MT6895 brom/preloader mode in order to flash OEM ROM packages

[v4lkyr]

Hello Björn,

I've came across below message:

I heard MediaTek released a BootROM blocking toolkit, and started to inform the vendors to use it :

• The OEM's also started to apply their own methods,
  the vendors which took a serious step so far seems to be :
  VIVO, OPPO, SAMSUNG, BLU, HMD, TCL, (LGE - Withdrawn but still receiving updates for the newer sets) and some custom USA carriers devices.
• As we know the preloader is just a boot code to be executed by the target, any modifications could allow to (Enable/Disable) emergency mode - aka (BootROM USB Download mode).
• They also have changed the voltage to prevent any in-trusted firmware execution or any exploitation.
• DA Version updated as well (crypto driver is no longer the same).
• Some EMI fuses added to prevent DRAM init
  , we can’t write anything via SRAM due to security, only readback with very slow speed.
• The new Dimensity processor’s have no vulnerabilities at all, and seems impossible to exploit anymore in near future.
• The recent brom disable by fuse is vulnerable and there is a small chance allow us to skip the boot verification with custom registers (Systems-on-chip (SoCs) specified) - or exploiting via META or FUS in Samsung case.
• But this new way from main SoC manufacturer MTK is really powerful, and we can say goodbye to the BootROM USB download mode in the next 2 years, the OEM's will take some time to study the new methods and apply.
• MediaTek has two boot copies of the preloader - the new brom disable way seems to compare between the 2 boot copies, if the first boot copy which is (boot1 on EMMC flash and LUN0 on UFS) is corrupted or modified or doesn’t match the second boot copy,
  the device will not enter BootROM, this only for exploiting/modifying cases, after doing some research and several tries with direct memory access (ISP).
• the fuses/patchs could be easily applied via OTA updates and hot patches, I guess hw test-point will still work for a while.
• VIVO is the top of the list, OPPO follows,
  The affected oppo devices so far on newer firmware versions :
• OPPO A16K.
• OPPO A54.
• OPPO A55.
• OPPO Devices with MT6765G chip.
• If you know more devices please let us know in the comments, for VIVO we know that all processes are now patched except MT6762/MT6765, but for oppo need to full list if possible.
• It’s all just assuming, I haven't looked deeply on it yet, and we don't know for sure what is really happening/running at the backend.

I have a MT6895 device and wondering if I'll still be able to use your awesome tool without any problems, with latest updates installed from OEM?

Thanks in advance.

[Atassen21]

Mt 6895 brom config q

0x1172: chipconfig(
var1=0xA,
watchdog=0x1c007000,
uart=0x11001000,
brom_payload_addr=0x100A00,
da_payload_addr=0x201000,
pl_payload_addr=0x40200000,
gcpu_base=0x10050000,
dxcc_base=0x10210000,
sej_base=0x1000a000,
cqdma_base=0x10212000,
ap_dma_mem=0x11300800 + 0x1a0,
#blacklist=[(0x102848, 0x0), (0x00106B60, 0x0)],
#blacklist_count=0x0000000A,
#send_ptr=(0x102888, 0xE79C),
#ctrl_buffer=0x00102A9C,
#cmd_handler=0x0000F569,
#brom_register_access=(0xeba4, 0xec5c),
#meid_addr=0x102B98,
#socid_addr=0x102BA8,
#prov_addr=0x1066C0,
damode=damodes.XFLASH,
dacode=0x6895,
name="MT6895",
description="Dimensity 8100"

[iisnsb]

Is it really useful?

[ibnochadad]

hi
i have xiaomi 12t plato mt6895z boot loop after flash wrong region firmware
stuck on DA 100 in spflashtool with authflash server.
no bypass tools can baypass authorization.
just one tool "viper And TIR FRP Removal Tool" has read back mor address info from device without baypassing SLA.
and mtk client

MTK Flash/Exploit Client V1.55 (c) B.Kerler 2018-2022 Moded by: Balveer Jat

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.

