How to read firmware without DA and sSLA?

[NEOCRIVI]

Hi Team,

How to read fw in new phones?

I make backup data:

Operation : Identify [ v2.21 ]
Mode : FLASH

1. Make sure device is powered off. Power off, if need. Wait 20 seconds after
2. Insert USB cable in phone
Waiting for device connection ...

PTFN : MediaTek USB Port_V1632 (COM28)
MODE : BOOTROM
PORT : 28
Waiting BOOT ack ...
BROM : Skip ACK verify
BROM : Init BROM
BROM init passed!
CHIP : MT6765 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000
CODE : Cervino
TYPE : MODERN RAPHAEL
BROM : MEID : 8DDFA5BA33E8758FFF37070FFB3501CB
BROM : SecLevel : 0x000000E7
BROM : SecMode : SBC+SLA+SDA+EXT
BROM : BROM|BL : 0x05|0xFE
BROM : BOOTROM
MODE : 0_base : BASE_v2044 | Manual : Disabled
BROM : SOCID : 2842AC993B2BDC30E1EBD7FCA015AC8B8B0BBF32D445049AA3 417BB36D7EF910
BROM : SLA : Local Auth
BROM : SLA : Auth Started!
BROM : SLA : Auth Passed!
BROM : SLA : 0x0000001F
AGENT : Look for suitable BootChain in DA ...
AGENT : MTK_AllInOne_DA.bin
AGENT : Found MT6765
AGENT : MTK_DOWNLOAD_AGENT
BROM : Sending 1st DA ...
BROM : DA sent
BROM :Transfer control to DA ...
DA : AGENT started!
DA : SYNC
DA : MODE : BROM
DA : EXT_RAM NOT initialized!
EMI : DEV : INFINITY
EMI : SRC : PRELOADER_INFINITY_0
EMI : CNT : 0001
EMI : Init EMI from INTERNAL DB
EMI : EXT_RAM CFG Passed!
DA : BOOT to 2nd DA ...
DA : 2ND stage confirmed!
DA : SYNC with DA passed!
DA : Receiving HW info

SRAM: 0x0003A000 [ 232,00 KB ]
DRAM: 0x100000000 [ 4,00 GB ]

EMMC: 150100445636444D420296EBCC38B7DF
EMMC: VEN : SAMSUNG | OEM : 01 | DEV : DV6DMB
EMMC:
BOOT1 : 0x00400000 [ 4,00 MB ]
BOOT2 : 0x00400000 [ 4,00 MB ]
RPMB : 0x01000000 [ 16,00 MB ]
USER : 0x1D1EC00000 [ 116,48 GB ]

CHIP : MT6765 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000 , EVOL : 0x0000

RNID : DEB832952CF3593329AE3D0627BBA2AC

DA : USB : HIGH-SPEED

Boot done!

Patch Level : QP1A.190711.020
Display ID : QP1A.190711.020 release-keys
Ver. CodeName : REL
Ver. Release : 10
Sec. Patch : 2020-11-05
Build Time : 24.11.2020
Product Board : MT6765
Board Platform : mt6765

USERDATA : FILESYSTEM : F2FS with FBE ( File-Base Encryption )

NVRAM check : Passed!
NVRAM : SEC NORMAL [ No extra security ]

Backup sensetive data [ 15 ]
Backup path : Backup\MT6765__DEB832952CF3593329AE3D0627BBA2AC\
Backup done!


STORAGE : LifeStatus : eMMC : OK!

Done!
Elapsed: 00:00:21

But read fw not work:

Operation : Read Firmware [ v2.21 ]

ExtSparse : Enabled
ForceRead : Disabled

1. Make sure device is powered off. Power off, if need. Wait 20 seconds after
2. Insert USB cable in phone
Waiting for device connection ...

