Please, help! I have a total zte axon brick on my hands... Windows recognizes it only like qualcomm HS-USB QDloader 9008. I've tried Qfil programm and msm9894download tool, but have no success.
Qfil output such as:
COM Port number:5
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Ack Raw Data:False
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:5
Sending NOP
NOP: Fail Code: 10
Unable to send FireHose NOP, Device is not in Firehose mode !
Download Fail:System.Exception: Failed to send Firehose NOP to the phone.
at QC.QMSLPhone.Phone.QPHONEMS_FireHoseNOP()
at QC.SwDownloadDLL.SwDownload.FireHoseDownloadImage(Boolean bResetPhone, List`1 rawprogramFilesList, List`1 patchFilesList, Single& fImageSizeInMB, Single& fThroughput)
Download Fail:FireHose Fail FireHose Fail
Finish Download
I'll appreciate any help in my situation!
P.S. Sorry if my english is not right, it's not my native language.
P.S.S As far, as I undestend after reading a lot of guides, I need one of files - MPRG8994.hex or MPRG8994.mbn. Can anyone know where I can get them?
saardukar said:
Please, help! I have a total zte axon brick on my hands... Windows recognizes it only like qualcomm HS-USB QDloader 9008. I've tried Qfil programm and msm9894download tool, but have no success.
Qfil output such as:
COM Port number:5
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Ack Raw Data:False
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:5
Sending NOP
NOP: Fail Code: 10
Unable to send FireHose NOP, Device is not in Firehose mode !
Download Fail:System.Exception: Failed to send Firehose NOP to the phone.
at QC.QMSLPhone.Phone.QPHONEMS_FireHoseNOP()
at QC.SwDownloadDLL.SwDownload.FireHoseDownloadImage(Boolean bResetPhone, List`1 rawprogramFilesList, List`1 patchFilesList, Single& fImageSizeInMB, Single& fThroughput)
Download Fail:FireHose Fail FireHose Fail
Finish Download
I'll appreciate any help in my situation!
P.S. Sorry if my english is not right, it's not my native language.
P.S.S As far, as I undestend after reading a lot of guides, I need one of files - MPRG8994.hex or MPRG8994.mbn. Can anyone know where I can get them?
Click to expand...
Click to collapse
Have you tried to go into recovery mode and install any rom from there?
Crazyhat said:
Have you tried to go into recovery mode and install any rom from there?
Click to expand...
Click to collapse
Recovery is not available. Nether fastboot or adb.
So most of you probably don't know what mtkclient is. It is basically an exploit which is used to boot any (mtk) phone into BROM mode (basically EDL for mtk)
I am writing this guide especially for the RM6785 community.
This tool is very useful, you can unlock almost any mediatek device using it (brand won't matter), you can write partitions, read partitions, and even erase partitions.
This tool can also get you out of any kind of brick!
Thanks to bkerler for making such an amazing tool!
How to use it?
Well first of all, I will talk about how to install it inside windows, because most of the users here are most likely using windows.
Download the mtkclient folder from here: https://github.com/bkerler/mtkclient/archive/refs/heads/main.zip
Extract it, and open it.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Now it's time to download python.
If you are on windows 11/10, you can download Python directly from the microsoft store, and I recommend you to do it from there.
If you are on windows 8.1 or lower, you will have to download it from the web.
After installing python is complete.
Open the command prompt inside the mtkclient-main folder.
connect to the internet
and type:
pip3 install -r requirements.txt
and wait for it to install completely.
This will basically set up mtkclient to perform every command.
(ignore this warning)
So after this command is done, you need to install usbdk.
Releases · daynix/UsbDk
Usb Drivers Development Kit for Windows. Contribute to daynix/UsbDk development by creating an account on GitHub.
github.com
After you install usbdk, just restart your PC.
So your mtkclient setup is finished now!
Now you can basically do anything with it.
