├── amlogic ├── amlogic.s905d2.bootrom.bin ├── amlogic.s905d3.bootrom.bin ├── amlogic.s905d3g.bootrom.bin ├── amlogic.s905x.bin ├── amlogic.s905x2.bootrom.bin ├── amlogic.s905x3.bootrom.bin ├── amlogic.s905z.bootrom.bin ├── amlogic.s922x.rev_C.bootrom.bin └── amlogic.s922z.rev_B.bootrom.bin ├── espressif ├── esp32-v3-rom.bin ├── esp32-v3-rom.sym ├── esp32c2-rom.bin ├── esp32c2-rom.sym ├── esp32c3-rom.bin ├── esp32c3-rom.sym ├── esp32c6-rom.bin ├── esp32c6-rom.sym ├── esp32h2-rom.bin ├── esp32h2-rom.sym ├── esp32p4-rom-preview.bin ├── esp32p4-rom-preview.sym ├── esp32s2-rom.bin ├── esp32s2-rom.sym ├── esp32s3-rom.bin └── esp32s3-rom.sym ├── hisilicon ├── hi3516dv300.bootrom.bin ├── hi3521av100.bootrom.bin ├── hi3535v100.bootrom.bin └── hi3536dv100.bootrom.bin ├── mediatek ├── MT6573V 1209-BCAH CKHC6P │ ├── README.md │ ├── dump-1.bin │ ├── dump-2.bin │ └── dump-3.bin ├── MT6577A 1330-CMAH DTPRV616 │ ├── README.md │ ├── dump-1.bin │ ├── dump-2.bin │ └── dump-3.bin ├── MT6582V 1421-XAHHHH CTT9P090 │ ├── README.md │ ├── dump-1.bin │ ├── dump-2.bin │ └── dump-3.bin ├── MT6582V 1609-XAHHHH CTTGS141 │ ├── README.md │ ├── dump-1.bin │ ├── dump-2.bin │ └── dump-3.bin ├── MT6589WTK 1325-ATAH DTNGT126 │ ├── README.md │ ├── dump-1.bin │ ├── dump-2.bin │ ├── dump-3.bin │ └── usbdl.jpg ├── MT8317ATA 1245-CMAH DTPMY342 │ ├── README.md │ ├── dump-1.bin │ ├── dump-2.bin │ └── dump-3.bin ├── MT8382V 1521-XAHHAH CTTBA531 │ ├── README.md │ ├── dump-1.bin │ ├── dump-2.bin │ └── dump-3.bin ├── mt6572.bootrom.bin ├── mt6580.bootrom.bin ├── mt6589.bootrom.bin ├── mt6750.bootrom.bin ├── mt6753.bootrom.bin ├── mt6765.bootrom.bin ├── mt6768.bootrom.bin ├── mt6771.bootrom.bin ├── mt8163.bootrom.bin ├── mt8167.bootrom.bin ├── mt8173.bootrom.bin ├── mt8186.bootrom.bin ├── mt8382v.bootrom.bin ├── mt8735v.bootrom.bin └── mt8735w.bootrom.bin ├── qualcomm └── qsd8650.bootrom.bin ├── rockchip ├── rk3288.bootrom.bin └── rk3399.bootrom.bin ├── sunxi └── sunxi-s3.bootrom.bin └── ti ├── am335x.bootrom.bin ├── imx6d.bootrom.bin └── imx8mq.bootrom.bin /amlogic/amlogic.s905d2.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s905d2.bootrom.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s905d3.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s905d3.bootrom.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s905d3g.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s905d3g.bootrom.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s905x.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s905x.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s905x2.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s905x2.bootrom.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s905x3.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s905x3.bootrom.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s905z.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s905z.bootrom.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s922x.rev_C.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s922x.rev_C.bootrom.bin -------------------------------------------------------------------------------- /amlogic/amlogic.s922z.rev_B.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/amlogic/amlogic.s922z.rev_B.bootrom.bin -------------------------------------------------------------------------------- /espressif/esp32-v3-rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32-v3-rom.bin -------------------------------------------------------------------------------- /espressif/esp32-v3-rom.sym: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32-v3-rom.sym -------------------------------------------------------------------------------- /espressif/esp32c2-rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32c2-rom.bin -------------------------------------------------------------------------------- /espressif/esp32c2-rom.sym: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32c2-rom.sym -------------------------------------------------------------------------------- /espressif/esp32c3-rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32c3-rom.bin -------------------------------------------------------------------------------- /espressif/esp32c3-rom.sym: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32c3-rom.sym -------------------------------------------------------------------------------- /espressif/esp32c6-rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32c6-rom.bin -------------------------------------------------------------------------------- /espressif/esp32c6-rom.sym: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32c6-rom.sym -------------------------------------------------------------------------------- /espressif/esp32h2-rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32h2-rom.bin -------------------------------------------------------------------------------- /espressif/esp32h2-rom.sym: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32h2-rom.sym -------------------------------------------------------------------------------- /espressif/esp32p4-rom-preview.