.....Port - Device detected :)
Preloader - CPU: ()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x200000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader
Preloader - [LIB]: Error on da_write32, addr 0x10007000, INVALID_ADDRESS (0x1d02)
Preloader
Preloader - [LIB]: Received wrong SetReg_DisableWatchDogTimer response
Preloader - HW code: 0x1172
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 0A399CF11D0C7E32ECAE53F852D9XXXX
PLTools - Loading payload from generic_patcher_payload.bin, 0x56c bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Traceback (most recent call last):
File "C:\Users\HICHAM\Desktop\MTKClient GUI 2.0\mtkclient\mtk", line 698, in
mtk = Main(args).run()
File "C:\Users\HICHAM\Desktop\MTKClient GUI 2.0\mtkclient\mtkclient\Library\mtk_main.py", line 486, in run
self.cmd_payload(mtk=mtk, payloadfile=payloadfile)
File "C:\Users\HICHAM\Desktop\MTKClient GUI 2.0\mtkclient\mtkclient\Library\mtk_main.py", line 548, in cmd_payload
plt.runpayload(filename=payloadfile)
File "C:\Users\HICHAM\Desktop\MTKClient GUI 2.0\mtkclient\mtkclient\Library\pltools.py", line 100, in runpayload
if self.kama.payload(payload, addr, True, exploittype):
File "C:\Users\HICHAM\Desktop\MTKClient GUI 2.0\mtkclient\mtkclient\Library\kamakiri.py", line 138, in payload
if self.exploit2(payload, addr):
File "C:\Users\HICHAM\Desktop\MTKClient GUI 2.0\mtkclient\mtkclient\Library\kamakiri.py", line 116, in exploit2
ptr_send = unpack("<I", self.da_read(self.mtk.config.chipconfig.send_ptr[0][1], 4))[0] + 8
TypeError: 'NoneType' object is not subscriptable
Press Enter to continue

[ghost]

你好比约恩，

我遇到了以下消息：

我听说联发科发布了一个 BootROM 阻止工具包，并开始通知供应商使用它：

• OEM也开始应用自己的方法，到目前为止迈出了重要一步的供应商似乎是：VIVO，OPPO，SAMSUNG，BLU，HMD，TCL，（LGE - 撤回但仍在接收更新的更新）和一些定制的美国运营商设备。
• 正如我们所知，预加载器只是目标要执行的引导代码，任何修改都可能允许（启用/禁用）紧急模式 - 又名（BootROM USB 下载模式）。
• 他们还更改了电压，以防止任何不受信任的固件执行或任何利用。
• DA 版本也已更新（加密驱动程序不再相同）。
• 添加一些EMI保险丝以防止DRAM初始化，由于安全性，我们无法通过SRAM写入任何东西，只能以非常慢的速度回读。
• 新的天玑处理器完全没有漏洞，在不久的将来似乎不可能再被利用了。
• 最近通过保险丝禁用的 brom 容易受到攻击，并且有很小的机会允许我们跳过使用自定义寄存器（指定的片上系统 （SoC））的启动验证 - 或者在三星的情况下通过 META 或 FUS 进行利用。
• 但是主要SoC制造商MTK的这种新方式确实很强大，我们可以在未来2年内告别BootROM USB下载模式，OEM将需要一些时间来研究新方法并应用。
• MediaTek 有两个预加载器的启动副本 - 新的 brom 禁用方式似乎比较了 2 个启动副本，如果第一个启动副本（EMMC 闪存上的 boot1 和 UFS 上的 LUN0）损坏或修改或与第二个启动副本不匹配，设备将不会进入 BootROM，这仅用于利用/修改情况， 在进行了一些研究并多次尝试直接内存访问 （ISP） 之后。
• 保险丝/补丁可以通过 OTA 更新和热补丁轻松应用，我想硬件测试点仍然可以工作一段时间。
• VIVO位居榜首，OPPO紧随其后，到目前为止，受影响的oppo设备使用较新的固件版本：
• OPPO A16K.
• OPPO的A54。
• OPPO A55的。
• 搭载MT6765G芯片的OPPO设备。
• 如果您知道更多设备，请在评论中告诉我们，对于VIVO，我们知道除MT6762 / MT6765之外的所有进程现在都已修补，但对于oppo，如果可能的话，需要完整列表。
• 这一切都只是假设，我还没有深入研究它，我们不确定后端真正发生/运行的情况。

我有一台 MT6895 设备，想知道我是否仍然能够毫无问题地使用您的出色工具，并从 OEM 安装最新更新？

提前致谢。

我是oppoA92s更新到F.12版本以后不能使用此工具，你可以使用如unlocktool付费工具尝试。

[google-mirror]

fixed by MTK

[ibnochadad]

Use this tool . free . Just create user and login
https://authflash.com/api/v8/tool/AFT_10.9.zip

[iisnsb]

Use this tool . free . Just create user and login https://authflash.com/api/v8/tool/AFT_10.9.zip

Really?

[ibnochadad]

Yes this tool is capable to unbrick same mtk phone. I use it to unbrick mi 12T
There is a special boot loader in this tool.

[iisnsb]

Yes this tool is capable to unbrick same mtk phone. I use it to unbrick mi 12T There is a special boot loader in this tool.

Sir.Can you login or create user now? I cant do this,it reported that connecting failed.

[iisnsb]

Yes this tool is capable to unbrick same mtk phone. I use it to unbrick mi 12T
There is a special boot loader in this tool.

And is it still free?