Let me tell you how it works:
For example, if you want to flash something into a partition, you do:
python mtk w *partitionname* *filename*
the w indicates "write"
so for example if i want to flash, lets say boot img.
python mtk w boot *location of the boot img*
in simple words:
python mtk w boot boot.img
to pull a partition from your device:
python mtk r *partitionname* *filename*
the r indicates "read"
you can pull the image as any name that you'd like"
example:
python mtk r vbmeta realme6vbmeta.img
to erase partitions:
python mtk e *partition*
the e indicates "erase
so for example i want to clear my userdata partition
python mtk e userdata
you can also write,flash,erase multiple partitions at once.
for example:
python mtk w boot,vbmeta boot.img,vbmeta.img
python mtk r dtbo,boot dtbo.img,boot.img
python mtk e metadata,userdata
you can also unlock the bootloader through it:
python mtk da seccfg unlock
so to actually begin the flashing/reading/erasing process, enter the command.
power off your device
hold both of the volume buttons, and quickly connect usb (do not leave the volume buttons until the command is done)
So that is basically how you use it, thanks for reading!
I will make a version for linux users soon!
hey i am getting handshake failed error, not sure how to fix this.
Sidharth09 said:
So most of you probably don't know what mtkclient is. It is basically an exploit which is used to boot any (mtk) phone into BROM mode (basically EDL for mtk)
I am writing this guide especially for the RM6785 community.
This tool is very useful, you can unlock almost any mediatek device using it (brand won't matter), you can write partitions, read partitions, and even erase partitions.
This tool can also get you out of any kind of brick!
Thanks to bkerler for making such an amazing tool!
How to use it?
Well first of all, I will talk about how to install it inside windows, because most of the users here are most likely using windows.
Download the mtkclient folder from here: https://github.com/bkerler/mtkclient/archive/refs/heads/main.zip
Extract it, and open it.
View attachment 5741507
Now it's time to download python.
If you are on windows 11/10, you can download Python directly from the microsoft store, and I recommend you to do it from there.
If you are on windows 8.1 or lower, you will have to download it from the web.
After installing python is complete.
Open the command prompt inside the mtkclient-main folder.
connect to the internet
and type:
pip3 install -r requirements.txt
View attachment 5741509
and wait for it to install completely.
This will basically set up mtkclient to perform every command.
View attachment 5741511
(ignore this warning)
So after this command is done, you need to install usbdk.
Releases · daynix/UsbDk
Usb Drivers Development Kit for Windows. Contribute to daynix/UsbDk development by creating an account on GitHub.
github.com
After you install usbdk, just restart your PC.
So your mtkclient setup is finished now!
Now you can basically do anything with it.
Let me tell you how it works:
For example, if you want to flash something into a partition, you do:
python mtk w *partitionname* *filename*
the w indicates "write"
so for example if i want to flash, lets say boot img.
python mtk w boot *location of the boot img*
in simple words:
python mtk w boot boot.img
to pull a partition from your device:
python mtk r *partitionname* *filename*
the r indicates "read"
you can pull the image as any name that you'd like"
example:
python mtk r vbmeta realme6vbmeta.img
to erase partitions:
python mtk e *partition*
the e indicates "erase
so for example i want to clear my userdata partition
python mtk e userdata
you can also write,flash,erase multiple partitions at once.
for example:
python mtk w boot,vbmeta boot.img,vbmeta.img
python mtk r dtbo,boot dtbo.img,boot.img
python mtk e metadata,userdata
you can also unlock the bootloader through it:
python mtk da seccfg unlock
so to actually begin the flashing/reading/erasing process, enter the command.
power off your device
hold both of the volume buttons, and quickly connect usb (do not leave the volume buttons until the command is done)
So that is basically how you use it, thanks for reading!
I will make a version for linux users soon!
Click to expand...
Click to collapse
Hello have you made the Linux version?
Thank you for this guide, I have encountered an error on Tecno spark 8C(kg5j) when trying either of the commands in ubuntu.
Here is an output of the error.
-----
DAXFlash - [LIB]: xread error: unpack requires a buffer of 12 bytes
DAXFlash
DAXFlash - [LIB]: Error jumping to DA: -1
-----
Johnhek said:
handshake failed error
Click to expand...
Click to collapse
Check this out: https://github.com/bkerler/mtkclient/issues/52
Fair warning, there are a TON of multiple GB dependencies to make this work. I'm seriously starting to wonder if trying to un brick my $1,800 device is even worth the trouble.
I have an RFinder B1+ with a MTK 6765 chipset. It has external batteries only and boot loops when one is attached due to a bad lk.img flash. The device does show up brieflu in Windows task manager as a MediaTek COM port when I plug in a USB cable with no battery attached.
Should I plug in the battery first or try to run mtkclient without it?
I was using "wl" command (write list: write partitions from directory to flash) and I had a very dumb issue:
I moved the partition images to the mtkclient folder and started the wl comand, but when the partitions were all copied, the comand continued checking all the subfolders looking for more partition files to write to the phone... and it "found" one: inside of the python lib folder there is a file called gpt and the command overwrited my pgpt partition with that file!
Now of course any command trying to read or write partitions crash because the pgpt partition is corrupt.
I can read sectors and indeed I have confirmed that the contents of the first sectors (that would correspond to pgpt partition) actually contains plain text from the pgt file at python lib folder.
Before this mistake, I saved the gpt table to a file and I also have gpt scatter information from my phone.
I would need help to restore the pgpt partition using the sgpt partition or using the pgt scatter information, or the gpt table copied from my phone before the deletion or any other way to restore the phone...
Someone can help me?
I Have a lg k61, I can use mtkclient but I have no fastboot. Im wondering if its posible to boot a bin without flashing it (like fastboot boot recovery.img) because I think that the only reazon I cant install a working twrp in my device is the way I flash it, directly to boot partition.
Maybe is it possible to flash the recovery to b slot, force boot from that slot, flash from twrp the zip to boot_a partition, then set a slot?
Sidharth09 said:
So most of you probably don't know what mtkclient is. It is basically an exploit which is used to boot any (mtk) phone into BROM mode (basically EDL for mtk)
I am writing this guide especially for the RM6785 community.
This tool is very useful, you can unlock almost any mediatek device using it (brand won't matter), you can write partitions, read partitions, and even erase partitions.
This tool can also get you out of any kind of brick!
Thanks to bkerler for making such an amazing tool!
How to use it?
Well first of all, I will talk about how to install it inside windows, because most of the users here are most likely using windows.
Download the mtkclient folder from here: https://github.com/bkerler/mtkclient/archive/refs/heads/main.zip
Extract it, and open it.
View attachment 5741507
Now it's time to download python.
If you are on windows 11/10, you can download Python directly from the microsoft store, and I recommend you to do it from there.
If you are on windows 8.1 or lower, you will have to download it from the web.
After installing python is complete.
Open the command prompt inside the mtkclient-main folder.
connect to the internet
and type:
pip3 install -r requirements.txt
View attachment 5741509
and wait for it to install completely.
This will basically set up mtkclient to perform every command.
View attachment 5741511
(ignore this warning)
So after this command is done, you need to install usbdk.
Releases · daynix/UsbDk
Usb Drivers Development Kit for Windows. Contribute to daynix/UsbDk development by creating an account on GitHub.
github.com
After you install usbdk, just restart your PC.
So your mtkclient setup is finished now!
Now you can basically do anything with it.
Let me tell you how it works:
For example, if you want to flash something into a partition, you do:
python mtk w *partitionname* *filename*
the w indicates "write"
so for example if i want to flash, lets say boot img.
python mtk w boot *location of the boot img*
in simple words:
python mtk w boot boot.img
to pull a partition from your device:
python mtk r *partitionname* *filename*
the r indicates "read"
you can pull the image as any name that you'd like"
example:
python mtk r vbmeta realme6vbmeta.img
to erase partitions:
python mtk e *partition*
the e indicates "erase
so for example i want to clear my userdata partition
python mtk e userdata
you can also write,flash,erase multiple partitions at once.
for example:
python mtk w boot,vbmeta boot.img,vbmeta.img
python mtk r dtbo,boot dtbo.img,boot.img
python mtk e metadata,userdata
you can also unlock the bootloader through it:
python mtk da seccfg unlock
so to actually begin the flashing/reading/erasing process, enter the command.
power off your device
hold both of the volume buttons, and quickly connect usb (do not leave the volume buttons until the command is done)
So that is basically how you use it, thanks for reading!
I will make a version for linux users soon!
Click to expand...
Click to collapse
Hi, not quite sure with the terminologies in the commands part, if i want to root /give root access to my phone which command should i use?
darklight_69 said:
Hi, not quite sure with the terminologies in the commands part, if i want to root /give root access to my phone which command should i use?
Click to expand...
Click to collapse
You read to your pc from your phone vía mtkclient the boot_a.bin. You then rename it to boot_a.img, then you turn on your phone, move the img to it, install magisk, patch the boot.img, move it to your pc again, rename the patched to *.bin again and flash it to your boot_a partition vía mtkclient.
Jaguar_90 said:
You read to your pc from your phone vía mtkclient the boot_a.bin. You then rename it to boot_a.img, then you turn on your phone, move the img to it, install magisk, patch the boot.img, move it to your pc again, rename the patched to *.bin again and flash it to your boot_a partition vía mtkclient.
Click to expand...
Click to collapse
if it's not bothering, could you please make a detailed step by step or link a post for a detailed instruction on how to exactly do what youve said? sorry i am having a hard time comprehending the steps, dont want to mess the procedure, thank you
or can i pm u instead?
darklight_69 said:
if it's not bothering, could you please make a detailed step by step or link a post for a detailed instruction on how to exactly do what youve said? sorry i am having a hard time comprehending the steps, dont want to mess the procedure, thank you
or can i pm u instead?
Click to expand...
Click to collapse
Here is a more detail steps.
You need to find out if the Phone is using AB slot or not. For AB slot partitions, you need to know which slot is active and flash accordingly.
Use Mtkclientand to copy the boot_a.bin.
For AB slot: python mtk r boot_a boot_a.bin
For AB slot: python mtk r boot_b boot_b.bin
For single slot: python mtk r boot boot.bin
You rename it to boot_a.img
Copy the boot_a.img to phone's internal storage.
Install Magisk on the phone.
Open Magisk app.
Click the Install button .
Select the patch the image file option.
After you patched boot_a.img, copy the patched boot_a.img to the PC.
Rename the patched boot_a.img to boot_a.bin.
Use MTKClient to flash it to the boot_a partition.
For AB slot: python mtk w boot boot.bin
For AB slot: python mtk w boot_a boot_a.bin
For single slot: python mtk w boot_b boot_b.bin
edited this instead sicne i cant delte this reply, please ignore this one
i want to ask some questions here in advance after reading the entire process so i can reduce the unnecessary replies from me lol
magi44ken said:
You need to find out if the Phone is using AB slot or not. For AB slot partitions, you need to know which slot is active and flash accordingly.
Click to expand...
Click to collapse
-my phone is using a/b slot and is currently on B slot
magi44ken said:
Use Mtkclientand to copy the boot_a.bin.
For AB slot: python mtk r boot boot.bin
For AB slot: python mtk r boot_a boot_a.bin
Click to expand...
Click to collapse
do i need to run all of them one by one?
and in 2nd command's case, sicne i'm currently in slot b should i rename "boot_a | boot_a.bin" to "boot_b | boot_b.bin"?
magi44ken said:
You rename it to boot_a.img
Click to expand...
Click to collapse
okay for this part its just changing the extension
magi44ken said:
Copy the boot_a.img to phone's internal storage.
Click to expand...
Click to collapse
you mean like the regular transfer when the phone is on right? XD
magi44ken said:
Install Magisk on the phone.
Open Magisk app.
Click the Install button .
Select the patch the image file option.
After you patched boot_a.img, copy the patched boot_a.img to the PC.
Rename the patched boot_a.img to boot_a.bin.
Use MTKClient to flash it to the boot_a partition.
For AB slot: python mtk w boot boot.bin
For AB slot: python mtk w boot_a boot_a.bin
For single slot: python mtk w boot_b boot_b.bin
Click to expand...
Click to collapse
well, the earlier questions will clear the confusion in this part anyways but i still got the gist of it.
also on this post, it mentioned something about vbmeta.img, do i no longer need that?