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32p4-rom-preview.bin -------------------------------------------------------------------------------- /espressif/esp32p4-rom-preview.sym: -------------------------------------------------------------------------------- 1 | WOKWISYM -------------------------------------------------------------------------------- /espressif/esp32s2-rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32s2-rom.bin -------------------------------------------------------------------------------- /espressif/esp32s2-rom.sym: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32s2-rom.sym -------------------------------------------------------------------------------- /espressif/esp32s3-rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32s3-rom.bin -------------------------------------------------------------------------------- /espressif/esp32s3-rom.sym: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/espressif/esp32s3-rom.sym -------------------------------------------------------------------------------- /hisilicon/hi3516dv300.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/hisilicon/hi3516dv300.bootrom.bin -------------------------------------------------------------------------------- /hisilicon/hi3521av100.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/hisilicon/hi3521av100.bootrom.bin -------------------------------------------------------------------------------- /hisilicon/hi3535v100.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/hisilicon/hi3535v100.bootrom.bin -------------------------------------------------------------------------------- /hisilicon/hi3536dv100.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/hisilicon/hi3536dv100.bootrom.bin -------------------------------------------------------------------------------- /mediatek/MT6573V 1209-BCAH CKHC6P/README.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | | key | value | 3 | |---------------|------------------------------------------------------------------------------------------------------------------------------------------| 4 | | SoC | MT6573V 1209-BCAH CKHC6P | 5 | | Device | Highscreen Yummy Duo | 6 | | Software used | [brom-dump (spft-replay, payloads)](https://github.com/arzam16/empty-sixty-five), commit 06f9214db6f735a838ad030e6236319ba2a2e44b | 7 | 8 | # Regions 9 | | File name | Name | Memory address | 10 | |------------|------|----------------| 11 | | dump-1.bin | BROM | 0x48000000 | 12 | | dump-2.bin | SRAM | 0x40000000 | 13 | | dump-3.bin | DA | 0x90005000 | 14 | 15 | # Device ID 16 | ``` 17 | $ ./spft-replay.py -i 18 | [2023-12-09 02:47:11,510] Init backend 19 | [2023-12-09 02:47:11,519] Waiting for device in BROM mode (0E8D:0003) 20 | [2023-12-09 02:47:20,542] Found device 21 | [2023-12-09 02:47:20,547] USB transport has successfully started! Waiting for further commands... 22 | [2023-12-09 02:47:20,550] Handshake completed! 23 | [2023-12-09 02:47:20,551] HW code: 6573 24 | [2023-12-09 02:47:20,554] HW version: CA10 25 | [2023-12-09 02:47:20,554] SW version: CA01 26 | [2023-12-09 02:47:20,555] BROM version: 05 27 | [2023-12-09 02:47:20,556] ME ID: 24B06916DCD1670AF5C4CE6649F081A6 28 | [2023-12-09 02:47:20,557] Raw target config value: 00000000 29 | [2023-12-09 02:47:20,558] Secure boot: NO 30 | [2023-12-09 02:47:20,558] Serial link auth: NO 31 | [2023-12-09 02:47:20,558] Download agent auth: NO 32 | [2023-12-09 02:47:20,559] Stopping transport 33 | [2023-12-09 02:47:22,512] USB transport has stopped! 34 | ``` 35 | 36 | # Dump log 37 | ``` 38 | $ ./spft-replay.py -p ../payloads/build/release/piggyback/mt6577-usb-dump.bin -pr 39 | [2023-12-09 02:48:28,474] Init backend 40 | [2023-12-09 02:48:28,481] Waiting for device in BROM mode (0E8D:0003) 41 | [2023-12-09 02:48:51,096] Found device 42 | [2023-12-09 02:48:51,100] USB transport has successfully started! Waiting for further commands... 43 | [2023-12-09 02:48:51,104] Handshake completed! 44 | [2023-12-09 02:48:51,104] Payload size 92724 bytes (0x00016A34) 45 | [2023-12-09 02:48:51,106] HW code: 6573 46 | [2023-12-09 02:48:51,106] Identify 47 | [2023-12-09 02:48:51,109] HW version: CA10 48 | [2023-12-09 02:48:51,109] SW version: CA01 49 | [2023-12-09 02:48:51,109] Initialize PMIC 50 | [2023-12-09 02:48:51,146] Disable watchdog 51 | [2023-12-09 02:48:51,148] Cannot get PRELOADER version in BROM mode 52 | [2023-12-09 02:48:51,148] Initialize RTC 53 | [2023-12-09 02:48:51,150] RTC register 0x70014000 == 0007 54 | [2023-12-09 02:48:51,152] RTC register 0x70014050 == 7AD3 55 | [2023-12-09 02:48:51,153] RTC register 0x70014054 == BE09 56 | [2023-12-09 02:48:51,177] Identify software components 57 | [2023-12-09 02:48:51,178] ME ID: 24B06916DCD1670AF5C4CE6649F081A6 58 | [2023-12-09 02:48:51,180] Raw target config value: 00000000 59 | [2023-12-09 02:48:51,180] Secure boot: NO 60 | [2023-12-09 02:48:51,181] Serial link auth: NO 61 | [2023-12-09 02:48:51,181] Download agent auth: NO 62 | [2023-12-09 02:48:51,182] BROM version: 05 63 | [2023-12-09 02:48:51,183] Cannot