Boot to META via mtkclient?

[progzone122]

Looks like we can boot into META without the Android utility!
This is very good! This way we can avoid the proprietary utility (which doesn't work at all now) and can get more functionality via mtkclient!

[progzone122]

@shomykohai What do you think about that?

[progzone122]

[progzone122]

How to load it from the preloader to the VCOM preloader 🤔

[progzone122]

WTF

[progzone122]

@shomykohai

I was actually able to use META to boot into fastboot!
Is it possible that somehow META can be used to boot into BROM?

[progzone122]

But there is a chance of that because META mode has been mentioned many times in different files.

[shomykohai]

I don't know mmh, maybe you can find something in modem tool: https://androidmtk.com/use-modem-meta-tool

[cxzstuff]

I was actually able to use META to boot into fastboot!

On G24 from meta to adb...
https://hostingunlock.com/threads/moto-g-24-voy-a-intentar-algo-lo-ponen-en-meta-con-vol-y.77988/

Now tested and above didn't work. I think I've previously managed somehow to do the same while playing with buttons. But like those noises, it hasn't happen since. Though I've not really tried much. Wondering if it just that the screen stays black while it boots normally into the system... ??

[progzone122]

I was actually able to use META to boot into fastboot!

On G24 from meta to adb...

https://hostingunlock.com/threads/moto-g-24-voy-a-intentar-algo-lo-ponen-en-meta-con-vol-y.77988/

Now tested and above didn't work. I think I've previously managed somehow to do the same while playing with buttons. But like those noises, it hasn't happen since. Though I've not really tried much. Wondering if it just that the screen stays black while it boots normally into the system... ??

Here it is boot only through Android Utilitty

[progzone122]

I think I almost entered it into META, there was a highlight on a black screen for a second, almost the same as before.
It's such a masochism to enter it into META, as if you were using a vulnerability in their shitty code to do so.

[shomykohai]

If you actually manage to enter meta from mtkclient it will be very good.
I already knew you could with mtkclient but I was never able to succeed (Imagine that I have hard times entering meta with android utility too).

In my folder I had a script I found on gist to enter meta without mtkclient (I wasn't able to make it work tho), it's quite easy actually, you just need to handshake with preloader and usb_write "METAMETA"

There are other options too, like ADVMETA, FASTBOOT, FACTORY and some more iirc

[progzone122]

@shomykohai STOP! sla_keys Moto G13???

[progzone122]

[progzone122]

Bypass SLA:

The device requests a signature, and a tool like MTKClient uses the public key and attempts to generate or replace the signature.

This may involve interacting with Security Boot mode.

Dummy Auth:

The tool bypasses the entire verification process. For example, the vulnerability allows you to directly load a custom DA or execute commands ignoring authorization.

[progzone122]

Bypass SLA:

The device requests a signature, and a tool like MTKClient uses the public key and attempts to generate or replace the signature.

This may involve interacting with Security Boot mode.

Dummy Auth:

The tool bypasses the entire verification process. For example, the vulnerability allows you to directly load a custom DA or execute commands ignoring authorization.

But we can't upload custom DA!

[shomykohai]

That's because we still have DAA and SBC unfortunately!

[progzone122]

That's because we still have DAA and SBC unfortunately!

yes...

[progzone122]

@shomykohai @cxzstuff

2025-01-15.02-21-26.mp4

[progzone122]

We can send more commands while these lines are appearing. Perhaps we need to send some commands to get into META?

[shomykohai]

Makes sense! To boot to meta usually the host has to handshake with the PL, then send "METAMETA" and wait for the device response of "ATEMATEM", and then send a reboot command to the phone I think