Help how to Unbrick Redmi Note 9

Orfeluh
Enthusiastic Member

11

09-01-2024, 02:02 AM

#1

Hello, need help with unbricking Redmi Note 9 Merlin. I bought phone in bricked state so I don't know which firmware was last on phone, by searching with IMEI check found that its 3GB/64GB version bought in Germany, so I don't know is it Global or EEA/EU ROM installed. Also bootloader is probably locked, can't check for sure.

First I found guide on XDA Developers forum. Here is link: https://xdaforums.com/t/guide-how-to-fix...k.4347025/
I don't know if it's allowed to link to external site, sorry if its forbidden, I just registered.

Followed the guide but got stuck at Download DA 100% and after 2minutes it shows ERROR STATUS_EXT_RAM_EXCEPTION . Tried searching for solutions and found that I should try different Fastboot ROM or DA or scatter file. Downloaded and tried with 4 different ROMs, both Global and EU and both MIUI 11 and 12 (if its needed I will write exact version but right now I wont as it will be long for thread). No success still showed ERROR STATUS_EXT_RAM_EXCEPTION.

Then also tried searching for solution and found this thread from this forum: https://www.hovatek.com/forum/thread-439.html
It says I should charge battery, tried again but no success.
This method https://www.hovatek.com/blog/my-experien...g-stylo-6/ also didn't work.

User on XDA told me to use mtkclient by bkernel and try to unlock bootloader with that tool. Here is thread from XDA https://xdaforums.com/t/guide-how-to-pro...161/page-2. I am user Orfeluh44.
Dont want to spam too much here so if you could read what errors I got.

After setting up mtkclient gui got this

Capture2.PNG
Size: 85.92 KB / Downloads: 8

and

Capture4.PNG
Size: 46.47 KB / Downloads: 9

.
At the end it showed None. I waited for like 5-10 minutes but nothing happened so I closed mtkclient. Should I waited longer?

Also, can't open phone as motherboard cover has stripped screws so I would need to take it repair store.

Does anyone has solution and could help me?

Thank you.

AutoResponder
Verified Account

609

09-01-2024, 02:02 AM

#2

Thank you for reaching out for support. Due to high demand, our free support services may experience some delays in response time. We apologize for any inconvenience this may cause.
Alternatively, we offer private support where you can receive dedicated attention and prompt support. These sessions are designed to provide personalized solutions to your specific needs.
If you are interested in scheduling a private session, please visit https://www.hovatek.com/remote

maxpayne
Intern

4,059

18-01-2024, 10:04 AM

#3

(09-01-2024, 02:02 AM)Orfeluh ..
Dont want to spam too much here so if you could read what errors I got.

After setting up mtkclient gui got this and .
At the end it showed None. I waited for like 5-10 minutes but nothing happened so I closed mtkclient. Should I waited longer?

Also, can't open phone as motherboard cover has stripped screws so I would need to take it repair store.

Does anyone has solution and could help me?

Thank you.

since you don't know how it got bricked, a full backup should be the first thing to do.
in mtkclient, run

Code:

py -3 mtk payload

Share the result. This will open the door to backing up and flashing with SP flash tool
See this https://www.hovatek.com/forum/thread-46342.html

This post was last modified: 18-01-2024, 10:07 AM by maxpayne.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

Orfeluh
Enthusiastic Member

11

18-01-2024, 01:25 PM

#4

(18-01-2024, 10:04 AM)maxpayne
(09-01-2024, 02:02 AM)Orfeluh ..
Dont want to spam too much here so if you could read what errors I got.

After setting up mtkclient gui got this and .
At the end it showed None. I waited for like 5-10 minutes but nothing happened so I closed mtkclient. Should I waited longer?

Also, can't open phone as motherboard cover has stripped screws so I would need to take it repair store.

Does anyone has solution and could help me?

Thank you.

since you don't know how it got bricked, a full backup should be the first thing to do.
in mtkclient, run

Code:

py -3 mtk payload

Share the result. This will open the door to backing up and flashing with SP flash tool
See this https://www.hovatek.com/forum/thread-46342.html

.........Port - Device detected Smile

Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 0499E2EAC9E808A007C6C5FBD6C21C87
Preloader - SOC_ID: 269DFED3791D0B20CDA40998F799AD5930C07671B9DEC7EDE2696D235F1E7ACA
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\mtkclient-main\mtkclient\payloads\mt6768_payload.bin

E:\mtkclient-main>

Orfeluh
Enthusiastic Member

11

19-01-2024, 11:31 AM

#5

.........Port - Device detected Smile

Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 0499E2EAC9E808A007C6C5FBD6C21C87
Preloader - SOC_ID: 269DFED3791D0B20CDA40998F799AD5930C07671B9DEC7EDE2696D235F1E7ACA
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\mtkclient-main\mtkclient\payloads\mt6768_payload.bin