Hello, if I have a bin file (Rom1) from another device, can I read the rpmb key with mtkclient this way?
I do not understand these messages:
mtkclient-main\mtk_gui:557: DeprecationWarning: Enum value 'Qt::ApplicationAttribute.AA_EnableHighDpiScaling' is marked as deprecated, please check the documentation for more information.
QApplication.setAttribute(Qt.AA_EnableHighDpiScaling, True)
...and...
\mtkclient-main\mtk_gui:118: DeprecationWarning: Function: 'QLibraryInfo.location(QLibraryInfo.LibraryPath location)' is marked as deprecated, please check the documentation for more information.
translations_path = QLibraryInfo.location(QLibraryInfo.TranslationsPath)
When trying to flash the preloader, the execution of the command started like this:
Device detected : )
Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x788
Preloader - Target config: 0x0
Preloader - SBC enabled: False
Preloader - SLA enabled: False
Preloader - DAA enabled: False
Preloader - SWJTAG enabled: False
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 5649224A4BD6F0263F7ABC130DCE05AA
Preloader - SOC_ID: 67EB8D8456F3D36A30C5801507195F549290F216EF032600F78136D5E0D540D5
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
It is a Unihertz Titanium (UFS) that stopped responding. The previous owner tried to prepare the bottles of Gargoyle-LOS20 by deleting user data, cache and system. I would like to help him and save the device for him.
I would like to use the graphical interface of mtkclient. But unfortunately the tool does not load the files from the unpacked stock ROM...where do I have to put the files in the mtkclient-main directory?
how come your preloader gets detected? mine only shows up for 1 sec in device manager
Medionato said:
I do not understand these messages:
mtkclient-main\mtk_gui:557: DeprecationWarning: Enum value 'Qt::ApplicationAttribute.AA_EnableHighDpiScaling' is marked as deprecated, please check the documentation for more information.
QApplication.setAttribute(Qt.AA_EnableHighDpiScaling, True)
...and...
\mtkclient-main\mtk_gui:118: DeprecationWarning: Function: 'QLibraryInfo.location(QLibraryInfo.LibraryPath location)' is marked as deprecated, please check the documentation for more information.
translations_path = QLibraryInfo.location(QLibraryInfo.TranslationsPath)
When trying to flash the preloader, the execution of the command started like this:
Device detected : )
Preloader - CPU: MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x788
Preloader - Target config: 0x0
Preloader - SBC enabled: False
Preloader - SLA enabled: False
Preloader - DAA enabled: False
Preloader - SWJTAG enabled: False
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 5649224A4BD6F0263F7ABC130DCE05AA
Preloader - SOC_ID: 67EB8D8456F3D36A30C5801507195F549290F216EF032600F78136D5E0D540D5
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
It is a Unihertz Titanium (UFS) that stopped responding. The previous owner tried to prepare the bottles of Gargoyle-LOS20 by deleting user data, cache and system. I would like to help him and save the device for him.
I would like to use the graphical interface of mtkclient. But unfortunately the tool does not load the files from the unpacked stock ROM...where do I have to put the files in the mtkclient-main directory?
Click to expand...
Click to collapse
I tried installing directly from here: https://github.com/bkerler/mtkclient. It works for the most part. But I would have liked to use the graphical interface, but that somehow fails. The files don't load into the selection windows and the command buttons don't respond either. Only the terminal control works. But I could not flash the preloader yet. The battery of the device doesn't seem to be charged either. I can't control this...is this possibly a hindering problem?
Medionato said:
I tried installing directly from here: https://github.com/bkerler/mtkclient. It works for the most part. But I would have liked to use the graphical interface, but that somehow fails. The files don't load into the selection windows and the command buttons don't respond either. Only the terminal control works. But I could not flash the preloader yet. The battery of the device doesn't seem to be charged either. I can't control this...is this possibly a hindering problem?
Click to expand...
Click to collapse
Which device are you using?
anybody knows how to solve this problem? i get this whenever i try to extract boot.bin
Code:
.DeviceClass
DeviceClass - [LIB]: ←[31mCouldn't get device configuration.←[0m