We're hiring! Apply Now

Hovatek Forum MOBILE Android [Please help] Unbricking My Tecno Spark 7p

[Please help] Unbricking My Tecno Spark 7p

[Please help] Unbricking My Tecno Spark 7p

Juilce
Juilce
Juilce
Newbie
2
14-06-2024, 10:17 AM
#1



I would love your assistance on a specific matter , I wanted to flash my phone but my latest 5 or 6 attempts resulting in either ‘secure boot is enabled’ error when I try to flash everything , or when I exclude unverified bins , phone boots up blank ( black screen ) , this happened a couple of times before , otherwise sometimes it just reboots at boot level.

Things I tried : installing usb filter , using mct bypass tool , custom flash tool , using both uart and automatic usb detection , excluding the following files ( preloader,dtbo_a , tkv_a , tranfs)

Please note : I only get black screen when I exclude said files and I didn’t have this secure boot issue until i tried installing a gsi on a what seemed to me a broken twrp boot recovery i generated on your website ( I am not complaining at all just thoroughly describing what happened)

I’m super tired and I would appreciate your counsel on the matter or/and as to how to flash verified/factory tecno spark 7p firmware or atleast if you could provide me with updated links since they’re dead on your website.


I’m patiently awaiting your response.
Justadudeinspace
Justadudeinspace
Justadudeinspace
Enthusiastic Member
10
15-06-2024, 02:33 AM
#2
(14-06-2024, 10:17 AM)Juilce I would love your assistance on a specific matter , I wanted to flash my phone but my latest 5 or 6 attempts resulting in either ‘secure boot is enabled’ error when I try to flash everything , or when I exclude unverified bins , phone boots up blank ( black screen ) , this happened a couple of times before , otherwise sometimes it just reboots at boot level.

Things I tried : installing usb filter , using mct bypass tool , custom flash tool , using both uart and automatic usb detection , excluding the following files ( preloader,dtbo_a , tkv_a , tranfs)

Please note : I only get black screen when I exclude said files and I didn’t have this secure boot issue until i tried installing a gsi on a what seemed to me a broken twrp boot recovery i generated on your website ( I am not complaining at all just thoroughly describing what happened)

I’m super tired and I would appreciate your counsel on the matter or/and as to how to flash verified/factory tecno spark 7p firmware or atleast if you could provide me with updated links since they’re dead on your website.


I’m patiently awaiting your response.

Hello Friend,

So, I don't actually have your device but I think I can still help you. The Techno Spark 7P is a Mediatek (MT6769V) device. You're best bet is going to be flashing the device in Brom mode using MTKClient. MTKClient is a shell based flash tool developed by bkerler that functions much like Platform-Tools (adb and fastboot). MTKClient is up to date as it is continuously maintained.

Though, some tend to struggle with MTKClient because it's a process and requires learning even more commands. However, MTKClient has a high success rate at effectively flashing bricked Mediatek devices. MTKClient only works on Mediatek devices because it takes advantage of the exploit (back door) on Mediatek devices called Brom mode.

First, you need to install MTKClient on your PC. I personally use a Windows installation but there are installation methods for Linux/MacOS as well. There's also a liveDVD for those who would prefer to skip the installation process. You can find MTKClient with it's in depth instructions and list of commands at the following link:

Bkerler/MTKClient 


I'm pretty familiar with the flashing process using MTKClient cause most of my devices are Mediatek devices, so if you have any questions or struggles with learning the program I'm willing to guide you through it. Matter of fact, I will post a step by step guide following this post.

But go ahead and check MTKClient out and try to become somewhat familiar with the program.
Justadudeinspace
Justadudeinspace
Justadudeinspace
Enthusiastic Member
10
15-06-2024, 03:05 AM
#3
(14-06-2024, 10:17 AM)Juilce I would love your assistance on a specific matter

Code:

Your warranty is now void. Proceed at your own risk. I am not responsible should you brick, bootloop, or destroy your device. Flashing can go wrong and often bricks devices. Should you brick your device then you will need to flash the device with the stock firmware to bring it back to full operation. However, if you point your finger at me in blame, I'm going to do like the other developers and laugh at you.

But don't stress, I'm here to help you fix the device you already bricked.

MTKClient Windows Installation (Install to C:/platform-tools) 
  
Install python 3.9 and git     

If you install python from microsoft store, "python setup.py install" will fail, but that step isn't required.     

WIN+R cmd  

Grab files and install Code:  
Code:

git clone https://github.com/bkerler/mtkclient 
Code:

cd mtkclient 
Code:

pip3 install -r requirements.txt   

Get latest UsbDk 64-Bit      
Install normal MTK Serial Port driver (or use default Windows COM Port one, make sure no exclamation is seen)     

Get usbdk installer (.msi) from here and install it     

Test on device connect using "UsbDkController -n" if you see a device with 0x0E8D 0x0003     

Works fine under Windows 10 and 11  

Other MTKClient Installation Options


Once you have successfully installed MTKClient, open MTKClient shell the same way you'd open Platform-Tools. Open the containing MTKClient folder and type cmd in the search bar to bring up command prompt. Next comes the Brom mode process.

