UFS flash based unlock issues (example: Redmi note 9t) about mtkclient

[soralis0912]

I'm try it
But can't Unlock device.

[soralis0912]

python mtk stage

Port - Device detected :)
Preloader -     CPU:                    MT6853(Dimensity 720 5G)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212000
Preloader -     Var1:                   0xa
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xca00
Preloader -     SW Ver:                 0x0
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x996
Preloader - Target config:              0xe7
Preloader -     SBC enabled:            True
Preloader -     SLA enabled:            True
Preloader -     DAA enabled:            True
Preloader -     SWJTAG enabled:         True
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          True
Preloader -     Mem write auth:         True
Preloader -     Cmd 0xC8 blocked:       True
Preloader - ME_ID:                      XXXXXXXXXXXXXX
Preloader - SOC_ID:                     XXXXXXXXXXXXXX
PLTools - Loading payload from D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin
Port - Device detected :)
Main - Device is protected.
Main - Device is in BROM mode. Trying to dump preloader.
Successfully extracted preloader for this device to: D:\APP\mtkclient\mtkclient\Loader\Preloader\preloader_cannong.bin
DAXFlash - Uploading stage 1...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 0000000000000000
DAXFlash - Uploading stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - UFS FWVer:    0x32
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS CID:      XXXXXXXXXXXXXX
DAXFlash - UFS LU0 Size: 0xee5800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DA-CODE      : 0x969F0

python stage2 seccfg unlock

sej - HACC init
sej - HACC run
sej - HACC terminate
Successfully wrote seccfg to seccfg.bin. You need to write seccfg.bin to partition seccfg.

python mtk w seccfg seccfg.bin

Port - Device detected :)
Preloader -     CPU:                    MT6853(Dimensity 720 5G)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212000
Preloader -     Var1:                   0xa
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xca00
Preloader -     SW Ver:                 0x0
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x996
Preloader - Target config:              0xe7
Preloader -     SBC enabled:            True
Preloader -     SLA enabled:            True
Preloader -     DAA enabled:            True
Preloader -     SWJTAG enabled:         True
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          True
Preloader -     Mem write auth:         True
Preloader -     Cmd 0xC8 blocked:       True
Preloader - ME_ID:                      XXXX
Preloader - SOC_ID:                     XXXX
PLTools - Loading payload from D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: D:\APP\mtkclient\mtkclient\payloads\mt6853_payload.bin
Port - Device detected :)
Main - Device is protected.
Main - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading stage 1...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 0000000000000000
DAXFlash - Uploading stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - UFS FWVer:    0x32
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS CID:      XXXX
DAXFlash - UFS LU0 Size: 0xee5800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DA-CODE      : 0x969F0
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: Write data not allowed (0xc002000c)
Failed to write seccfg.bin to sector 104448 with sector count 2048.

python mtk stage
python stage2 seccfg unlock
python stage2 memwrite 0x18000000 seccfg.bin

Successfully wrote data to 0x18000000.

but can't unlock device.

[soralis0912]

sorry missing preloader url

https://github.com/soralis0912/xiaomi_preloader_collection/blob/main/preloader_cannong.bin

[fayharinn]

U need to flash eng rom, after - generate seccfg, flash via fastboot seccfg, and check bl status

Hello you mean with sp flash tool ? I tried to flash the same device to restore imei (I have a full backup except userdata) with format all+download but it stucked at download DA 100%, now my device is dead even if I have backup and stock rom. Cannot write with mtkclient because no partitions are found (which is normal since SP flash tool formated everything)

[fayharinn]

You need try other versions of SPFT. And try to reinstall drivers and other. @fayharinn

Thank you for the reply. I tried with SP_Flash_Tool_v5.2124_Win. I alors installed the drivers one more time. Reading data is still working but not writing...

[soralis0912]

i can't found cannong eng rom....

[Warlockguitarman]

I tried also these commands with the k51
python mtk stage
python stage2 seccfg unlock
python stage2 memwrite 0xe800000 seccfg.bin

and the unlocked seccfg is not correct, I will read the seccfg and get the modified one and then I'll unlock the bootloader with chimera and get that seccfg and then you'll see where things aren't correct, I'll zip them up and label them so you can check out what is wrong with the script

[Warlockguitarman]

https://drive.google.com/file/d/17t_UVUOJJyy87koEFWe5ZM5M3zDEQFuU/view?usp=drivesdk

[Warlockguitarman]

One thing I still notice chimera correctly reads the phone as mt6762 where on here it reads it as mt6765, I'm gonna attempt this with my k61 and stylo 6 which are 6765

[bkerler]

Please try latest commit 05833f1, should work now.

[MlgmXyysd]

Please try latest commit 05833f1, should work now.

Still Device has is either already unlocked or algo is unknown. Aborting. on MT6893.

[MlgmXyysd]

tried

python mtk stage
python stage2 seccfg unlock
python mtk w seccfg seccfg.bin

write success, still locked

[komenkHp]

@bkerler Check For Erase Partition UFS... Erase Sucess But Not Done

[soralis0912]

@bkerler thanks! unlock sucessed

[walleyegg]

Please help me? What command should I enter to unlock？

[walleyegg]

@bkerler ，mDevice has is either already unlocked or algo is unknown. Aborting.�[0m
How can I do this? I am a novice