[Please help] Invengo XC2908 (MT6765) - Preloader handshake fails, stuck vendor lock blockin
[Please help] Invengo XC2908 (MT6765) - Preloader handshake fails, stuck vendor lock blockin
31-07-2026, 05:50 PM
Quick disclaimer: I'm not very experienced with Android internals/MTK exploits - most of the diagnosis below was worked out with the help of Claude (AI assistant), so apologies in advance if I'm missing something obvious or misusing terminology anywhere.
Device: Invengo XC2908 RFID scanner (Android-based, industrial handheld)
- SoC: MT6765 (Helio P35/G35)
- Board: XC2908_3G, ODM: Jintaiyi ("kingtop" k61v1_64_bsp)
- Android 11, Kernel 4.19.127
- SW Ver: alps-mp-r0.mp1-V8.263_kingtop.r0mp1.k61v11.64.bsp_P1
- Build: full_k65v1_64_254_YWG, user/dev-keys (production build, ro.secure=1)
Background:
Bought this used from a company liquidation (Kleinanzeigen/eBay-style listing) to run our own logistics APK on it. After doing a factory reset from the Android settings menu, I can no longer install our own app (signed, not from Play Store) - neither via normal install nor via adb install. Popup says "System prohibits the installadion of third-party applications"(yes. There is a typo in the message), and adb install returns INSTALL_FAILED_INSUFFICIENT_STORAGE (red herring - 21GB free on /data).
Root cause (confirmed via logcat/dumpsys): a read-only system property baked into the OEM image:
ro.jty_ywg_app_install_switch = 1
Enforced by a custom framework check in services.jar (method setInstallMarketAppsRestriction), logged as "Restrict installation applications:". Since it's a ro. property, it can't be changed at runtime (setprop/settings put do nothing), and it gets reset from the factory image on every factory reset. No device owner, no MDM profile active (dpm list-owners empty, dumpsys device_policy only shows a harmless screen-lock admin). Likely the original fleet owner had a system-signed management app that bypassed this restriction, which got wiped by the reset.
Goal: root the device to patch/override this property (Magisk module or init hook), since there's no official firmware available (no vendor support - no proof of purchase, device came from a third-party liquidation) and I don't want to firmware-lock myself out further.
What I've tried:
1. Factory test menu (*#*#6311#*#* / *#*#6316#*#*, also reachable via Vol Up+Down at boot) - only hardware diagnostics (LCD, sensors, battery), no software/property options.
2. Fastboot mode (via bootloader menu, Vol Up at boot) - device enumerates fine over USB (drivers installed via Zadig, WinUSB then libusbK on 0E8D:201C), but `fastboot devices` / `fastboot getvar` return nothing at all, not even an error - just "waiting for any device" indefinitely. Suspect fastboot daemon is functionally disabled in this build.
3. Stock recovery (Android Recovery, user/dev-keys) - "Mount /system" works fine, "Apply update from ADB" starts sideload, and the device does show up via `adb devices` - but permanently as "unauthorized". No way to confirm the RSA key dialog since this recovery has no touch/visual confirmation UI at all. Both `adb shell` and `adb sideload` fail with device unauthorized, no matter what.
4. MTKClient - this is the closest I've gotten. In preloader mode (no buttons held, just plug in), mtk.py detects the device ("Preloader") but the handshake loops with:
`Preloader - [LIB]: Status: Handshake failed, retrying...`
Tried different cables/ports, multiple replug attempts, both WinUSB and libusbK drivers on 0E8D:2000. No luck so far. Haven't yet nailed the BROM key combo (vol+power vs vol+vol) cleanly - vol up+down together sends it into the factory test menu instead, vol up alone goes to the fastboot/bootloader selector.
Questions:
- Anyone recognize this ODM ("jty_ywg"/Jintaiyi/kingtop) or dealt with a similarly locked-down MT6765 fleet device?
- Does this look like a case where BROM is patched and I need a specific V6 loader instead of the generic payload?
- Any known working key-combo/timing for this specific board to reliably hit BROM (not preloader, not the factory test menu)?
- Is stock recovery ADB unauthorized-with-no-UI a known dead end, or is there a trick to auto-authorize (e.g. pre-seeding an adbkey some other way)?
Happy to post anything that helps. Thanks in advance.
31-07-2026, 11:14 PM
(31-07-2026, 05:50 PM)Leon0321 ...
4. MTKClient - this is the closest I've gotten. In preloader mode (no buttons held, just plug in), mtk.py detects the device ("Preloader") but the handshake loops with:
`Preloader - [LIB]: Status: Handshake failed, retrying...`
...
You first need afirmware pull/dump.
List all the buttons on the device besides the volume buttons
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
31-07-2026, 11:30 PM
(31-07-2026, 11:14 PM)hovatek(31-07-2026, 05:50 PM)Leon0321 ...
4. MTKClient - this is the closest I've gotten. In preloader mode (no buttons held, just plug in), mtk.py detects the device ("Preloader") but the handshake loops with:
`Preloader - [LIB]: Status: Handshake failed, retrying...`
...
You first need afirmware pull/dump.
List all the buttons on the device besides the volume buttons
Besides the volume up/down buttons are a power button and on each side a "scanner" button to trigger the scanner module.
This post was last modified: 31-07-2026, 11:31 PM by Leon0321.
06-08-2026, 03:24 PM
(31-07-2026, 11:30 PM)Leon0321 Besides the volume up/down buttons are a power button and on each side a "scanner" button to trigger the scanner module.
Power off the device, then open Device Manager on your PC
Take note of what appears when you hold different button combinations, then connect to the PC
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)