get PRELOADER version in BROM mode 64 | [2023-12-09 02:48:51,183] Initialize external memory interface 65 | [2023-12-09 02:48:51,186] EMI_GENA (0x70000000) set to 00000002, was 3B731FFF 66 | [2023-12-09 02:48:51,187] Send payload 67 | [2023-12-09 02:48:51,190] Uploaded 1024 out of 92724 bytes (1%) 68 | [2023-12-09 02:48:51,286] Uploaded 92724 out of 92724 bytes (100%) 69 | [2023-12-09 02:48:51,288] Received DA checksum: 0692 70 | [2023-12-09 02:48:51,288] Jump to payload 71 | [2023-12-09 02:48:51,289] Wait for remaining data 72 | [2023-12-09 02:48:51,289] Waiting for device to send remaining data 73 | [2023-12-09 02:48:51,292] <- DA: (unknown) C0 74 | [2023-12-09 02:48:51,293] <- DA: (unknown) 03 75 | [2023-12-09 02:48:51,294] <- DA: (unknown) 02 76 | [2023-12-09 02:48:51,294] <- DA: (unknown) 83 77 | [2023-12-09 02:48:51,294] Waiting for custom payload response 78 | [2023-12-09 02:48:51,295] Received HELLO sequence 79 | [2023-12-09 02:48:51,295] Reading 65536 bytes 80 | [2023-12-09 02:48:51,461] Saved to dump-1.bin 81 | [2023-12-09 02:48:51,462] Reading 262144 bytes 82 | [2023-12-09 02:48:51,994] Saved to dump-2.bin 83 | [2023-12-09 02:48:51,995] Reading 110592 bytes 84 | [2023-12-09 02:48:52,269] Saved to dump-3.bin 85 | [2023-12-09 02:48:52,269] Received GOODBYE sequence 86 | [2023-12-09 02:48:52,270] Stopping transport 87 | [2023-12-09 02:48:56,337] USB transport has stopped! 88 | ``` 89 | 90 | # Dump procedure 91 | 1. Kill the preloader 92 | 2. Pull out the battery 93 | 3. (`spft-replay` waits for a connection here) 94 | 4. Connect the USB cable 95 | 5. Connect the battery 96 | 4. Wait till `spft-replay` finishes 97 | 5. Disconnect the USB cable 98 | 6. Pull out the battery 99 | -------------------------------------------------------------------------------- /mediatek/MT6573V 1209-BCAH CKHC6P/dump-1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6573V 1209-BCAH CKHC6P/dump-1.bin -------------------------------------------------------------------------------- /mediatek/MT6573V 1209-BCAH CKHC6P/dump-2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6573V 1209-BCAH CKHC6P/dump-2.bin -------------------------------------------------------------------------------- /mediatek/MT6573V 1209-BCAH CKHC6P/dump-3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6573V 1209-BCAH CKHC6P/dump-3.bin -------------------------------------------------------------------------------- /mediatek/MT6577A 1330-CMAH DTPRV616/README.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | | key | value | 3 | |---------------|------------------------------------------------------------------------------------------------------------------------------------------| 4 | | SoC | MT6577A 1330-CMAH DTPRV616 | 5 | | Device | MTS 975 (original name in cyrillic script: МТС 975) | 6 | | Software used | [brom-dump (spft-replay, payloads)](https://github.com/arzam16/empty-sixty-five), commit 06f9214db6f735a838ad030e6236319ba2a2e44b | 7 | 8 | # Regions 9 | | File name | Name | Memory address | 10 | |------------|------|----------------| 11 | | dump-1.bin | BROM | 0xFFFF0000 | 12 | | dump-2.bin | SRAM | 0xF0000000 | 13 | | dump-3.bin | DA | 0xC2000000 | 14 | 15 | # Device ID 16 | ``` 17 | $ ./spft-replay.py -i 18 | [2023-12-09 03:06:36,695] Init backend 19 | [2023-12-09 03:06:36,701] Waiting for device in BROM mode (0E8D:0003) 20 | [2023-12-09 03:06:43,238] Found device 21 | [2023-12-09 03:06:43,244] USB transport has successfully started! Waiting for further commands... 22 | [2023-12-09 03:06:43,246] Handshake completed! 23 | [2023-12-09 03:06:43,247] HW code: 6575 24 | [2023-12-09 03:06:43,249] HW subcode: 8B00 25 | [2023-12-09 03:06:43,249] HW version: CB00 26 | [2023-12-09 03:06:43,249] SW version: E201 27 | [2023-12-09 03:06:43,250] BROM version: 05 28 | [2023-12-09 03:06:43,251] ME ID: 1AD96C3679768FCACAF78A6C92A7A53D 29 | [2023-12-09 03:06:43,252] Raw target config value: 00000000 30 | [2023-12-09 03:06:43,252] Secure boot: NO 31 | [2023-12-09 03:06:43,253] Serial link auth: NO 32 | [2023-12-09 03:06:43,253] Download agent auth: NO 33 | [2023-12-09 03:06:43,253] Stopping transport 34 | [2023-12-09 03:06:45,176] USB transport has stopped! 35 | ``` 36 | 37 | # Dump log 38 | ``` 39 | $ ./spft-replay.py -p ../payloads/build/release/piggyback/mt6577-usb-dump.bin -pr 40 | [2023-12-09 03:06:57,297] Init backend 41 | [2023-12-09 03:06:57,304] Waiting for device in BROM mode (0E8D:0003) 42 | [2023-12-09 03:07:07,047] Found device 43 | [2023-12-09 03:07:07,053] USB transport has successfully started! Waiting for further commands... 44 | [2023-12-09 03:07:07,055] Handshake completed! 45 | [2023-12-09 03:07:07,056] Payload size 139232 bytes (0x00021FE0) 46 | [2023-12-09 03:07:07,056] HW code: 6575 47 | [2023-12-09 03:07:07,058] Detected MT6575E2 48 | [2023-12-09 03:07:07,058] Identify 49 | [2023-12-09 03:07:07,060] HW subcode: 8B00 50 | [2023-12-09 03:07:07,060] HW version: CB00 51 | [2023-12-09 03:07:07,060] SW version: E201 52 | [2023-12-09 03:07:07,061] Initialize PMIC 53 | [2023-12-09 03:07:07,068] Disable watchdog 54 | [2023-12-09 03:07:07,072] Cannot get PRELOADER version in BROM mode 55 | [2023-12-09 03:07:07,074] TOPRGU register 0xC0000000 == 00000064 56 | [2023-12-09 03:07:07,076] TOPRGU register 0xC0000004 == 0000FFE0 57 | [2023-12-09 03:07:07,077] TOPRGU register 0xC0000008 == 00000000 58 | [2023-12-09 03:07:07,079] TOPRGU register 0xC000000C == 00000000 59 | [2023-12-09 03:07:07,081] TOPRGU register 0xC0000010 == 000007FF 60 | [2023-12-09 03:07:07,083] TOPRGU register 0xC0000014 == 00000000 61 | [2023-12-09 03:07:07,085] TOPRGU register 0xC0000018 == 00000000 62 | [2023-12-09 03:07:07,085] Initialize RTC 63 | [2023-12-09 03:07:07,113] Identify software components 64 | [2023-12-09 03:07:07,114] ME ID: 1AD96C3679768FCACAF78A6C92A7A53D 65 | [2023-12-09 03:07:07,116] Raw target config value: 00000000 66 | [2023-12-09 03:07:07,117] Secure boot: NO 67 | [2023-12-09 03:07:07,117] Serial link auth: NO 68 | [2023-12-09 03:07:07,117] Download agent auth: NO 69 | [2023-12-09 03:07:07,118] BROM version: 05 70 | [2023-12-09 03:07:07,119] Cannot get PRELOADER version in BROM mode 71 | [2023-12-09 03:07:07,120] Initialize external memory interface 72 | [2023-12-09 03:07:07,123] EMI_GENA (0xC0003070) set to 00000002, was 00000000 73 | [2023-12-09 03:07:07,123] Send payload 74 | [2023-12-09 03:07:07,126] Uploaded 1024 out of 139232 bytes (0%) 75 | [2023-12-09 03:07:07,276] Uploaded 139232 out of 139232 bytes (100%) 76 | [2023-12-09 03:07:07,279] Received DA checksum: 5737 77 | [2023-12-09 03:07:07,280] Jump to payload 78 | [2023-12-09 03:07:07,281] Wait for remaining data 79 | [2023-12-09 03:07:07,281] Waiting for custom payload response 80 | [2023-12-09 03:07:07,292] Received HELLO sequence 81 | [2023-12-09 03:07:07,292] Reading 65536 bytes 82 | [2023-12-09 03:07:07,476] Saved to dump-1.bin 83 | [2023-12-09 03:07:07,477] Reading 65536 bytes 84 | [2023-12-09 03:07:07,654] Saved to dump-2.bin 85 | [2023-12-09 03:07:07,654] Reading 262144 bytes 86 | [2023-12-09 03:07:08,363] Saved to dump-3.bin 87 | [2023-12-09 03:07:08,364] Received GOODBYE sequence 88 | [2023-12-09 03:07:08,364] Stopping transport 89 | [2023-12-09 03:07:12,449] USB transport has stopped! 90 | ``` 91 | 92 | # Dump procedure 93 | 1. Kill the preloader 94 | 2. Reconnect the battery 95 | 3. (`spft-replay` waits for a connection here) 96 | 4. Connect the USB cable 97 | 5. Wait till `spft-replay` finishes 98 | 6. Disconnect the USB cable 99 | 7. Pull out the battery 100 | -------------------------------------------------------------------------------- /mediatek/MT6577A 1330-CMAH DTPRV616/dump-1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6577A 1330-CMAH DTPRV616/dump-1.bin -------------------------------------------------------------------------------- /mediatek/MT6577A 1330-CMAH DTPRV616/dump-2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6577A 1330-CMAH DTPRV616/dump-2.bin -------------------------------------------------------------------------------- /mediatek/MT6577A 1330-CMAH DTPRV616/dump-3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6577A 1330-CMAH DTPRV616/dump-3.bin -------------------------------------------------------------------------------- /mediatek/MT6582V 1421-XAHHHH CTT9P090/README.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | | key | value | 3 | |---------------|------------------------------------------------------------------------------------------------------------------------------------------| 4 | | SoC | MT6582V 1421-XAHHHH CTT9P090 | 5 | | Device | Micromax A106 | 6 | | Software used | [brom-dump (spft-replay, payloads)](https://github.com/arzam16/empty-sixty-five), commit 06f9214db6f735a838ad030e6236319ba2a2e44b | 7 | 8 | # Regions 9 | | File name | Name | Memory address | 10 | |------------|------|----------------| 11 | | dump-1.bin | BROM | 0x0 | 12 | | dump-2.bin | SRAM | 0x100000 | 13 | | dump-3.bin | DA | 0x200000 | 14 | 15 | # Device ID 16 | ``` 17 | $ ./spft-replay.py -i 18 | [2023-12-09 02:54:55,040] Init backend 19 | [2023-12-09 02:54:55,047] Waiting for device in BROM mode (0E8D:0003) 20 | [2023-12-09 02:55:11,682] Found device 21 | [2023-12-09 02:55:11,687] USB transport has successfully started! Waiting for further commands... 22 | [2023-12-09 02:55:11,690] Handshake completed! 23 | [2023-12-09 02:55:11,691] HW code: 6582 24 | [2023-12-09 02:55:11,692] HW subcode: 8A00 25 | [2023-12-09 02:55:11,693] HW version: CA01 26 | [2023-12-09 02:55:11,693] SW version: 0001 27 | [2023-12-09 02:55:11,693] BROM version: 05 28 | [2023-12-09 02:55:11,695] ME ID: 63188F8203468B2F732D3402A4D77DCA 29 | [2023-12-09 02:55:11,696] Raw target config value: 00000000 30 | [2023-12-09 02:55:11,696] Secure boot: NO 31 | [2023-12-09 02:55:11,696] Serial link auth: NO 32 | [2023-12-09 02:55:11,697] Download agent auth: NO 33 | [2023-12-09 02:55:11,697] Stopping transport 34 | [2023-12-09 02:55:13,620] USB transport has stopped! 