PTFN : MediaTek USB Port_V1632 (COM28)
MODE : BOOTROM
PORT : 28
Waiting BOOT ack ...
BROM : Skip ACK verify
BROM : Init BROM
BROM init passed!
CHIP : MT6765 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000
CODE : Cervino
TYPE : MODERN RAPHAEL
BROM : MEID : 8DDFA5BA33E8758FFF37070FFB3501CB
BROM : SecLevel : 0x000000E7
BROM : SecMode : SBC+SLA+SDA+EXT
BROM : BROM|BL : 0x05|0xFE
BROM : BOOTROM
MODE : 0_base : BASE_v2044 | Manual : Disabled
BROM : SOCID : 2842AC993B2BDC30E1EBD7FCA015AC8B8B0BBF32D445049AA3 417BB36D7EF910
BROM : SLA : Local Auth
BROM : SLA : Auth Started!
BROM : SLA : Auth Passed!
BROM : SLA : 0x0000001F
AGENT : Look for suitable BootChain in DA ...
AGENT : MTK_AllInOne_DA.bin
AGENT : Found MT6765
AGENT : MTK_DOWNLOAD_AGENT
BROM : Sending 1st DA ...
BROM : DA sent
BROM :Transfer control to DA ...
DA : AGENT started!
DA : SYNC
DA : MODE : BROM
DA : EXT_RAM NOT initialized!
EMI : DEV : INFINITY
EMI : SRC : PRELOADER_INFINITY_0
EMI : CNT : 0001
EMI : Init EMI from INTERNAL DB
EMI : EXT_RAM CFG Passed!
DA : BOOT to 2nd DA ...
DA : 2ND stage confirmed!
DA : SYNC with DA passed!
DA : Receiving HW info

SRAM: 0x0003A000 [ 232,00 KB ]
DRAM: 0x100000000 [ 4,00 GB ]

EMMC: 150100445636444D420296EBCC38B7DF
EMMC: VEN : SAMSUNG | OEM : 01 | DEV : DV6DMB
EMMC:
BOOT1 : 0x00400000 [ 4,00 MB ]
BOOT2 : 0x00400000 [ 4,00 MB ]
RPMB : 0x01000000 [ 16,00 MB ]
USER : 0x1D1EC00000 [ 116,48 GB ]

CHIP : MT6765 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000 , EVOL : 0x0000

RNID : DEB832952CF3593329AE3D0627BBA2AC

DA : USB : HIGH-SPEED

Boot done!

Patch Level : QP1A.190711.020
Display ID : QP1A.190711.020 release-keys
Ver. CodeName : REL
Ver. Release : 10
Sec. Patch : 2020-11-05
Build Time : 24.11.2020
Product Board : MT6765
Board Platform : mt6765

MT6765__10__QP1A.190711.020

Unsupport : 0x0000000003000000 : 0x0000000002000000 : recovery2


Error : Device NOT supported for SAFE READ!
>>> Send log and report.log (if exists) to support! Include device info also!

Reconnect Power/Cable!

I try make hw report:

Operation : HW Report [ v2.21 ]
HWreport : Mode : eMMC
1. Make sure device is powered off. Power off, if need. Wait 20 seconds after
2. Insert USB cable in phone
Waiting for device connection ...

PTFN : MediaTek USB Port_V1632 (COM28)
MODE : BOOTROM
PORT : 28
Waiting BOOT ack ...
BROM : Skip ACK verify
BROM : Init BROM
BROM init passed!
CHIP : MT6765 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000
CODE : Cervino
TYPE : MODERN RAPHAEL
BROM : MEID : 8DDFA5BA33E8758FFF37070FFB3501CB
BROM : SecLevel : 0x000000E7
BROM : SecMode : SBC+SLA+SDA+EXT
BROM : BROM|BL : 0x05|0xFE
BROM : BOOTROM
MODE : 0_base : BASE_v2044 | Manual : Disabled
BROM : SOCID : 2842AC993B2BDC30E1EBD7FCA015AC8B8B0BBF32D445049AA3 417BB36D7EF910
BROM : SLA : Local Auth
BROM : SLA : Auth Started!
BROM : SLA : Auth Passed!
BROM : SLA : 0x0000001F
AGENT : Look for suitable BootChain in DA ...
AGENT : MTK_AllInOne_DA.bin
AGENT : Found MT6765
AGENT : MTK_DOWNLOAD_AGENT
BROM : Sending 1st DA ...
BROM : DA sent
BROM :Transfer control to DA ...
DA : AGENT started!
DA : SYNC
DA : MODE : BROM
DA : EXT_RAM NOT initialized!
EMI : DEV : INFINITY
EMI : SRC : PRELOADER_INFINITY_0
EMI : CNT : 0001
EMI : Init EMI from INTERNAL DB
EMI : EXT_RAM CFG Passed!
DA : BOOT to 2nd DA ...
DA : 2ND stage confirmed!
DA : SYNC with DA passed!
DA : Receiving HW info

SRAM: 0x0003A000 [ 232,00 KB ]
DRAM: 0x100000000 [ 4,00 GB ]

EMMC: 150100445636444D420296EBCC38B7DF
EMMC: VEN : SAMSUNG | OEM : 01 | DEV : DV6DMB
EMMC:
BOOT1 : 0x00400000 [ 4,00 MB ]
BOOT2 : 0x00400000 [ 4,00 MB ]
RPMB : 0x01000000 [ 16,00 MB ]
USER : 0x1D1EC00000 [ 116,48 GB ]

CHIP : MT6765 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000 , EVOL : 0x0000

RNID : DEB832952CF3593329AE3D0627BBA2AC

DA : USB : HIGH-SPEED

Boot done!