Code:

To enter BRom mode, completely power off the device. Enter the MTKClient command into the shell, and MTKClient will hang idle while searching for the device. Press and hold both volume keys and the power key. While all the phone keys are pressed and held, plug the device into the computer via the data transfer cable. The MTKClient command that's hanging idle should catch and the command will activate.



Code:

(NOTE: Sometimes the first try doesn't catch and the command hanging idle in MTKClient will freeze. If this happens, while still pressing and holding all the phone keys down, unplug the device and immediately plug the device back in. The command should now catch and take off.)

You will have to repeat this process for each individual MTKClient command.

Use the following command in BRom mode with MTKClient to wipe user data:

Code:
Code:

python mtk e metadata,userdata

Use the following command in BRom mode with MTKClient to unlock the bootloader:

Code:

python mtk da seccfg unlock

Use the following command in BRom mode with MTKClient to create a backup dump file (backup of the stock firmware):

Code:
Code:

python mtk rl --skip userdata <full path to the Back-Up Folder on PC>

Use the following command in BRom mode with MTKClient to flash an entire backup dump file/stock firmware folder:

Code:
Code:

python mtk wl <full path to Firmware Folder>

Use the following command in BRom mode with MTKClient to reset the device to system:

Code:
Code:

python mtk reset

After successfully flashing the entire firmware folder, it's a good idea to reset to recovery mode and factory data reset.

Also, you may need to re-enter the unlock bootloader code after fully flashing the device. Flashing the device with MTKClient tends to relock the bootloader. Just a FYI..

That's it.. You should now have a fully stock unbricked device once again. If you have any questions please feel free to ask me. I know that it can be tricky using MTKClient, so don't hesitate to present whatever issue you may have.

I hope this helps..
Juilce
Juilce
Juilce
Newbie
2
16-06-2024, 11:35 AM
#4
Okay so here's an update:


After resolving issues with python dependencies and libraries i got it to work and flash but it behaves similarly to sp flash tool , it flashes some partitions and skips others ( you can guess the ones in question( dtbo , tranfs , tkv , preloader )
I tried using python mtk seccfg and here's the log :






.....Port - Device detected Smile
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 35AE436DEA90A82A5B4982611DF67A1A
Preloader - SOC_ID: A77CE0C456B8584B907FA47AE7CB261EA73098FA3C39FA7FB16DD7DB4999A3E3
DaHandler - Device is protected.
DaHandler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: C:\platform-tools\mtkclient\mtkclient\payloads\mt6768_payload.bin
Port - Device detected Smile
DaHandler
DaHandler - [LIB]: ←[33mDevice is in BROM mode. No preloader given, trying to dump preloader from ram.←[0m
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - EMMC FWVer: 0x0
DAXFlash - EMMC ID: hC9aP3
DAXFlash - EMMC CID: 90014a68433961503301104c3a225809
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size: 0x0
DAXFlash - EMMC GP2 Size: 0x0
DAXFlash - EMMC GP3 Size: 0x0
DAXFlash - EMMC GP4 Size: 0x0
DAXFlash - EMMC RPMB Size: 0x1000000
DAXFlash - EMMC USER Size: 0xe8f800000
DAXFlash - HW-CODE : 0x707
DAXFlash - HWSUB-CODE : 0x8A00
DAXFlash - HW-VERSION : 0xCA00
DAXFlash - SW-VERSION : 0x0
DAXFlash - CHIP-EVOLUTION : 0x1
DAXFlash - DA-VERSION : 1.0
DAXFlash - Extensions were accepted. Jumping to extensions...
DAXFlash - Boot to succeeded.
DAXFlash - DA Extensions successfully added
DaHandler
DaHandler - [LIB]: ←[31mUnknown seccfg partition header. Aborting unlock.←[0m

C:\platform-tools\mtkclient>python mtk.py dumppreloader
MTK Flash/Exploit Client Public V2.0.1 © B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...Port - Device detected Smile
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 35AE436DEA90A82A5B4982611DF67A1A
Preloader - SOC_ID: A77CE0C456B8584B907FA47AE7CB261EA73098FA3C39FA7FB16DD7DB4999A3E3
PLTools - Kamakiri / DA Run
PLTools - Loading payload from generic_preloader_dump_payload.bin, 0x250 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: C:\platform-tools\mtkclient\mtkclient\payloads\generic_preloader_dump_payload.bin
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Main - Preloader dumped as: preloader_kf7j_h696.bin
maxpayne
maxpayne
maxpayne
Intern
4,101
17-06-2024, 08:25 AM
#5



(16-06-2024, 11:35 AM)Juilce Okay so here's an update:
..

I can understand getting that error with other partitions but not preloader unless the firmware is incompatible.
You can bypass verified boot on those partitions with this guide https://www.hovatek.com/forum/thread-39260.html

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
Join us
WhTlYt