[Please help] Redmi Pad 2 (taiko / MT6789) stuck in preloader only, SLA blocks mtkclient, no
[Please help] Redmi Pad 2 (taiko / MT6789) stuck in preloader only, SLA blocks mtkclient, no
27-07-2026, 02:38 PM
Hi everyone,
I bricked my Redmi Pad 2 and I'm out of ideas, hoping someone here
has dealt with MT6789 before.
DEVICE
Xiaomi Redmi Pad 2, codename taiko, model 25040RP0AE
MediaTek MT6789 (Helio G100)
Global/EEA version (taiko_eea), not China
Stock was HyperOS OS2.0.204.0.VOVEUXM, Android 15
Bootloader officially unlocked, seccfg still intact
WHAT I DID
I built CrDroid 16.0 for it and flashed boot, dtbo, vendor_boot
and the vbmeta chain from fastboot. Everything flashed fine, all
OKAY. Then I ran "fastboot reboot recovery" to sideload the ROM
zip, and the screen just went black and never came back. The ROM
itself was never installed, so super still has the stock system
on it. I never formatted userdata either.
Yes, I know flashing both slots was dumb. Learned that one the
hard way.
CURRENT STATE
The tablet is alive. When I plug it in it shows up reliably as
VID 0e8d (MediaTek Preloader), every single time. Screen stays
completely black, no backlight at all.
Fastboot (18d1) never appears no matter what button combo I try.
From what I can tell, with the USB cable connected the preloader
just parks in download mode and never hands off to LK, so there's
no chance for LK to see the volume key.
WHAT I ALREADY TRIED
- mtkclient printgpt and crash: always "Preloader - Status:
Handshake failed, retrying..."
- BROM mode (holding Vol Up + Vol Down while connecting): same,
never handshakes
- Moved to a real USB 2.0 port (480 Mbps), no change
- Stopped ModemManager in case it was stealing the port, no change
- Battery died mid-troubleshooting, charged it back up, device
responds again but handshake still fails
- bypass_utility: MT6789 isn't in the supported chipset list, it
stops at mt6873/mt6785
- Found an auth_sv5.auth floating around but hexdump shows
"LenovoAndy" at 0x40, so it's Lenovo signed and useless here
So I'm fairly sure this is just Xiaomi SLA/DAA and not a hardware
problem. UFS has to be fine since the preloader loads from it.
WHAT I'M ASKING
1. Has anyone actually gotten SP Flash Tool to auth a Xiaomi
MT6789 device in preloader mode? Which tool worked?
2. Is there any known way to force LK to come up so I can reach
fastboot? If I could get there I'd be done, the bootloader is
already unlocked and I have the stock images ready.
3. Does anyone know the testpoint location for taiko? I'd rather
not go in blind on a glued battery.
Checked Hydra changelogs and their Xiaomi preloader auth only
lists MT6765, MT6768 and MT6833. MT6789 is there but only for
Motorola/Infinix/Oppo, which doesn't help since auth is signed
per OEM key.
Any pointers appreciated. Happy to run whatever diagnostics and
post logs.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)