Preloader serial commands

[progzone122]

We can now use the mtkbootcmd.py script to send serial commands to preloader.
For example, in this way we can reboot into fastboot:

python mtkbootcmd.py FASTBOOT

Can there be other modes?

[progzone122]

@shomykohai

[progzone122]

First of all try entering all the modes we can find in mtkclient, to see how they act on our device

they don't work

[shomykohai]

Here a list of meta modes
https://github.com/l33tnoob/MT65x2_kernel_lk/blob/master/mediatek/platform/mt6572/preloader/src/core/inc/meta.h

I was able to use boot ADVMETA one time with android utility, I think at least, because it wasn't neither fastboot, brom or preloader, but it wasn't meta neither, it was detected as GDC Gadget

[progzone122]

I was able to use boot ADVMETA one time with android utility

I failed with mtkclient, I'll try my script

[shomykohai]

on legacy devices there's a DOWNLOAD string too, but we use xflash https://github.com/l33tnoob/MT65x2_kernel_lk/blob/master/mediatek/platform/mt6572/preloader/src/core/inc/download_legacy.h

[progzone122]

on legacy devices there's a DOWNLOAD string too, but we use xflash https://github.com/l33tnoob/MT65x2_kernel_lk/blob/master/mediatek/platform/mt6572/preloader/src/core/inc/download_legacy.h

At least we can try it all

[progzone122]

Unfortunately, it doesn't boot to BROM :(

 python mtkbootcmd.py BOOTROM

[progzone122]

If we try to boot into METAMETA we will get a Preloader bootloop for 10 seconds and then it will boot into the system

[progzone122]

Interesting...

diablo-pc :: ~/Desktop/fuckyoumoto » python mtkbootcmd.py METAMETA
Listening for ports!
Found /dev/ttyACM0 with description: MT65xx Preloader - CDC ACM Communication Interface
HWID: USB VID:PID=0E8D:2000 LOCATION=5-1:1.0
PORT: /dev/ttyACM0
Initializing port: /dev/ttyACM0
b'METAMETA' cmd sent
diablo-pc :: ~/Desktop/fuckyoumoto » python mtkbootcmd.py ADVMETA 
Listening for ports!
Found /dev/ttyACM0 with description: MT65xx Preloader - CDC ACM Communication Interface
HWID: USB VID:PID=0E8D:2000 LOCATION=5-1:1.0
PORT: /dev/ttyACM0
Initializing port: /dev/ttyACM0
Error: b'ATEM0'

[shomykohai]

You might want to open an issue on mtkclient, too

Do we know what ATEMO response is?

[progzone122]

Maybe he's trying to respond with ATEMATEM, but due to a timeout he can't make it?

diablo-pc :: ~/Desktop/fuckyoumoto 2 » python mtkbootcmd.py METAMETA
Listening for ports!
Found /dev/ttyACM0 with description: MT65xx Preloader - CDC ACM Communication Interface
HWID: USB VID:PID=0E8D:2000 LOCATION=5-1:1.0
PORT: /dev/ttyACM0
Initializing port: /dev/ttyACM0
b'METAMETA' cmd sent
diablo-pc :: ~/Desktop/fuckyoumoto » python mtkbootcmd.py ADVMETA
Listening for ports!
Found /dev/ttyACM0 with description: MT65xx Preloader - CDC ACM Communication Interface
HWID: USB VID:PID=0E8D:2000 LOCATION=5-1:1.0
PORT: /dev/ttyACM0
Initializing port: /dev/ttyACM0
Error: b'ATEM0'
diablo-pc :: ~/Desktop/fuckyoumoto 2 » python mtkbootcmd.py ADVMETA
Listening for ports!
Found /dev/ttyACM0 with description: MT65xx Preloader - CDC ACM Communication Interface
HWID: USB VID:PID=0E8D:2000 LOCATION=5-1:1.0
PORT: /dev/ttyACM0
Initializing port: /dev/ttyACM0
Error: b'ATEMA'

[shomykohai]

Did the output change??

You could be right... check the logs, you might find something, I remember seeing meta in mine, or at least "Boot mode"

[progzone122]

Did the output change??

You could be right... check the logs, you might find something, I remember seeing meta in mine, or at least "Boot mode"

You can try changing the array and check if META will load

[shomykohai]

Are you checking for the response from the phone to actually go into meta? Look at the preloader src to see how it except the host to respond.

Maybe that's why it bootloops, it could be waiting for response