35 | ``` 36 | 37 | # Dump log 38 | ``` 39 | $ ./spft-replay.py -p ../payloads/build/release/piggyback/mt6582-usb-dump.bin -pr 40 | [2023-12-09 02:55:21,247] Init backend 41 | [2023-12-09 02:55:21,254] Waiting for device in BROM mode (0E8D:0003) 42 | [2023-12-09 02:55:26,017] Found device 43 | [2023-12-09 02:55:26,023] USB transport has successfully started! Waiting for further commands... 44 | [2023-12-09 02:55:26,025] Handshake completed! 45 | [2023-12-09 02:55:26,026] Payload size 67584 bytes (0x00010800) 46 | [2023-12-09 02:55:26,027] HW code: 6582 47 | [2023-12-09 02:55:26,027] Identify 48 | [2023-12-09 02:55:26,028] HW subcode: 8A00 49 | [2023-12-09 02:55:26,029] HW version: CA01 50 | [2023-12-09 02:55:26,029] SW version: 0001 51 | [2023-12-09 02:55:26,030] 0x10206044: 00000380 52 | [2023-12-09 02:55:26,031] Initialize PMIC 53 | [2023-12-09 02:55:26,031] Disable watchdog 54 | [2023-12-09 02:55:26,033] Initialize RTC 55 | [2023-12-09 02:55:26,033] Identify software components 56 | [2023-12-09 02:55:26,034] Cannot get PRELOADER version in BROM mode 57 | [2023-12-09 02:55:26,035] ME ID: 63188F8203468B2F732D3402A4D77DCA 58 | [2023-12-09 02:55:26,036] Cannot get PRELOADER version in BROM mode 59 | [2023-12-09 02:55:26,036] Initialize external memory interface 60 | [2023-12-09 02:55:26,036] Send payload 61 | [2023-12-09 02:55:26,039] Uploaded 1024 out of 67584 bytes (1%) 62 | [2023-12-09 02:55:26,112] Uploaded 67584 out of 67584 bytes (100%) 63 | [2023-12-09 02:55:26,113] Received DA checksum: 24C5 64 | [2023-12-09 02:55:26,113] Jump to payload 65 | [2023-12-09 02:55:26,114] Wait for remaining data 66 | [2023-12-09 02:55:26,114] Waiting for custom payload response 67 | [2023-12-09 02:55:26,141] Received HELLO sequence 68 | [2023-12-09 02:55:26,142] Reading 65536 bytes 69 | [2023-12-09 02:55:26,330] Saved to dump-1.bin 70 | [2023-12-09 02:55:26,331] Reading 65536 bytes 71 | [2023-12-09 02:55:26,511] Saved to dump-2.bin 72 | [2023-12-09 02:55:26,512] Reading 131072 bytes 73 | [2023-12-09 02:55:26,851] Saved to dump-3.bin 74 | [2023-12-09 02:55:26,852] Received GOODBYE sequence 75 | [2023-12-09 02:55:26,852] Stopping transport 76 | [2023-12-09 02:55:30,941] USB transport has stopped! 77 | ``` 78 | 79 | # Dump procedure 80 | 1. Kill the preloader 81 | 2. Pull the battery 82 | 3. (`spft-replay` waits for a connection here) 83 | 4. Connect the USB cable 84 | 5. Wait till `spft-replay` finishes 85 | 6. Disconnect the USB cable 86 | -------------------------------------------------------------------------------- /mediatek/MT6582V 1421-XAHHHH CTT9P090/dump-1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6582V 1421-XAHHHH CTT9P090/dump-1.bin -------------------------------------------------------------------------------- /mediatek/MT6582V 1421-XAHHHH CTT9P090/dump-2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6582V 1421-XAHHHH CTT9P090/dump-2.bin -------------------------------------------------------------------------------- /mediatek/MT6582V 1421-XAHHHH CTT9P090/dump-3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6582V 1421-XAHHHH CTT9P090/dump-3.bin -------------------------------------------------------------------------------- /mediatek/MT6582V 1609-XAHHHH CTTGS141/README.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | | key | value | 3 | |---------------|------------------------------------------------------------------------------------------------------------------------------------------| 4 | | SoC | MT6582V 1609-XAHHHH CTTGS141 | 5 | | Device | Huawei Y3II (3G), MB sticker: `S96582AA1` | 6 | | Software used | [brom-dump (spft-replay, payloads)](https://github.com/arzam16/empty-sixty-five), commit 459d03d325d09b898df6429d2efbf57324ecb600 | 7 | 8 | # Regions 9 | | File name | Name | Memory address | 10 | |------------|------|----------------| 11 | | dump-1.bin | BROM | 0x0 | 12 | | dump-2.bin | SRAM | 0x100000 | 13 | | dump-3.bin | DA | 0x200000 | 14 | 15 | # Device ID 16 | ``` 17 | $ ./spft-replay.py -i 18 | [2023-11-25 02:37:00,405] Waiting for device in BROM mode (0E8D:0003) 19 | [2023-11-25 02:37:09,940] Found device 20 | [2023-11-25 02:37:09,948] Handshake completed! 21 | [2023-11-25 02:37:09,949] HW code: 6582 22 | [2023-11-25 02:37:09,950] HW subcode: 8A00 23 | [2023-11-25 02:37:09,950] HW version: CA01 24 | [2023-11-25 02:37:09,951] SW version: 0001 25 | [2023-11-25 02:37:09,951] BROM version: 05 26 | [2023-11-25 02:37:09,952] ME ID: D0B106638FF175EF24EAE0DD82A22914 27 | [2023-11-25 02:37:09,954] Raw target config value: 00000000 28 | [2023-11-25 02:37:09,954] Secure boot: NO 29 | [2023-11-25 02:37:09,954] Serial link auth: NO 30 | [2023-11-25 02:37:09,954] Download agent auth: NO 31 | [2023-11-25 02:37:09,955] Closing device 32 | ``` 33 | 34 | # Dump log 35 | ``` 36 | $ ./spft-replay.py -p ../payloads/build/release/piggyback/mt6582-usb-dump.bin -pr 37 | [2023-11-25 02:40:00,930] Waiting for device in BROM mode (0E8D:0003) 38 | [2023-11-25 02:40:09,400] Found device 39 | [2023-11-25 02:40:09,408] Handshake completed! 