Possible BROM TestPoints G23 | penangf

[shomykohai]

Looking through the schematics,
some test points that may grant brom access were found:

• KPCOL0 -- TESTED
• [CLK/DAT0] -- TESTED
• [UP/DOWN] -- TESTED

Update: No test point has granted us BROM. It's probably disabled by efuse.

KPCOL0:

TESTED

This TP relates to something called KEYPAD in the MT6769-SBS (Page 7 of the schematics).
What's important is the text next to the TP label: Translated it recalls something about "forcing" "Force USB Boot", and looking on xda it seems the brom TP usually is called KCOL0 (similar to KPCOL0).

Here's where the test point is located:

Seem to force the phone into loading a special USB mode?

CLK / DAT0

TESTED*

Located at the back of the board, cannot be accessed easily being them without a dedicated nyckel.
Risky to use, but higher chance of sending us to BROM.

https://www.msab.com/it/blog/mediatek-a-short-story/

UP / DOWN

TESTED

Positioned near the back camera, where BROM test points are usually located in Motorola phones:

Could be other test points for volume buttons.

[shomykohai]

Possible CLK and DAT0 Nyckels?

Looking at the schematics, near the SoC and the eMMC there should be the eMMC TPs.

Thanks to this video, I was able to identify these possible test points which could be CLK, DAT0 and CMD:

They look to be just hidden, like UFS ISP Test points do:

[progzone122]

But to do this you have to remove the protective metal shield, and this can be dangerous without special tools.
That is why we cannot do it.
Let's look for more options, maybe we can find a dedicated testpoint or a combination of testpoints?

[shomykohai]

The problem would be that the some of the test points on the front would still be under the other metal shield, so we are even more limited than before.

Surely UP/DOWN TPs are to try next, they should easy to access and nothing wrong should happen.
My guess is that they won't work but just emulates the volume UP/DOWN buttons, but their positioning is coherent with other phones TPs so trying is an option for sure.

[shomykohai]

Moto E7 (XT2097) Test point is KPCOL0, and it's marked as BOOT_MODE.

This doesn't say much about our device which has a different chipset, but it confirms what we thought KPCOL0 is generally used for.

Moto g24 (XT2423) has a KPCOL0 test point too, and the handling of this point looks to be different than ours (could this be g24 test point though?)

Our device does not have any reference of KPCOL0 in the Keypad section, and connects directly (with 1kOmh resistance, R1316) to the bus.

This could give two conclusions:

1. KPCOL0 is in fact our test point, and we just used it wrongly
2. BROM could be disabled by efuse, meaning we can't access it even with TP (I don't think we have a way to check it, without decompiling either expdb or preloader)

[shomykohai]

@progzone122 we have some useful news!
I dumped the expdb partition, and (apart from it being almost all zeros), at the end I think we have what could be the boot and preloader logs!

Looking for some of the strings I was able to find some kernel sources:

• https://android.googlesource.com/kernel/mediatek/+/android-mtk-3.18/drivers/misc/mediatek/boot/mt_boot_common.c
• https://github.com/l33tnoob/MT65x2_kernel_lk/blob/master/mediatek/platform/mt6572/lk/boot_mode.c

It would be really interesting seeing how this partition reacts to changes in boot modes (fastboot, META, preloader, DA and KPCOL0)

These logs are also really useful to understand which partitions does what!

Maybe ask the other people on the telegram group if they can manage to find something too while you fix your device, they just need to run your backup_critical_partitions script and open the file with a text editor.

[shomykohai]

I just found something that could mean REALLY GOOD NEWS!

Looking at my expdb logs, this is what i found:

[SBC] Verification Fail(0x102005)
[UDL] usbdl_send_da: clean invalid da
<ASSERT> /home/queen/buildspace/workspace/STC/STC_version_build_serial_nochecksum/android_build/code/S_base/vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6768/src/core/download.c:line 570 0
PL fatal error...
PL delay for Long Press Reboot
[PLFM] emergency download mode(timeout: 5s).

Emergency Download Mode?
Can this mean we can somehow send the device to brom and somehow make it stay like that?

We absolutely need to see what happens with KPCOL0

[progzone122]

I can check when I restore the phone. Because now it behaves itself strangely. I hate Motorola

[progzone122]

During phone startup, the KPCOL0 testpoint starts showing 1.6V, and when the phone is simply turned off - 0.6V. Is this normal?

[progzone122]

Could possibly be normal I'd say, doesn't sound that weird to me.

Also read this: https://xdaforums.com/t/coolpad-sky-3-e502-modena-2-unbrick.3610163/

Then why is it not detected in mtkclient as BROM when using testpoint? :(

[shomykohai]

Then why is it not detected in mtkclient as BROM when using testpoint? :(

Could be various reasons, our best way to know is to read the bootlogs!

[progzone122]

Then why is it not detected in mtkclient as BROM when using testpoint? :(

Could be various reasons, our best way to know is to read the bootlogs!

I still haven't fixed my phone, now it's stuck at 41% and won't charge anymore, charging current drops to 0.
I'm sick of it... >:((((

[shomykohai]

I wonder if this is still related to Android battery stats (so only android problem) or even stuff like keeping the phone in preloader.

If it's only the first, maybe factory reset could help?

[progzone122]

I wonder if this is still related to Android battery stats (so only android problem) or even stuff like keeping the phone in preloader.

If it's only the first, maybe factory reset could help?

This is not an Android problem

[shomykohai]

When the phone is powered on and a USB cable is connected to the PC, lsusb recognize the device as
Bus 001 Device 022: ID 22b8:2e82 Motorola PCS XT1541 [Moto G 3rd Gen]

If i then enable USB Debugging:
Bus 001 Device 023: ID 22b8:2e81 Motorola PCS moto g23

We get the same device name as we do with KPCOL0, but with a different PID: moto-penangf/penangf-schematics#1 (comment)

Do we get a special USB mode with KPCOL0?

[shomykohai]

I get STATUS_SEC_DOWNLOAD_FORBIDDEN

Edit: I had to use DA_PL_NO_CERT_V6, boots up again

Did you fix the soft brick? Does it boot now?

Yup! I flashed everything except userdata and super to make it flash faster.

It was probably something wrong in the boot partition or some other that tells the preloader what to boot, or at least this is my guess

[progzone122]

I get STATUS_SEC_DOWNLOAD_FORBIDDEN
Edit: I had to use DA_PL_NO_CERT_V6, boots up again

Did you fix the soft brick? Does it boot now?

Yup! I flashed everything except userdata and super to make it flash faster.

It was probably something wrong in the boot partition or some other that tells the preloader what to boot, or at least this is my guess

I will probably make a dozen warnings in the documentation...

Really shitty software

[shomykohai]

Better make the documentation to fix the issue too

[shomykohai]

Moreover, if it's not identified as BROM/Preloader, I don't see how else this mode can be explained other than by activating something in UART...

Our hypothesis could be confirmed by logs if we are able to capture them when switching to this mode.

I missed these replies.

In my opinion there's some other options to be enabled first to give us UART access.

Not having the moto bootloader, it's hard to check for Console mode as easily.

I've found this regarding UART
https://blog.bacon.dev/2020/10/enabling-serial-port-or-console-uart-on.html

Would be useful to find similar resources for Mediatek based devices.

[shomykohai]

@progzone122 What's the Switch console option in fastboot? Could it what we're looking for UART?

[shomykohai]

This could give two conclusions:

1. KPCOL0 is in fact our test point, and we just used it wrongly

@progzone122 What did you do to short KPCOL0? And how much time did you keep the short for? I'm reading of people keeping the connection all the time during flashing on dead devices (which are not only phones)

[progzone122]

I’m not sure, sometimes it worked when I briefly shorted the test point, and sometimes when I held it. This still needs to be tested.

[shomykohai]

I’m not sure, sometimes it worked when I briefly shorted the test point, and sometimes when I held it. This still needs to be tested.

There's so many things pointing to this TP being the one we want, we must test it as much we can when you're done with the battery issue

[shomykohai]

Could BROM be disabled completely?

Standing to this source, Lenovo blocked brom on new devices since 2022 https://www.hovatek.com/forum/thread-45917.html

What's concerning is that the device in question in this forum has the same chipset as ours, and test points seem not to work.

However, moto g22 (MT6765) has released after January 2022 and has a way to access brom: https://xdaforums.com/t/how-to-boot-a-moto-g22-into-brom-mode.4695317/#post-89736563

This post from XDA claims that brom is blocked on newer devices, unless you disassemble the phone

[progzone122]

Oh my god, why did they do that? Now I'm not sure we can unlock the bootloader without ISP Box.
But, I'm relieved that we have KPCOL 0

[shomykohai]

Probably "For security reasons" (while leaving FRP reset doable without a PC, which is way worse).

We must hope in either KPCOL0 or find an alternative spot for CLK.

Would be interesting trying AMT too: https://youtu.be/wz0zW3wQzvg

[progzone122]

Probably "For security reasons"

I think they did it to make it unrepairable, especially with their shitty firmware

[progzone122]

If we cause a flash memory read failure during phone startup, I think we can enter BROM even if it is locked.
But how can this be done safely and desirable using existing test points?

[shomykohai]

That's what we'd want to do with CLK unfortunately, but as we know it's hard to access, unless we find a point on the front of the board (a capacitor for example) that transfers the CLK signal, we might be able to short it.

When I say it's risky compared to KPCOL0 is because in this case we're dealing with the eMMC TP and not just the keypad ones, and especially their position (we might touch something else and risk frying the eMMC)

[progzone122]

That's what we'd want to do with CLK unfortunately, but as we know it's hard to access, unless we find a point on the front of the board (a capacitor for example) that transfers the CLK signal, we might be able to short it.

When I say it's risky compared to KPCOL0 is because in this case we're dealing with the eMMC TP and not just the keypad ones, and especially their position (we might touch something else and risk frying the eMMC)

Fucking Motorola

[shomykohai]

Take a look at the schematics, page 7, where there's the MSDC bus: The MSDC0_CMD point has a capacitor C26 (i think it's that) near KPCOL0. I can't find CLK one tho.

Do you think we might be able to use that if we find where it goes?

Nvm, I've read it wrong

[shomykohai]

I can confirm again, there's no easy accessible point to quiet CLK, I looked at the schematics from the beginning..

Vivo Y22 has the same issue for this TP, it has to be accessed like this.
We can only hope for KPCOL0, or you would have to access that CLK point which is absolutely not easy and not accessible.

[shomykohai]

We're lucky too tbh, Moto g24 doesn't have the CLK test point at all (they document JTAG points tho, but we already have them anyway)

[progzone122]

Good news, KPCOL0 in our scheme does not emulate any of our available buttons, this testpoint goes directly to our SOC. There is a good chance that it does provide us with some kind of mode.

KPCOL1 is our volume button-

[shomykohai]

I actually managed to get it into this mode with the help of VOL-...
Bus 005 Device 051: ID 22b8:2046 Motorola PCS moto g23

Are you able to pull the latest logs out to see what the phone did?

[progzone122]

On Windows it is defined as two devices:
MIDI function [0]
MIDI function [1]

[shomykohai]

I don't have any idea what that would imply

Maybe there was just an error using KPCOL0 last time??

[shomykohai]

Could this help?
https://github.com/svoboda18/preloader/blob/main/platform%2Fmt6768%2Fsrc%2Fdrivers%2Fplatform.c#L872-L885

[shomykohai]

It'd be very funny if they disabled this flag..

https://github.com/svoboda18/preloader/blob/main/custom%2Fk68v1_64%2Fsecurity%2Fchip_config%2Fs%2Fgfh%2Fpl_gfh_config_pss.ini#L19

[shomykohai]

@progzone122 We might want to try something new with KPCOL0:

When we cause an error in mtkclient (such as DAA_SIG_VERIFY_FAILED), the preloader throws a fatal error:
https://github.com/orgs/moto-penangf/discussions/1#discussioncomment-11646269

[SBC] Verification Fail(0x102005)
[UDL] usbdl_send_da: clean invalid da
<ASSERT> /home/queen/buildspace/workspace/STC/STC_version_build_serial_nochecksum/android_build/code/S_base/vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6768/src/core/download.c:line 570 0
PL fatal error...
PL delay for Long Press Reboot
[PLFM] emergency download mode(timeout: 5s).

What if, after we get the error in mtkclient, you start shorting KPCOL0 to GND and see if something changes? It looks like PL waits for something to happen (because of the timeout) before restarting the phone.

[shomykohai]

@progzone122 I continue seeing various sources affirming that to use KPCOL0 you need to keep it shorted either until you see BROM mode detected or until it finished flashing everything 🤔

Could you try again what you did here? https://github.com/orgs/moto-penangf/discussions/1#discussioncomment-11652779

This is our last chance for easy methods that doesn't revolve on removing shields, I wasn't able to use the crashed preloader in the 5 seconds timeframe, it just freezes instead

[progzone122]

It goes into PCS mode, but not into BROM mode

[shomykohai]

we really have to use CLK then..

[shomykohai]

It goes into PCS mode, but not into BROM mode

Update:
It looks like PCS is just part of the vendor name:
"Motorola PCS, vendor-id: 22b8"
and it stands for
Motorola’s Personal Communications Sector

My guess is that it's something related to their old devices and the acronym just stayed as the vendor id.

I don't know what kind of mode the phone is going into, it looks similar to what you get using either ADB or connecting the phone to transfer file (MTP?).

I really have no idea how this mode could be useful to us, and if we just need to update udev rules to make it do something useful?

You said somewhere that the phone is detected on windows as Midi, but this makes me wonder if you had motorola driver installed?
Could it be just a special mode to use it with stuff like RSA or some proprietary software?

Surely it's not BROM if the usb vendor ID is motorola, but that doesn't exclude that it could be some proprietary flash mode, which wouldn't be useful anyway for what we want.

[progzone122]

It goes into PCS mode, but not into BROM mode

Update:
It looks like PCS is just part of the vendor name:
"Motorola PCS, vendor-id: 22b8"
and it stands for
Motorola’s Personal Communications Sector

My guess is that it's something related to their old devices and the acronym just stayed as the vendor id.

I don't know what kind of mode the phone is going into, it looks similar to what you get using either ADB or connecting the phone to transfer file (MTP?).

I really have no idea how this mode could be useful to us, and if we just need to update udev rules to make it do something useful?

You said somewhere that the phone is detected on windows as Midi, but this makes me wonder if you had motorola driver installed?
Could it be just a special mode to use it with stuff like RSA or some proprietary software?

Surely it's not BROM if the usb vendor ID is motorola, but that doesn't exclude that it could be some proprietary flash mode, which wouldn't be useful anyway for what we want.

It would be great if this mode could be used to flash partitions that are inaccessible to us, but we don’t know how...

[progzone122]

We are idiots. After taking another look at the circuit, I realized that the test point can also receive incoming voltage, just like the RX test point. I measured the voltage between KPCOL and ground and found that it was 1.2V!

It’s possible that since we are pulling it to GND, we are getting MIDI mode due to a logical 0? What if we apply a logical 1 instead? For example, 1.8V or 3.3V to the KPCOL0 test point?

I also looked at the diagrams of other Motorola phones and KPCOL0 - it is always "Download Mode"

[shomykohai]

It does? I remember seeing a resistor in the g24 not the g23

[progzone122]

[shomykohai]

Uh well, it's safer then, but I would still be careful if i were you in doing so if you wanted to try

[progzone122]

Uh well, it's safer then, but I would still be careful if i were you in doing so if you wanted to try

There are some Motorola models where BROM was activated by applying 1.9V voltage to KPCOL0. I'll think about it now.

[shomykohai]

Really? Didn't know that

[progzone122]

When KPCOL0 is shorted to GND, Fastboot opens!

[shomykohai]

There's an HIGH CHANCE we get brom using KPCOL0

Interesting

There's also the chance we might not have to press the power button, I saw another video of the Moto g22 not using power and going In brom anyway, maybe the USB cable in kinda emulates it.

Furthermore, in another video they connected the g22 to RSA without pressing any button, so I assume it went to preloader mode in that case.

If all these assumptions are true, the device must have brom, it can't be just all coincidences.

[progzone122]

There's an HIGH CHANCE we get brom using KPCOL0

Interesting

There's also the chance we might not have to press the power button, I saw another video of the Moto g22 not using power and going In brom anyway, maybe the USB cable in kinda emulates it.

Furthermore, in another video they connected the g22 to RSA without pressing any button, so I assume it went to preloader mode in that case.

If all these assumptions are true, the device must have brom, it can't be just all coincidences.

Does G22 have MTK BL or MOTO BL? It's important

[shomykohai]

I think it has moto bootloader, but this doesn't matter since this is something related to preloader not LK

[shomykohai]

Read here the section about the boot mode, where it talks about DOWNLOAD_BOOT

https://www.lieberbiber.de/2015/07/05/mediatek-details-little-kernel/

[shomykohai]

@progzone122 also read this article https://www.lieberbiber.de/2015/07/04/mediatek-details-partitions-and-preloader/

The emergency download mode is init by preloader that reboots back into brom!

This is a good thing actually, because we know that devices such as the g22 does indeed boot in preloader and not brom.

And again, our button combination is tricky to test, but it should send us to brom somehow

[progzone122]

@shomykohai Why are the antenna pads connected this way? Can this help us?

[shomykohai]

The little dot between the lines means they are indeed connected, but uh, why would they be connected to volume buttons??
Perhaps it's part of the test mode?

[progzone122]

[progzone122]

The little dot between the lines means they are indeed connected, but uh, why would they be connected to volume buttons?? Perhaps it's part of the test mode?

But they are connected BEFORE THE RESISTORS

[progzone122]

I am very interested in PWRKEY_SW

[shomykohai]

I really have no idea then, but could be something that might come handy to know surely

[progzone122]

I've reviewed the circuit a hundred times, and now I can confidently say — no BROM testpoints

[progzone122]

The only way they could have blocked it is by efuse

They could also do it at the hardware level

[shomykohai]

The only way they could have blocked it is by efuse

They could also do it at the hardware level

But that would be something they'd do to the chipset, and I think it's mediatek that decides this, while the preloader is up to the manufacturer, and we know that mt6768 can indeed go to brom

[progzone122]

The only way they could have blocked it is by efuse

They could also do it at the hardware level

But that would be something they'd do to the chipset, and I think it's mediatek that decides this, while the preloader is up to the manufacturer, and we know that mt6768 can indeed go to brom

They might have simply not created a test point for this. The only option I see now is shorting the test points near the flash memory—that will definitely work. If only it didn’t require removing the protective shields…

[shomykohai]

Maybe there's a way to remove them easily (like with a soldering iron) without having to break them..

[shomykohai]

If you actually do it though, don't try right away, we might want first to get a good picture of the test point to add to the documentation, and then double check if I marked them correctly

[progzone122]

Interesting video
https://youtu.be/NulWJo2RSKE?si=kiG88e-UkbshAeTz

[shomykohai]

@progzone122 are JTAG pins connected to the eMMC ones? In the schematic they don't appear, but maybe it's safer using them than the one near the eMMC since we're sure of the pinout.

Though the issue is still that you'd need to remove the shield..

[progzone122]

a move coming from Lenovo

Most likely yes, Motorola is owned by Lenovo.
And if you remember that they pour compound under the GPU and CPU chips in their laptops.....
So it's definitely not for security).

[shomykohai]

And if you remember that they pour compound under the GPU and CPU chips in their laptops.....

I wonder if this phone even has it, it almost looks like they underpowered the chip to not heat at all, the battery charging heats way more than the SoC

[progzone122]

You would have a good chance of removing the shield using an heat gun (making it possible to reattach too)

It's possible with a soldering iron too, but it would require to basically first put tin on the shield and spread it, and then increase the temperature to allow the tin to act as a thermoconductor to melt what holds the shield

Or just clip it, but you wouldn't be able to put it back..

I recently bought a hot air soldering station for soldering, but I’m still not very skilled with it. I’m worried about the SMD components under the protective shields :(((

Do we need to use a alloy rose metal?

[shomykohai]

I'm not sure about that, you'd have more luck finding other sources on removing these shields.

I only know they usually use heat guns, but it makes sense to worry about the components below, I imagine there's a specific technique

Maybe on YouTube you'll find something

[progzone122]

[cxzstuff]

G13 xt2331 testpoint?

https://t.me/edl_testpoints/1426

[shomykohai]

Here is some teardown pics for G13. Some covers removed... https://device.report/manual/8014846

Uh, I don't see em?

[cxzstuff]

The very first pdf file there. There is another, but it has fewer pages. Haven't compared. The 3rd is not about the board...

[shomykohai]

Ok found them, for some reason the page didn't want to load all the contents

Unfortunately, we don't have a good picture of the eMMC TP, though the JTAG ones are pretty visible here

This surely may come handy for further analysis! Thanks!

[shomykohai]

Wait no, we also have the eMMC TP it seems!!

So they're located in a different location??

I'll have to mark the TP on the documentation as not yet assessed

[shomykohai]

Alright, I was wrong, those are the audio tp.

I confirm the one you sent is the clk one, as marked in the documentation too.

[progzone122]

I booted into fastboot using testpoint and shorted it out a few times

https://drive.google.com/file/d/1Tq5C-HnZZDnHuXCnw-Q_p4-cpN9uLFIy/view?usp=sharing

P.S Damn GitHub doesn't want to upload the file for some reason

[progzone122]

Which one?

Idk, everything is mixed up there, you can't figure it out without a bottle of vodka.
Why can't you clear the old logs?

[shomykohai]

Maybe try dumping the logs from fastboot, you get the new logs here!

[progzone122]

Maybe try dumping the logs from fastboot, you get the new logs here!

Later, I already put the phone back together and went to bed.

[shomykohai]

I looked at the logs better, but I can't understand which one are the latest, because sometimes the RTC clock is set to 2010...

But at least I now know which is the beginning: when it says "Preloader start".

What TP did you short? KPCOL0? If so, then the logs marked as 2010 are the latest, and it means you could try using the button combo that might get us to brom!

[progzone122]

What TP did you short? KPCOL0?

Yeah, the other readily available testpoints don't do anything

[progzone122]

I tried to do the actions:

1. Short KPCOL0
2. Connect the usb
3. quickly hold VOL+
4. Stop shorting the testpoint and button

Nothing seems to have changed, but something interesting was found in the logs
Have you ever had this text detected, or have I in past logs?

[58844] mtk detect key function pmic_detect_homekey pressed

logs-10_01_2025-11:04:12.txt

[progzone122]

[progzone122]

@shomykohai

[shomykohai]

I'm not sure it was already there mmh, have you got new logs with "key 0 is pressed?" Last time it appeared 2 times.

Can you try shorting KPCOL0 and hold Vol+ before connecting the USB and keep them pressed until the pc detects it? If needed, hold power too.

Maybe if you put something to hold one of the buttons to free your hands it may be easier.

@progzone122

[shomykohai]

I tried to do the actions:

1. Short KPCOL0
2. Connect the usb
3. quickly hold VOL+
4. Stop shorting the testpoint and button

Nothing seems to have changed, but something interesting was found in the logs
Have you ever had this text detected, or have I in past logs?

[58844] mtk detect key function pmic_detect_homekey pressed

logs-10_01_2025-11:04:12.txt

This happened in fastboot, you probably pressed Vol+.

Maybe we're missing something, like that the dl keys check happens on certain conditions? Like the phone needs to be powered off completely and not reset? 🤔

[shomykohai]

What does fastboot log if you press the power button? both from the key and from test point?

[shomykohai]

@progzone122 You can try something else too, I've found out that brom is also called in another instance: If you crash preloader and it detects KPCOL0, it should go to brom.

Try crashing preloader with mtkclient and before tue crash happens, short KPCOL0 and see if the logs say either "BR cmd is disabled" or "Force brom recovery success" after PL Fatal Error

[shomykohai]

Preloader crash without it hanging can be achieved by using a wrong da file

[progzone122]

No, it doesn't work

[shomykohai]

Sad, maybe it needs to fail to read preloader in that part. Whatever, we'll try what we were testing before, the button combination.

[progzone122]

Sad, maybe it needs to fail to read preloader in that part. Whatever, we'll try what we were testing before, the button combination.

I tested some today, no luck so far...

[shomykohai]

@progzone122 I've tried myself all of this combinations, I didn't get brom, nothing.

Just this

PL fatal error...
key 0 is pressed
PL delay for Long Press Reboot
[PLFM] emergency download mode(timeout: 5s).

[shomykohai]

@progzone122 I almost were able to press all the keys

mtk_kpd_gpio_set Already! 
mtk detect key function pmic_detect_homekey MTK_PMIC_RST_KEY = 17
mtk detect key function pmic_detect_homekey pressed
key 0 is pressed

I just missed the power key, it's too hard to press ugh

[shomykohai]

Reading the logs, I can see that whatever I did, it's always the power key that's missing umh, maybe we still have a chance of going to brom if the reason we can't go is because we can't press all buttons.

Please check your logs to see what you get here

[shomykohai]

Could it be that in preloader the power key is assigned to another TP and when it goes to lk, it gets assigned to the actual key with the same ID?

[shomykohai]

I'm now 100% sure the download keys are pressed, because the dl keys check function calls mtk_kpd_gpio_set, which does an early return if the keys are already set, and prints "mtk_kpd_gpio_set Already!"

The problem as I said it's still the same though, it doesn't detect the power key for some reason..

I'm thinking if the reason is that in the preloader initialization this prints out:

"[PLFM] WDT reboot bypass power key!"

Maybe we need to press the powerkey after when the phone detects being powered? Is this why they say that the power must be powered off completely to enter brom? Maybe if we try disconnecting the battery it will be easier? 🤔

I tried that too but nothing printed out, but I also pressed the power key before connecting the USB.

@progzone122 when there's the chance to test this again, are you able to solder some physical big buttons to KPCOL0 and POWER TPs so it's way easier to press em? Or at least to the power button, because KPCOL0 is too important to risk ripping the pad.

[progzone122]

Which phones on Helio G85 have a known test point? No matter how much I search - there is no information, only preloader

[progzone122]

Power nyckel to ground

It's no different than a physical button

[shomykohai]

Power nyckel to ground

It's no different than a physical button

In the schematic it's wired differently, it bypasses a resistor iirc

[progzone122]

I don't know then, the only thing we can do is continue to investigate and ask on xda.

One can only hope that a vulnerability will be found.....

[progzone122]

Power nyckel to ground

It's no different than a physical button

In the schematic it's wired differently, it bypasses a resistor iirc

I've already put the phone back together and have no desire to take it apart again. Maybe later. I'm sick of it :(

[shomykohai]

No problem, we have time

[progzone122]

I've analyzed the schematics again and in a while I'll add to the documentation what else we can try for going to BROM!
This may seem risky, but it looks like it can be used to go to BROM or some other mode!

[progzone122]

Anyway, maybe we can ask on XDA

Let me finish this section in the documentation and we'll ask, ok?

[shomykohai]

@progzone122 are you able to test the new information you added? Now I understand you're idea better. I'd like to know if preloader registers this as key 8, and if you're able to turn on the phone without using either TP or actual power button

[progzone122]

@shomykohai Instead of capacitors, we can directly use resistors for all those lines!

@shomykohai

R3004 - HOMEKEY_SW R3002 - KPCOL1 R3003 - PWRKEY_SW

Turns out we don't have those capacitors, but we do have those resistors!
I will make a photo of the board in good quality, because you can't see anything on the ones we have!

[shomykohai]

@shomykohai Instead of capacitors, we can directly use resistors for all those lines!

@shomykohai
R3004 - HOMEKEY_SW R3002 - KPCOL1 R3003 - PWRKEY_SW

Turns out we don't have those capacitors, but we do have those resistors! I will make a photo of the board in good quality, because you can't see anything on the ones we have!

It shouldn't be a problem that we don't have the caps, until we have the contacts we can still use em

[progzone122]

Turns out we don't have those capacitors, but we do have those resistors! I will make a photo of the board in good quality, because you can't see anything on the ones we have!

It shouldn't be a problem that we don't have the caps, until we have the contacts we can still use em

Yes, the important thing is that we have resistors.

[progzone122]

Just looked at one of the Samsung telephones and it uses KPCOL0 to boot into the BROM...
Why do we boot to fastboot ?

[progzone122]

same problem
https://forum.gsmhosting.com/vbb/f826/finding-test-test-points-3085512/

[shomykohai]

I guess we can only hope for a preloader bug to crash into brom at this poimt

[shomykohai]

@progzone122, I'm speechless.

That samsung phone uses the same button combo to enter emergency download mode (0 + 8 + 17), but it doesn't actually calls the method to enter it:

This means that it goes into brom from somewhere else

[shomykohai]

That said, we can finally say that we don't need to test brom anymore with that combo, we'll just crash preloader using DA etc.., We shouldn't need to open the phone anymore if not for CLK or DAT0.

[shomykohai]

Maybe we could find an exploit in the preloader, and then inject a payload, but we would need help for someone who has experience in this field, like the people who contribute to mtkclient, and the people who made amonet and kamakiri

[progzone122]

Perhaps usb2jtag can help us somehow? Because on other phones this is not available without bootloader unlock
++ we have JTAG activated

[shomykohai]

I don't know if it could work, we have SWJTAG, they put protections there too

[progzone122]

KPCOL0 voltages

Only charging - 1.36V
Preloader - 1.7V
Fastboot - 1.5V

[cxzstuff]

Now we have to see if:

1. We can write lk
2. We can write seccfg

So., can you?

Unfortunately no :(

And that includes the SPFT too?

[shomykohai]

With spft we can only write official lk, not patched.

Seccfg cannot be written at all, even with spft

[cxzstuff]

Looks like a broken file, I'll fix it

Here is another. Half the size...
https://github.com/moto-penangf/penangf-sp-flash-tool/blob/main/DA_PL_NO_CERT_V6.bin

[progzone122]

Looks like a broken file, I'll fix it

Here is another. Half the size... https://github.com/moto-penangf/penangf-sp-flash-tool/blob/main/DA_PL_NO_CERT_V6.bin

Is it just me or are these two different DA's? Because it was copied from RSA and it is exactly not broken and works in flash tool.

[cxzstuff]

Looks like a broken file, I'll fix it

Here is another. Half the size... https://github.com/moto-penangf/penangf-sp-flash-tool/blob/main/DA_PL_NO_CERT_V6.bin

Is it just me or are these two different DA's? Because it was copied from RSA and it is exactly not broken and works in flash tool.

nvm.. my bad. Used save as too soon. So saved the download page, not raw... lol

[progzone122]

I think Motorola has actually disabled BROM mode in fuse. I've tried everything I can think of, but I'm not getting anything

[progzone122]

If you disconnect the cable that goes to the display and the bottom board - KPCOL0 is always 1.7V, but if you connect the cable back the voltage drops quickly to 1.3V and the phone turns on.

[progzone122]

Maybe it was because of mtk crash, because I used it too after I did the preloader crash or mtk brute.

diablo-pc :: ~/Desktop/fuckyoumoto » mtk crash
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

At that moment, when he gave out Hanshake failed, I was going through the combinations.

[progzone122]

During invalid da, I was also able to invoke the power key

[PLFM] USB cable in
[TOOL] USB enum timeout (Yes), handshake timeout(Yes)
[USBD] USB Full Speed
[TOOL] Enumeration(Start)
[USBD] USB High Speed
[USBD] USB High Speed
[PMIC]IsUsbCableIn 1
[PMIC]IsUsbCableIn 1
[TOOL] Enumeration(End): OK 3001ms 
[TOOL] 0xa0 sync time 0ms
[UDL] usbdl_verify_da: da_len (0x100) is less than sig_len (0x100)
[UDL] usbdl_send_da: clean invalid da
<ASSERT> /home/queen/buildspace/workspace/STC/STC_version_build_serial_nochecksum/android_build/code/S_base/vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6768/src/core/download.c:line 570 0
PL fatal error...
PL delay for Long Press Reboot
power key is pressed
power key is pressed
[PLFM] emergency download mode(timeout: 5s).
[RGU] mtk_arch_reset at pre-loader!
[RGU] disable pwrap before WDT
[RGU] mtk_wdt_reset WDT MODE=24

[progzone122]

Does it seem or do mtk brute and mtk crash work differently?

diablo-pc :: ~/Desktop/fuckyoumoto » mtk brute
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Main - Kamakiri / DA Bruteforce run
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


Port - Device detected :)
Preloader - Get Target info
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: Unknown: 0x1d18
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...........
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Port - Device detected :)
Preloader - Get Target info
Exploitation - Crashing da...
DeviceClass
DeviceClass - [LIB]: Device disconnected

diablo-pc :: ~/Desktop/fuckyoumoto 1 » mtk crash
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Port - Device detected :)
Preloader - 	CPU:			MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x707
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca00
Preloader - 	SW Ver:			0x0
Preloader - ME_ID:			ADEB7175657ABF96B22C843F6E28AD85
Preloader - SOC_ID:			061A757D042B2A378D9761E60C9D3FBCD82792A4F5AA27C029815B011269AB8A
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: Unknown: 0x1d18
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...........
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Port - Device detected :)
Preloader - 	CPU:			MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x707
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca00
Preloader - 	SW Ver:			0x0
Preloader - ME_ID:			ADEB7175657ABF96B22C843F6E28AD85
Preloader - SOC_ID:			061A757D042B2A378D9761E60C9D3FBCD82792A4F5AA27C029815B011269AB8A

[shomykohai]

During invalid da, I was also able to invoke the power key

[PLFM] USB cable in
[TOOL] USB enum timeout (Yes), handshake timeout(Yes)
[USBD] USB Full Speed
[TOOL] Enumeration(Start)
[USBD] USB High Speed
[USBD] USB High Speed
[PMIC]IsUsbCableIn 1
[PMIC]IsUsbCableIn 1
[TOOL] Enumeration(End): OK 3001ms 
[TOOL] 0xa0 sync time 0ms
[UDL] usbdl_verify_da: da_len (0x100) is less than sig_len (0x100)
[UDL] usbdl_send_da: clean invalid da
<ASSERT> /home/queen/buildspace/workspace/STC/STC_version_build_serial_nochecksum/android_build/code/S_base/vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6768/src/core/download.c:line 570 0
PL fatal error...
PL delay for Long Press Reboot
power key is pressed
power key is pressed
[PLFM] emergency download mode(timeout: 5s).
[RGU] mtk_arch_reset at pre-loader!
[RGU] disable pwrap before WDT
[RGU] mtk_wdt_reset WDT MODE=24

Mmh I think i know why we can get it here: there's a check for power key (PL delay for Long Press Reboot) that is a loop and checks for it being held.

We also know that the log for a key being detected only appears when the mtk_detect_key is called, hence why in fastboot and on boot we can get it to print out.

We need to see if you can get it during boot too when it checks for download keys

[shomykohai]

Does it seem or do mtk brute and mtk crash work differently?

diablo-pc :: ~/Desktop/fuckyoumoto » mtk brute
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Main - Kamakiri / DA Bruteforce run
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


Port - Device detected :)
Preloader - Get Target info
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: Unknown: 0x1d18
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...........
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Port - Device detected :)
Preloader - Get Target info
Exploitation - Crashing da...
DeviceClass
DeviceClass - [LIB]: Device disconnected

diablo-pc :: ~/Desktop/fuckyoumoto 1 » mtk crash
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Port - Device detected :)
Preloader - 	CPU:			MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x707
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca00
Preloader - 	SW Ver:			0x0
Preloader - ME_ID:			ADEB7175657ABF96B22C843F6E28AD85
Preloader - SOC_ID:			061A757D042B2A378D9761E60C9D3FBCD82792A4F5AA27C029815B011269AB8A
Mtk - We're not in bootrom, trying to crash da...
Exploitation - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: Unknown: 0x1d18
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...........
Preloader
Preloader - [LIB]: Status: Handshake failed, retrying...
Port - Device detected :)
Preloader - 	CPU:			MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x707
Preloader - Target config:		0x5
Preloader - 	SBC enabled:		True
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		True
Preloader - 	SWJTAG enabled:		True
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca00
Preloader - 	SW Ver:			0x0
Preloader - ME_ID:			ADEB7175657ABF96B22C843F6E28AD85
Preloader - SOC_ID:			061A757D042B2A378D9761E60C9D3FBCD82792A4F5AA27C029815B011269AB8A

I think so, I'm not sure but iirc crash is for, well, crash to brom, while brute is for dumping brom on unknown chipsets, but in our case it crashes preloader too

[shomykohai]

@progzone122 we need a better picture of the back of the motherboard, especially the JTAG and eMMC TPs. Are you able to get them? Or maybe even @R0rt1z2 can, I saw they joined so I guess you two have a plan to test stuff like TPs or UART (Assumptions that come from the blog post about fire tablet)

It's important to get them before hand as we're unsure about the test points locations right now, so it's less of a risk of frying the eMMC.

[progzone122]

Go to our Telegram group

[shomykohai]

Go to our Telegram group

I can't join unfortunately for other reasons, but I'm able to read the chat and saw what y'all said.

If we get UART working too, we need to add it to the documentation.

Also, as I imagined, the plan is to use test testpoints too, but we need to get them right first to avoid damage.

[shomykohai]

BROM is blocked by efuse.
Making this just to mark an answer on the thread.