E:\mtkclient-main>

maxpayne
Intern

4,059

25-01-2024, 09:08 AM

#6

(19-01-2024, 11:31 AM)Orfeluh ...
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\mtkclient-main\mtkclient\payloads\mt6768_payload.bin

E:\mtkclient-main>

You should be able to do a firmware dump using WWR 2.51 and SP flash tool as linked @ https://www.hovatek.com/forum/thread-46342.html then,
After the dump, you can easily find out which firmware its running on and how to unbrick.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

Orfeluh
Enthusiastic Member

11

25-01-2024, 04:31 PM

#7

(25-01-2024, 09:08 AM)maxpayne
(19-01-2024, 11:31 AM)Orfeluh ...
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\mtkclient-main\mtkclient\payloads\mt6768_payload.bin

E:\mtkclient-main>

You should be able to do a firmware dump using WWR 2.51 and SP flash tool as linked @ https://www.hovatek.com/forum/thread-46342.html then,
After the dump, you can easily find out which firmware its running on and how to unbrick.

Tried that but got this error in Capture2.
Checked also that scatter is in txt format and it was.
Before clicking Readback I used MTK Auth bypass, also tried without using bypass but nothing happened in SP Flash tool after clicking readback, just phone connecting/disconnecting.

Attached Files

Capture2.PNG
Size: 41.14 KB / Downloads: 5

Capture1.PNG
Size: 48.49 KB / Downloads: 5

Orfeluh
Enthusiastic Member

11

26-01-2024, 12:18 AM

#8

(25-01-2024, 04:31 PM)Orfeluh
(25-01-2024, 09:08 AM)maxpayne
(19-01-2024, 11:31 AM)Orfeluh ...
Exploitation - Done sending payload...
PLTools - Successfully sent payload: E:\mtkclient-main\mtkclient\payloads\mt6768_payload.bin

E:\mtkclient-main>

You should be able to do a firmware dump using WWR 2.51 and SP flash tool as linked @ https://www.hovatek.com/forum/thread-46342.html then,
After the dump, you can easily find out which firmware its running on and how to unbrick.

Tried that but got this error in Capture2.
Checked also that scatter is in txt format and it was.
Before clicking Readback I used MTK Auth bypass, also tried without using bypass but nothing happened in SP Flash tool after clicking readback, just phone connecting/disconnecting.

Don't see attachment so I will write error here: ERROR: STATUS_PRELOADER_INVALID 0xC0030004.

Tried every solution from here https://www.hovatek.com/forum/thread-439.html and still got same error.
Also copied text from scatter file in official fastboot ROM to scatter from WWR to match same text for preloader but still got same error.
Tried using scatter from official rom but then its stuck at Download DA 100%.

maxpayne
Intern

4,059

31-01-2024, 11:31 AM

#9

(26-01-2024, 12:18 AM)Orfeluh Don't see attachment so I will write error here: ERROR: STATUS_PRELOADER_INVALID 0xC0030004.

Tried every solution from here https://www.hovatek.com/forum/thread-439.html and still got same error.
Also copied text from scatter file in official fastboot ROM to scatter from WWR to match same text for preloader but still got same error.
Tried using scatter from official rom but then its stuck at Download DA 100%.

In the Download section, you also need to load the preloader.bin from firmware even to do a read back or dump. Did you do that?

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

Orfeluh
Enthusiastic Member

11

31-01-2024, 04:18 PM

#10

(31-01-2024, 11:31 AM)maxpayne
(26-01-2024, 12:18 AM)Orfeluh Don't see attachment so I will write error here: ERROR: STATUS_PRELOADER_INVALID 0xC0030004.

Tried every solution from here https://www.hovatek.com/forum/thread-439.html and still got same error.
Also copied text from scatter file in official fastboot ROM to scatter from WWR to match same text for preloader but still got same error.
Tried using scatter from official rom but then its stuck at Download DA 100%.

In the Download section, you also need to load the preloader.bin from firmware even to do a read back or dump. Did you do that?

Copied preloader_merlin.bin file from V12.5.4.0.RJOMIXM fastboot rom image but got stuck at Download DA 100%. Used UART connection setting with baud rate 921600.

Capture5.PNG
Size: 39.15 KB / Downloads: 3

Then also tried with connection setting USB with Full speed and auto detect. Also got stuck.

Capture7.PNG
Size: 30.55 KB / Downloads: 6

One thing I noticed in tutorial is that it shows MediaTek PreLoader USB VCOM (Android) (COM43), while

Capture7.PNG
Size: 30.55 KB / Downloads: 6

here it just shows MediaTek USB Port (COM6).

Installed VCOM drivers using auto installer form this post https://www.hovatek.com/forum/thread-16640.html
After downloading installer it shows 2016 as date, could drivers be outdated as Redmi Note 9 is phone from 2020.
Maybe that is the reason it doesn't show MediaTek PreLoader USB VCOM and it's stuck at Download DA 100%. Just a guess.
Thank you for using your time to help.

Attached Files

Capture6.PNG
Size: 30.62 KB / Downloads: 3

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions