chaosmaster / bypass_payloads Goto Github PK

Hi,

I see the binary exists, can you upload the source too for this chip?

Thanks.

Please add them.
MT6595
MT6753
MT6885
MT6779

Please add MT6891/MT6893

Hello,
Pleas add MT6789/MT1208

I offer a financial reward, according to the agreement.

brom dump here
https://github.com/CoolDUp/MTK-brom-dump/blob/main/mt6853.dat

Seems wrong address or different BROM versions:
MT6572
int (cmd_handler)() = (void)0x4002f7; >> 0x40C5AF
MT6768
int (cmd_handler)() = (void)0xcec5; >> 0xCF15
MT6785
int (cmd_handler)() = (void)0xefd9; >> 0xF029
After these patch all works fine, Tested on Xiaomi phones.

Here is dump of my BROM's:
https://drive.google.com/file/d/1dIGr2Ndbzhj_7YpPdHUtzYBzCuwr7FlD/view?usp=sharing

Plz i really need that ... Can u help me ?

Thanks for providing the payload source for mt8167, hopefully confirmed that I am not going crazy.

function offsets match up with my bootrom but not sure about sec_reg ?

int is_daa_passed(void)

{
  if (*(int *)(skip_auth + 0xc) != 0) {
    return *(undefined4 *)(skip_auth + 0x14);
  }
  return 0;
}

skip_auth + 0xc = 0x7d34 which is a pointer to 0x10c54 (0x02000000)
skip_auth + 0x14 = 0x7d3c which is a pointer to 0x118b8 (0x64651000) (Pointer to 0x106564?)

Also (possibly because it's 01:30) I'm having a little trouble understanding:

    else if (mode==1)
    {
        fusebuffer[SEC_OFFSET/4] = 0x700; // 1026D4+0x40, << 0x1e < 0x0 (DAA),  & << 0x1f !=0 (SLA), << 0x1c < 0x0 (SBC)
        *((volatile uint32_t *)(SEC_REG + 2)) = 0xB;
        *SEC_REG2 = (volatile uint32_t *)&fusebuffer; // 1026D4, !=0 (SLA, SBC)
        *SEC_REG = (volatile uint32_t *)&fusebuffer; // 1026D4, !=0 (SLA, SBC)
    }

SEC_OFFSET/4 why?
SEC_REG+2 = 0xb why ?

Thanks