Memory Info :
CID : 150100445636444D420296EBCC38B7DF
MEM : VEN : SAMSUNG | OEM : 01 | DEV : DV6DMB
DAT : Size: 119276 MB, Max.Speed: 52000 kHz, blklen(512), nblks(244277248), ro(0)

EXT_CSD Info :
EXT_CSD rev. : v1.8 ( MMC v5.1 )
CSD struct rev. : v1.2
Supported command sets : 1h
HPI features : 1h
BG operations support : 1h
BG operations status : 0h
Correct prg. sectors : 0h
1st init time after part. : 3000 ms
Min. write perf.(DDR,52MH,8b): 0h
Min. read perf. (DDR,52MH,8b): 0h
TRIM timeout: 0 ms
Secure feature support: 55h
Secure erase timeout : 8100 ms
Secure trim timeout : 5100 ms
Access size : 3584 bytes
HC erase unit size : 512 kbytes
HC erase timeout : 300 ms
HC write prot grp size: 8192 kbytes
HC erase grp def. : 0h
Reliable write sect count: 1h
Sleep current (VCC) : 7h
Sleep current (VCCQ): 7h
Sleep/awake timeout : 26214400 ns
Sector count : e8f6000h
Min. WR Perf. (52MH,8b): 0h
Min. Read Perf.(52MH,8b): 0h
Min. WR Perf. (26MH,8b,52MH,4b): 0h
Min. Read Perf.(26MH,8b,52MH,4b): 0h
Min. WR Perf. (26MH,4b): 0h
Min. Read Perf.(26MH,4b): 0h
Power class: 0
Power class(DDR,52MH,3.6V): 0h
Power class(DDR,52MH,1.9V): 0h
Power class(26MH,3.6V) : 0h
Power class(52MH,3.6V) : 0h
Power class(26MH,1.9V) : 0h
Power class(52MH,1.9V) : 0h
Part. switch timing : 2h
Out-of-INTR busy timing: ah
Card type : 57h
Command set : 0h
Command set rev.: 0h
HS timing : 0h
Bus width : 0h
Erase memory content : 0h
Partition config : 48h
Boot partition size : 4096 kbytes
Boot information : 7h
Boot config protection: 0h
Boot bus width : 2h
Boot area write prot : 0h
User area write prot : 0h
FW configuration : 0h
RPMB size : 16384 kbytes
Write rel. setting : 1fh
Write rel. parameter: 14h
Start background ops : 0h
Enable background ops: 2h
H/W reset function : 1h
HPI management : 0h
Max. enhanced area size : 1369h (40706048 kbytes)
Part. support : 7h
Part. attribute: 0h
Part. setting : 0h
General purpose 1 size : 0h (0 kbytes)
General purpose 2 size : 0h (0 kbytes)
General purpose 3 size : 0h (0 kbytes)
General purpose 4 size : 0h (0 kbytes)
Enh. user area size : 0h (0 kbytes)
Enh. user area start: 0h
Bad block mgmt mode: 0h

Overall status :

MLC status : 0% - 10% used
SLC status : 0% - 10% used
EOL status : Normal ( Less than 80% reserved blocks used )


RPMB : RPMB KEY EXISTS! [State : NOT CLEAN : UNUSABLE]


Done!
Elapsed: 00:00:24

Any way for read fw?

BR

[YellowBoss]

Unsupport : 0x0000000003000000 : 0x0000000002000000 : recovery2


Error : Device NOT supported for SAFE READ!
>>> Send log and report.log (if exists) to support! Include device info also!

It may be damaged or unsupported yet device.
What is the device name ?
What is the phone state, is it working phone or damaged one ?

[NEOCRIVI]

Is a new sealed TCL 10SE, working phone.

BR

[YellowBoss]

Originally Posted by NEOCRIVI

Is a new sealed TCL 10SE, working phone.

BR

in this case it may be some kind of hardware unsupported by selected DA (base)

[NEOCRIVI]

Any ways for read DA in unsupported phones?

The program make backup with preloader and other files.

BR

[JayDi]

Originally Posted by NEOCRIVI

Any ways for read DA in unsupported phones?

The program make backup with preloader and other files.

BR

Please, send security backup for check. Also would be great to read with MEMTOOL :

PGPT
BOOT
RECOVERY

RECOVERY2


in addition to backup.