER Size:  0x3a8000000

DAXFlash - HW-CODE         : 0x717

DAXFlash - HWSUB-CODE      : 0x8A00

DAXFlash - HW-VERSION      : 0xCA01

DAXFlash - SW-VERSION      : 0x200

DAXFlash - CHIP-EVOLUTION  : 0x0

DAXFlash - DA-VERSION      : 1.0

DAXFlash - Upload data was accepted. Jumping to stage 2...

DAXFlash - DA Extensions successfully added

sej - HACC init

sej - HACC run

sej - HACC terminate

sej - HACC init

sej - HACC run

sej - HACC terminate

sej - HACC init

sej - HACC run

sej - HACC terminate

Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x1 of 0x1, ) 0.01 MB/s

DA_handler - Successfully wrote seccfg.

If I do unlock (mtk da seccfg unlock) it shows at boot:

Quote:dm-verity error
Android systeme on you deviceis corupted.
Device will boot in 5s

and then

Quote:Orange state
Your device has ben unlocked and can't be trust.
Your device will boot in 5s

But it's stuck on the logo and does not boot the phone.

I need help on what to do next to get the phone working normally. - please Big Grin

I promise, not to do anything alone from now on.
--------------------------------------------------------------

qla
Enthusiastic Member

17-10-2022, 10:36 AM

Ha!.
Fastboot mode works!

I tried command

Code:

fastboot devices

as normal user Confused

but as root I can see the phone! and work Big Grin

Code:

fastboot reboot recovery

I doit nothing with phone.

What I must doit to run the phone normally?.

Now I have stuck on boot logo.

any help - please?

maxpayne
Intern

4,448

18-10-2022, 02:01 PM

(17-10-2022, 10:36 AM)qla Ha!.
Fastboot mode works!

I tried command

Code:

fastboot devices
as normal user

but as root I can see the phone! and work

Code:

fastboot reboot recovery

I doit nothing with phone.

What I must doit to run the phone normally?.

Now I have stuck on boot logo.

any help - please?

Do a factory reset

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

qla
Enthusiastic Member

19-10-2022, 09:41 PM

#10

Quote:@maxpayne

Do a factory reset

That's all - phone works.

Then I did:

download: https://android.googleapis.com/packages/...19d82d.zip

- rename to OTA.zip
- run recovery mode
- select: Apply update from ADB

showed: devices error: no such file or directory, or something else

- in console: adb sideload /patch/to/OTA.zp
- factory reset again

and Big Grin

I have android 11 working system on my the nokia TA-1188.

I did all this on a Linux system with:

- MTK Client Tool
- SP flash for linux

Very important question:

I have firmware where there are files in the zip archive:

- one zip file

- one .json file

for example:

Quote: image_wasp_ppr1.180610.011_all.zip
rom.json

- How to update the phone with such firmware?

thanks for help!

Pages (2): 1 2 Next

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions