BootROM unbrick help

Herick
Enthusiastic Member

6

12-10-2023, 01:00 AM

#1

I read the following topic about the difference between BootROM and Preloader mode https://www.hovatek.com/forum/thread-37518.html, and I understood how the principle of each one works, but I want to ask for help because I have a Lenovo Pad Pro 2 Gen TB132FU tablet, after flashing an incompatible ROM and doing format all without bootloader it is always detected in BootROM and became bricked, now I can't give it a preloader in SP Flash Tool, I always get error 0xC00050005 , I come to ask for help because I've already tried several firmwares for this model but it doesn't come out of "Download DA 100%" in SP Flash Tool. Please ask for whatever you need to clarify further, I will send it! Thank you very much! Huh

AutoResponder
Verified Account

609

12-10-2023, 01:00 AM

#2

Thank you for reaching out for support. Due to high demand, our free support services may experience some delays in response time. We apologize for any inconvenience this may cause.
Alternatively, we offer private support where you can receive dedicated attention and prompt support. These sessions are designed to provide personalized solutions to your specific needs.
If you are interested in scheduling a private session, please visit https://www.hovatek.com/remote

maxpayne
Intern

4,201

12-10-2023, 01:39 PM

#3

(12-10-2023, 01:00 AM)Herick I read the following topic about the difference between BootROM and Preloader mode https://www.hovatek.com/forum/thread-37518.html, and I understood how the principle of each one works, but I want to ask for help because I have a Lenovo Pad Pro 2 Gen TB132FU tablet, after flashing an incompatible ROM and doing format all without bootloader it is always detected in BootROM and became bricked, now I can't give it a preloader in SP Flash Tool, I always get error 0xC00050005 , I come to ask for help because I've already tried several firmwares for this model but it doesn't come out of "Download DA 100%" in SP Flash Tool. Please ask for whatever you need to clarify further, I will send it! Thank you very much!

It looks like the firmware isn't compatible
Search for 0xC0050005 @ https://www.hovatek.com/forum/thread-439.html

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

Herick
Enthusiastic Member

6

12-10-2023, 11:18 PM

#4

(12-10-2023, 01:39 PM)maxpayne
(12-10-2023, 01:00 AM)Herick I read the following topic about the difference between BootROM and Preloader mode https://www.hovatek.com/forum/thread-37518.html, and I understood how the principle of each one works, but I want to ask for help because I have a Lenovo Pad Pro 2 Gen TB132FU tablet, after flashing an incompatible ROM and doing format all without bootloader it is always detected in BootROM and became bricked, now I can't give it a preloader in SP Flash Tool, I always get error 0xC00050005 , I come to ask for help because I've already tried several firmwares for this model but it doesn't come out of "Download DA 100%" in SP Flash Tool. Please ask for whatever you need to clarify further, I will send it! Thank you very much!

It looks like the firmware isn't compatible
Search for 0xC0050005 @ https://www.hovatek.com/forum/thread-439.html

Thank you for responding! I go try this way, this is strange because I've tried several firmwares for this model but I always get this response, something strange is that in some applications the model shown is Dimensity 1200, but the real one on my device is Dimensity 1300.

Herick
Enthusiastic Member

6

13-10-2023, 12:13 AM

#5

I got this, but even holding the power button he doesn't turn on, I tried all possible button combinations and it didn't leave the black screen

Port - Device detected Smile

Preloader - CPU: MT6893(Dimensity 1200)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x950
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 69525E5635F8A680C7F7615BA0C6E910
Preloader - SOC_ID: 790DC785FC251438DCFC1A157CA735F686E22280133EC637335CB613354861A6
PLTools - Loading payload from mt6893_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Totz013\Downloads\mtkclient-main\mtkclient-main\mtkclient\mtkclient\payloads\mt6893_payload.bin
Port - Device detected Smile

Main - Connected to device, loading
Main - Using custom preloader : preloader_p11_pro_2gen.bin
Mtk - Valid preloader detected.
Mtk - Patched "mt6739 c30" in preloader
Mtk - Patched "ram blacklist" in preloader
Mtk - Patched "seclib_sec_usbdl_enabled" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "sec_img_auth" in preloader
Mtk - Patched "get_vfy_policy" in preloader
Main - Sent preloader to 0x201000, length 0x6e6ac
Preloader - Jumping to 0x201000
Preloader - Jumping to 0x201000: ok.
Main - PL Jumped to daaddr 0x201000.
Main - Keep pressed power button to boot.

And when I try to flash the preloader this is what I get back

PS C:\Users\Totz013\Downloads\mtkclient-main\mtkclient-main\mtkclient> python mtk w preloader preloader_p11_pro_2gen.bin --parttype=boot_a
MTK Flash/Exploit Client V1.6.3 © B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

Port - Device detected Smile

Preloader - CPU: MT6893(Dimensity 1200)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x950
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 69525E5635F8A680C7F7615BA0C6E910
Preloader - SOC_ID: 790DC785FC251438DCFC1A157CA735F686E22280133EC637335CB613354861A6
PLTools - Loading payload from mt6893_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Totz013\Downloads\mtkclient-main\mtkclient-main\mtkclient\mtkclient\payloads\mt6893_payload.bin
Port - Device detected Smile

DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2228.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
xflashext
xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS ID: KLUDG4UHGC-B0E
DAXFlash - UFS MID: 0xce
DAXFlash - UFS CID: ce014b4c55444734554847432d423045
DAXFlash - UFS FWVer: 30383031
DAXFlash - UFS Serial: 363763323362616339373238
DAXFlash - UFS LU0 Size: 0x1dcb000000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DRAM config needed for : ce014b4c55444734554847432d423045
DAXFlash - No preloader given. Searching for preloader
DAXFlash - Sending emi data ...
DAXFlash
DAXFlash - [LIB]: ←[31mError on sending parameter: DA exceed max num (0xc0070005)←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on sending parameter: DA exceed max num (0xc0070005)←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on sending parameter: DA exceed max num (0xc0070005)←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on sending parameter: DA exceed max num (0xc0070005)←[0m
DAXFlash
.
.
.
DAXFlash
DAXFlash - [LIB]: ←[31mError on sending parameter: DA exceed max num (0xc0070005)←[0m
DAXFlash
DAXFlash - [LIB]: ←[33mNo preloader given. Operation may fail due to missing dram setup.←[0m
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash
DAXFlash - [LIB]: ←[31mStage was't executed. Maybe dram issue ?.←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on booting to da (xflash)←[0m

maxpayne
Intern

4,201

16-10-2023, 09:01 AM

#6

(13-10-2023, 12:13 AM)Herick I got this, but even holding the power button he doesn't turn on, I tried all possible button combinations and it didn't leave the black screen
..

Which version of python are you using?
Run

Code:

py -3 mtk payload

and share the log

This post was last modified: 23-10-2023, 10:14 AM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

Herick
Enthusiastic Member

6

20-10-2023, 03:46 PM

#7

(16-10-2023, 09:01 AM)maxpayne
(13-10-2023, 12:13 AM)Herick I got this, but even holding the power button he doesn't turn on, I tried all possible button combinations and it didn't leave the black screen
..

Which version of python are you using?
Run

Code:

py -3 payload

and share the log

I using Python 3.11.0

"py -3 payload" return:

PS C:\Users\Totz013\Downloads\mtkclient-main\mtkclient-main\mtkclient> py -3 payload
C:\Users\Totz013\AppData\Local\Programs\Python\Python311\python.exe: can't open file 'C:\\Users\\T\\Downloads\\mtkclient-main\\mtkclient-main\\mtkclient\\payload': [Errno 2] No such file or directory

"py -3 mtk payload" return:

PS C:\Users\Totz013\Downloads\mtkclient-main\mtkclient-main> py -3 mtk payload
MTK Flash/Exploit Client V1.6.3 © B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Device detected Smile

Preloader - CPU: MT6893(Dimensity 1200)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x950
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 69525E5635F8A680C7F7615BA0C6E910
Preloader - SOC_ID: 790DC785FC251438DCFC1A157CA735F686E22280133EC637335CB613354861A6
PLTools - Loading payload from mt6893_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Totz013\Downloads\mtkclient-main\mtkclient-main\mtkclient\payloads\mt6893_payload.bin

This post was last modified: 20-10-2023, 03:48 PM by Herick.

Gargoyle
Contributor

541

20-10-2023, 03:59 PM

#8

Have you tried the manufacturer's software?

Rescue and Smart Assistant (RSA)

maxpayne
Intern

4,201

23-10-2023, 10:16 AM

#9

(20-10-2023, 03:46 PM)Herick Exploitation - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Totz013\Downloads\mtkclient-main\mtkclient-main\mtkclient\payloads\mt6893_payload.bin

Since this payload command was successful, you (without disconnecting the phone), flash the firmware in SP flash tool immediately

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

maxpayne
Intern

4,201

23-10-2023, 10:17 AM

#10

I don't know if RSA will detect in BROM but here's the guide https://www.hovatek.com/forum/thread-37327.html

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions