Help how to Unbrick Redmi Note 9
Help how to Unbrick Redmi Note 9
02-02-2024, 05:02 PM
(31-01-2024, 04:18 PM)Orfeluh Thank you for using your time to help.
Leave it in USB auto detect.
I want to confirm that what you did was to:
1. run "py -3 mtk payload" in mtkclient then connect the phone in BROM
2. After mtkclient showed success, you ran SP flash tool, loaded scatter file and preloader then tried to do a readback
Was this what you did?
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
02-02-2024, 06:01 PM
(02-02-2024, 05:02 PM)maxpayne(31-01-2024, 04:18 PM)Orfeluh Thank you for using your time to help.
Leave it in USB auto detect.
I want to confirm that what you did was to:
1. run "py -3 mtk payload" in mtkclient then connect the phone in BROM
2. After mtkclient showed success, you ran SP flash tool, loaded scatter file and preloader then tried to do a readback
Was this what you did?
Did that and again and got STATUS_EXT_RAM_EXCEPTION error.
And this is how download tab looks like in SP Flash Tool, I think I loaded scatter and preloader correctly.
Didn't charge battery before trying so maybe it's because of that, but wouldn't know if its charging as phone doesn't react or show anything when plug in charger.
Will try again after leaving phone to charge some time.
05-02-2024, 12:53 PM
06-02-2024, 02:17 PM
(02-02-2024, 06:01 PM)Orfeluh Did that and again and got STATUS_EXT_RAM_EXCEPTION error.
And this is how download tab looks like in SP Flash Tool, I think I loaded scatter and preloader correctly.
Didn't charge battery before trying so maybe it's because of that, but wouldn't know if its charging as phone doesn't react or show anything when plug in charger.
Will try again after leaving phone to charge some time.
Use the default Download Agent in SP flash tool and don't load the auth file
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
09-02-2024, 03:44 PM
Followed the guide but got stuck at Download DA 100% and after 2minutes it shows ERROR STATUS_EXT_RAM_EXCEPTION . Tried searching for solutions and found that I should try different Fastboot ROM or DA or scatter file. Downloaded and tried with 4 different ROMs, both Global and EU and both MIUI 11 and 12 (if its needed I will write exact version but right now I wont as it will be long for thread). No success still showed ERROR STATUS_EXT_RAM_EXCEPTION.
This post was last modified: 10-02-2024, 03:48 AM by hovatek.
23-02-2024, 01:24 AM
(06-02-2024, 02:17 PM)maxpayne(02-02-2024, 06:01 PM)Orfeluh Did that and again and got STATUS_EXT_RAM_EXCEPTION error.
And this is how download tab looks like in SP Flash Tool, I think I loaded scatter and preloader correctly.
Didn't charge battery before trying so maybe it's because of that, but wouldn't know if its charging as phone doesn't react or show anything when plug in charger.
Will try again after leaving phone to charge some time.
Use the default Download Agent in SP flash tool and don't load the auth file
Tried but still same error.
Also downloaded every Fastboot Global and EU ROM and tried flashing with firmware upgrade but still same error.
Then took phone to repair shop where technician said it looks like hardware motherboard issue, they couldn't fix it.
Only thing left to do is to try flashing Chinese ROM, did try with V12.5.4.0.RJOCNXM but same STATUS_EXT_RAM_EXCEPTION error.
Would try deattaching battery but screws are striped so can't do that.
Found replacement motherboard so will probably replace motherboard.
Either way thank you for your help maxpayne.
29-02-2024, 09:22 AM
(23-02-2024, 01:24 AM)Orfeluh Tried but still same error.
Also downloaded every Fastboot Global and EU ROM and tried flashing with firmware upgrade but still same error.
Then took phone to repair shop where technician said it looks like hardware motherboard issue, they couldn't fix it.
Only thing left to do is to try flashing Chinese ROM, did try with V12.5.4.0.RJOCNXM but same STATUS_EXT_RAM_EXCEPTION error.
Would try deattaching battery but screws are striped so can't do that.
Found replacement motherboard so will probably replace motherboard.
Either way thank you for your help maxpayne.
Try these
Code:
python mtk e metadata,userdata,md_udc
python mtk da seccfg unlock
python mtk r boot boot.bin This post was last modified: 29-02-2024, 09:23 AM by maxpayne.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
29-02-2024, 03:29 PM
(29-02-2024, 09:22 AM)maxpayne(23-02-2024, 01:24 AM)Orfeluh Tried but still same error.
Also downloaded every Fastboot Global and EU ROM and tried flashing with firmware upgrade but still same error.
Then took phone to repair shop where technician said it looks like hardware motherboard issue, they couldn't fix it.
Only thing left to do is to try flashing Chinese ROM, did try with V12.5.4.0.RJOCNXM but same STATUS_EXT_RAM_EXCEPTION error.
Would try deattaching battery but screws are striped so can't do that.
Found replacement motherboard so will probably replace motherboard.
Either way thank you for your help maxpayne.
Try these
Code:python mtk e metadata,userdata,md_udc python mtk da seccfg unlock python mtk r boot boot.bin
E:\PhoneRepairSoftware\mtkclient-main>python mtk e metadata,userdata,md_udc
MTK Flash/Exploit Client Public V2.0.0 Beta © B.Kerler 2018-2023
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
....Port - Device detected
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0x0
Preloader - SBC enabled: False
Preloader - SLA enabled: False
Preloader - DAA enabled: False
Preloader - SWJTAG enabled: False
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 0499E2EAC9E808A007C6C5FBD6C21C87
Preloader - SOC_ID: 269DFED3791D0B20CDA40998F799AD5930C07671B9DEC7EDE2696D235F1E7ACA
DA_handler - Device is unprotected.
DA_handler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\PhoneRepairSoftware\mtkclient-main\mtkclient\payloads\mt6768_payload.bin
Port - Device detected
DA_handler
DA_handler - [LIB]: ←[31mFailed to dump preloader from ram, provide a valid one via --preloader option←[0m
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
xflashext
xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
xflashext - DA version anti-rollback patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 13014e53304a394a
DAXFlash - No preloader given. Searching for preloader
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Emi data accepted ...
DAXFlash - Detected working preloader: E:\PhoneRepairSoftware\mtkclient-main\mtkclient\Loader\Preloader\preloader_k69v1_64.bin
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash
DAXFlash - [LIB]: ←[31mStage was't executed. Maybe dram issue ?.←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on booting to da (xflash)←[0m
E:\PhoneRepairSoftware\mtkclient-main>python mtk da seccfg unlock
MTK Flash/Exploit Client Public V2.0.0 Beta © B.Kerler 2018-2023
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
...........
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
...........
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
....Port - Device detected
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 0499E2EAC9E808A007C6C5FBD6C21C87
Preloader - SOC_ID: 269DFED3791D0B20CDA40998F799AD5930C07671B9DEC7EDE2696D235F1E7ACA
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\PhoneRepairSoftware\mtkclient-main\mtkclient\payloads\mt6768_payload.bin
Port - Device detected
DA_handler - Device was protected. Successfully bypassed security.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
xflashext
xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
xflashext - DA version anti-rollback patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup failed: unpack requires a buffer of 12 bytes
E:\PhoneRepairSoftware\mtkclient-main>python mtk r boot boot.bin
MTK Flash/Exploit Client Public V2.0.0 Beta © B.Kerler 2018-2023
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
...........
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
..........Port - Device detected
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 0499E2EAC9E808A007C6C5FBD6C21C87
Preloader - SOC_ID: 269DFED3791D0B20CDA40998F799AD5930C07671B9DEC7EDE2696D235F1E7ACA
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\PhoneRepairSoftware\mtkclient-main\mtkclient\payloads\mt6768_payload.bin
Port - Device detected
DA_handler - Device was protected. Successfully bypassed security.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
xflashext
xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
xflashext - DA version anti-rollback patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup failed: unpack requires a buffer of 12 bytes
Run all three commands, this is what I got
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)