40 | [2023-11-25 02:40:09,409] Payload size 67584 bytes (0x00010800) 41 | [2023-11-25 02:40:09,410] HW code: 6582 42 | [2023-11-25 02:40:09,410] Identify 43 | [2023-11-25 02:40:09,411] HW subcode: 8A00 44 | [2023-11-25 02:40:09,412] HW version: CA01 45 | [2023-11-25 02:40:09,412] SW version: 0001 46 | [2023-11-25 02:40:09,414] 0x10206044: 00000380 47 | [2023-11-25 02:40:09,414] Initialize PMIC 48 | [2023-11-25 02:40:09,414] Disable watchdog 49 | [2023-11-25 02:40:09,416] Initialize RTC 50 | [2023-11-25 02:40:09,416] Identify software components 51 | [2023-11-25 02:40:09,416] Cannot get PRELOADER version in BROM mode 52 | [2023-11-25 02:40:09,417] ME ID: D0B106638FF175EF24EAE0DD82A22914 53 | [2023-11-25 02:40:09,417] Cannot get PRELOADER version in BROM mode 54 | [2023-11-25 02:40:09,418] Initialize external memory interface 55 | [2023-11-25 02:40:09,418] Send payload 56 | [2023-11-25 02:40:09,420] Uploaded 1024 out of 67584 bytes (1%) 57 | [2023-11-25 02:40:09,488] Uploaded 67584 out of 67584 bytes (100%) 58 | [2023-11-25 02:40:09,488] Received DA checksum: BADB 59 | [2023-11-25 02:40:09,489] Jump to payload 60 | [2023-11-25 02:40:09,489] Wait for remaining data 61 | [2023-11-25 02:40:09,489] Waiting for custom payload response 62 | [2023-11-25 02:40:09,516] Received HELLO sequence 63 | [2023-11-25 02:40:09,516] Reading 65536 bytes 64 | [2023-11-25 02:40:09,655] Saved to dump-1.bin 65 | [2023-11-25 02:40:09,656] Reading 65536 bytes 66 | [2023-11-25 02:40:09,786] Saved to dump-2.bin 67 | [2023-11-25 02:40:09,786] Reading 131072 bytes 68 | [2023-11-25 02:40:10,092] Saved to dump-3.bin 69 | [2023-11-25 02:40:10,092] Received GOODBYE sequence 70 | [2023-11-25 02:40:10,093] Closing device 71 | ``` 72 | 73 | # Dump procedure 74 | 1. Kill the preloader 75 | 2. Pull the battery 76 | 3. (`spft-replay` waits for a connection here) 77 | 4. Connect the USB cable 78 | 5. Wait till `spft-replay` finishes 79 | 6. Disconnect the USB cable 80 | -------------------------------------------------------------------------------- /mediatek/MT6582V 1609-XAHHHH CTTGS141/dump-1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6582V 1609-XAHHHH CTTGS141/dump-1.bin -------------------------------------------------------------------------------- /mediatek/MT6582V 1609-XAHHHH CTTGS141/dump-2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6582V 1609-XAHHHH CTTGS141/dump-2.bin -------------------------------------------------------------------------------- /mediatek/MT6582V 1609-XAHHHH CTTGS141/dump-3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6582V 1609-XAHHHH CTTGS141/dump-3.bin -------------------------------------------------------------------------------- /mediatek/MT6589WTK 1325-ATAH DTNGT126/README.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | | key | value | 3 | |---------------|-----------------------------------------------------------------------------------------------------------------------------------| 4 | | SoC | MT6589WTK 1325-ATAH DTNGT126 | 5 | | Device | Highscreen Alpha R | 6 | | Software used | [brom-dump (spft-replay, payloads)](https://github.com/arzam16/empty-sixty-five), commit d8659844eb8e1c8c25e83e04ec9645b874704072 | 7 | 8 | # Regions 9 | | File name | Name | Memory address | 10 | |------------|------|----------------| 11 | | dump-1.bin | BROM | 0x0 | 12 | | dump-2.bin | SRAM | 0x100000 | 13 | | dump-3.bin | DA | 0x12000000 | 14 | 15 | # Device ID 16 | ``` 17 | $ ./spft-replay.py -i 18 | [2023-07-15 03:14:26,442] Waiting for device in BROM mode (0E8D:0003) 19 | [2023-07-15 03:14:45,244] Found device 20 | [2023-07-15 03:14:45,276] Handshake completed! 21 | [2023-07-15 03:14:45,289] HW code: 6583 22 | [2023-07-15 03:14:45,308] HW subcode: 8A00 23 | [2023-07-15 03:14:45,308] HW version: CA01 24 | [2023-07-15 03:14:45,308] SW version: 0001 25 | [2023-07-15 03:14:45,317] BROM version: 05 26 | [2023-07-15 03:14:45,333] ME ID: D319F8178D4ED9CDE04C200CB609AEBE 27 | [2023-07-15 03:14:45,346] Raw target config value: 00000000 28 | [2023-07-15 03:14:45,346] Secure boot: NO 29 | [2023-07-15 03:14:45,347] Serial link auth: NO 30 | [2023-07-15 03:14:45,347] Download agent auth: NO 31 | [2023-07-15 03:14:45,347] Closing device 32 | ``` 33 | 34 | # Dump log 35 | ``` 36 | $ ./spft-replay.py -p ../payloads/build/release/piggyback/mt6589-usb-dump.bin -pr 37 | [2023-07-15 03:19:15,568] Waiting for device in BROM mode (0E8D:0003) 38 | [2023-07-15 03:19:40,122] Found device 39 | [2023-07-15 03:19:40,175] Handshake completed! 40 | [2023-07-15 03:19:40,175] Payload size 142804 bytes (0x00022DD4) 41 | [2023-07-15 03:19:40,188] HW code: 6583 42 | [2023-07-15 03:19:40,188] Identify 43 | [2023-07-15 03:19:40,207] HW subcode: 8A00 44 | [2023-07-15 03:19:40,207] HW version: CA01 45 | [2023-07-15 03:19:40,207] SW version: 0001 46 | [2023-07-15 03:19:40,217] Initialize PMIC 47 | [2023-07-15 03:19:40,688] Disable watchdog 48 | [2023-07-15 03:19:40,726] Cannot get PRELOADER version in BROM mode 49 | [2023-07-15 03:19:40,755] TOPRGU register 0x10000000 == 00000024 50 | [2023-07-15 03:19:40,783] TOPRGU register 0x10000004 == 0000FFE0 51 | [2023-07-15 03:19:40,812] TOPRGU register 0x10000008 == 00000000 52 | [2023-07-15 03:19:40,840] TOPRGU register 0x1000000C == 00000000 53 | [2023-07-15 03:19:40,869] TOPRGU register 0x10000010 == 00000FFF 54 | [2023-07-15 03:19:40,897] TOPRGU register 0x10000014 == 00000000 55 | [2023-07-15 03:19:40,926] TOPRGU register 0x10000018 == 00000000 56 | [2023-07-15 03:19:40,926] Initialize RTC 57 | [2023-07-15 03:19:40,926] Identify software components 58 | [2023-07-15 03:19:40,932] BROM version: 05 59 | [2023-07-15 03:19:40,938] Cannot get PRELOADER version in BROM mode 60 | [2023-07-15 03:19:40,939] Initialize external memory interface 61 | [2023-07-15 03:19:41,002] EMI_GENA (0x10203070) set to 00000002, was 00000000 62 | [2023-07-15 03:19:41,002] Send payload 63 | [2023-07-15 03:19:41,036] Uploaded 1024 out of 142804 bytes (0%) 64 | [2023-07-15 03:19:41,337] Uploaded 50176 out of 142804 bytes (35%) 65 | [2023-07-15 03:19:41,642] Uploaded 100352 out of 142804 bytes (70%) 66 | [2023-07-15 03:19:41,905] Uploaded 142804 out of 142804 bytes (100%) 67 | [2023-07-15 03:19:41,924] Received DA checksum: A6B7 68 | [2023-07-15 03:19:41,925] Jump to payload 69 | [2023-07-15 03:19:41,953] Wait for remaining data 70 | [2023-07-15 03:19:41,958] <- DA: (unknown) C0 71 | [2023-07-15 03:19:41,999] <- DA: (unknown) 00000BC4 72 | [2023-07-15 03:19:42,014] <- DA: (unknown) 0005 73 | [2023-07-15 03:19:42,017] <- DA: (unknown) 00000000000000000000 74 | [2023-07-15 03:19:42,020] <- DA: (unknown) 00000000 75 | [2023-07-15 03:19:42,023] <- DA: (EMMC CID) 4D0001703430434DE7050247B350FCBC 76 | [2023-07-15 03:19:42,024] -> DA: (OK) 5A 77 | [2023-07-15 03:19:42,027] Waiting for custom payload response 78 | [2023-07-15 03:19:42,030] Received HELLO sequence 79 | [2023-07-15 03:19:42,033] Reading 65536 bytes 80 | [2023-07-15 03:19:45,288] Saved to dump-1.bin 81 | [2023-07-15 03:19:45,294] Reading 65536 bytes 82 | [2023-07-15 03:19:48,535] Saved to dump-2.bin 83 | [2023-07-15 03:19:48,540] Reading 262144 bytes 84 | [2023-07-15 03:20:01,522] Saved to dump-3.bin 85 | [2023-07-15 03:20:01,527] Received GOODBYE sequence 86 | [2023-07-15 03:20:01,528] Closing device 87 | ``` 88 | 89 | # Dump procedure 90 | 1. Kill the preloader 91 | 2. Pull the battery 92 | 3. (`spft-replay` waits for a connection here) 93 | 4. Short the usbdl pin (see the photo below) to the ground with a 100 Ohm resistor 94 | 5. Connect the USB cable 95 | 6. (the camera flash blinks slightly) 96 | 7. Unshort the pin 97 | 8. Wait till `spft-replay` finishes 98 | 9. Disconnect the USB cable 99 | 100 | ![usbdl pin](usbdl.jpg) 101 | -------------------------------------------------------------------------------- /mediatek/MT6589WTK 1325-ATAH DTNGT126/dump-1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6589WTK 1325-ATAH DTNGT126/dump-1.bin -------------------------------------------------------------------------------- /mediatek/MT6589WTK 1325-ATAH DTNGT126/dump-2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6589WTK 1325-ATAH DTNGT126/dump-2.bin -------------------------------------------------------------------------------- /mediatek/MT6589WTK 1325-ATAH DTNGT126/dump-3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6589WTK 1325-ATAH DTNGT126/dump-3.bin -------------------------------------------------------------------------------- /mediatek/MT6589WTK 1325-ATAH DTNGT126/usbdl.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT6589WTK 1325-ATAH DTNGT126/usbdl.jpg -------------------------------------------------------------------------------- /mediatek/MT8317ATA 1245-CMAH DTPMY342/README.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | | key | value | 3 | |---------------|------------------------------------------------------------------------------------------------------------------------------------------| 4 | | SoC | MT8317ATA 1245-CMAH DTPMY342 | 5 | | Device | Acer Iconia B1-A71 | 6 | | Software used | [brom-dump (spft-replay, payloads)](https://github.com/arzam16/empty-sixty-five), commit 06f9214db6f735a838ad030e6236319ba2a2e44b | 7 | 8 | # Regions 9 | | File name | Name | Memory address | 10 | |------------|------|----------------| 11 | | dump-1.bin | BROM | 0xFFFF0000 | 12 | | dump-2.bin | SRAM | 0xF0000000 | 13 | | dump-3.bin | DA | 0xC2000000 | 14 | 15 | # Device ID 16 | ``` 17 | $ ./spft-replay.py -i 18 | [2023-12-09 02:39:41,690] Init backend 19 | [2023-12-09 02:39:41,698] Waiting for device in BROM mode (0E8D:0003) 20 | [2023-12-09 02:39:56,322] Found device 21 | [2023-12-09 02:39:56,326] USB transport has successfully started! Waiting for further commands... 22 | [2023-12-09 02:39:56,330] Handshake completed! 23 | [2023-12-09 02:39:56,332] HW code: 6575 24 | [2023-12-09 02:39:56,333] HW subcode: 8B00 25 | [2023-12-09 02:39:56,334] HW version: CB00 26 | [2023-12-09 02:39:56,334] SW version: E201 27 | [2023-12-09 02:39:56,335] BROM version: 05 28 | [2023-12-09 02:39:56,336] ME ID: A8D5A0267E7D68C5FA057F7C51F26943 29 | [2023-12-09 02:39:56,337] Raw target config value: 00000000 30 | [2023-12-09 02:39:56,337] Secure boot: NO 31 | [2023-12-09 02:39:56,337] Serial link auth: NO 32 | [2023-12-09 02:39:56,338] Download agent auth: NO 33 | [2023-12-09 02:39:56,338] Stopping transport 34 | [2023-12-09 02:39:58,224] USB transport has stopped! 35 | ``` 36 | 37 | # Dump log 38 | ``` 39 | $ ./spft-replay.py -p ../payloads/build/release/piggyback/mt6577-usb-dump.bin -pr 40 | [2023-12-09 02:40:38,161] Init backend 41 | [2023-12-09 02:40:38,168] Waiting for device in BROM mode (0E8D:0003) 42 | [2023-12-09 02:40:47,012] Found device 43 | [2023-12-09 02:40:47,017] USB transport has successfully started! Waiting for further commands... 44 | [2023-12-09 02:40:47,020] Handshake completed! 45 | [2023-12-09 02:40:47,020] Payload size 139232 bytes (0x00021FE0) 46 | [2023-12-09 02:40:47,022] HW code: 6575 47 | [2023-12-09 02:40:47,023] Detected MT6575E2 48 | [2023-12-09 02:40:47,023] Identify 49 | [2023-12-09 02:40:47,025] HW subcode: 8B00 50 | [2023-12-09 02:40:47,026] HW version: CB00 51 | [2023-12-09 02:40:47,026] SW version: E201 52 | [2023-12-09 02:40:47,026] Initialize PMIC 53 | [2023-12-09 02:40:47,034] Disable watchdog 54 | [2023-12-09 02:40:47,038] Cannot get PRELOADER version in BROM mode 55 | [2023-12-09 02:40:47,040] TOPRGU register 0xC0000000 == 00000064 56 | [2023-12-09 02:40:47,042] TOPRGU register 0xC0000004 == 0000FFE0 57 | [2023-12-09 02:40:47,044] TOPRGU register 0xC0000008 == 00000000 58 | [2023-12-09 02:40:47,045] TOPRGU register 0xC000000C == 00000000 59 | [2023-12-09 02:40:47,047] TOPRGU register 0xC0000010 == 000007FF 60 | [2023-12-09 02:40:47,049] TOPRGU register 0xC0000014 == 00000000 61 | [2023-12-09 02:40:47,051] TOPRGU register 0xC0000018 == 00000000 62 | [2023-12-09 02:40:47,051] Initialize RTC 63 | [2023-12-09 02:40:47,083] Identify software components 64 | [2023-12-09 02:40:47,085] ME ID: A8D5A0267E7D68C5FA057F7C51F26943 65 | [2023-12-09 02:40:47,087] Raw target config value: 00000000 66 | [2023-12-09 02:40:47,087] Secure boot: NO 67 | [2023-12-09 02:40:47,087] Serial link auth: NO 68 | [2023-12-09 02:40:47,088] Download agent auth: NO 69 | [2023-12-09 02:40:47,089] BROM version: 05 70 | [2023-12-09 02:40:47,089] Cannot get PRELOADER version in BROM mode 71 | [2023-12-09 02:40:47,090] Initialize external memory interface 72 | [2023-12-09 02:40:47,093] EMI_GENA (0xC0003070) set to 00000002, was 00000000 73 | [2023-12-09 02:40:47,093] Send payload 74 | [2023-12-09 02:40:47,097] Uploaded 1024 out of 139232 bytes (0%) 75 | [2023-12-09 02:40:47,248] Uploaded 139232 out of 139232 bytes (100%) 76 | [2023-12-09 02:40:47,252] Received DA checksum: 5737 77 | [2023-12-09 02:40:47,252] Jump to payload 78 | [2023-12-09 02:40:47,254] Wait for remaining data 79 | [2023-12-09 02:40:47,254] Waiting for custom payload response 80 | [2023-12-09 02:40:47,265] Received HELLO sequence 81 | [2023-12-09 02:40:47,265] Reading 65536 bytes 82 | [2023-12-09 02:40:47,448] Saved to dump-1.bin 83 | [2023-12-09 02:40:47,449] Reading 65536 bytes 84 | [2023-12-09 02:40:47,586] Saved to dump-2.bin 85 | [2023-12-09 02:40:47,587] Reading 262144 bytes 86 | [2023-12-09 02:40:48,308] Saved to dump-3.bin 87 | [2023-12-09 02:40:48,309] Received GOODBYE sequence 88 | [2023-12-09 02:40:48,309] Stopping transport 89 | [2023-12-09 02:40:52,385] USB transport has stopped! 90 | ``` 91 | 92 | # Dump procedure 93 | 1. (`spft-replay` waits for a connection here) 94 | 2. Hold the Vol+ key 95 | 3. Connect the USB cable, release the key once device connects in BROM mode 96 | 4. Wait till `spft-replay` finishes 97 | 5. Disconnect the USB cable 98 | 6. Hit the Reset key in a small hole next to the Power key 99 | -------------------------------------------------------------------------------- /mediatek/MT8317ATA 1245-CMAH DTPMY342/dump-1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT8317ATA 1245-CMAH DTPMY342/dump-1.bin -------------------------------------------------------------------------------- /mediatek/MT8317ATA 1245-CMAH DTPMY342/dump-2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT8317ATA 1245-CMAH DTPMY342/dump-2.bin -------------------------------------------------------------------------------- /mediatek/MT8317ATA 1245-CMAH DTPMY342/dump-3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT8317ATA 1245-CMAH DTPMY342/dump-3.bin -------------------------------------------------------------------------------- /mediatek/MT8382V 1521-XAHHAH CTTBA531/README.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | | key | value | 3 | |---------------|------------------------------------------------------------------------------------------------------------------------------------------| 4 | | SoC | MT8382V 1521-XAHHAH CTTBA531 | 5 | | Device | Lenovo A7-30 | 6 | | Software used | [brom-dump (spft-replay, payloads)](https://github.com/arzam16/empty-sixty-five), commit 459d03d325d09b898df6429d2efbf57324ecb600 | 7 | 8 | # Regions 9 | | File name | Name | Memory address | 10 | |------------|------|----------------| 11 | | dump-1.bin | BROM | 0x0 | 12 | | dump-2.bin | SRAM | 0x100000 | 13 | | dump-3.bin | DA | 0x200000 | 14 | 15 | # Device ID 16 | ``` 17 | $ ./spft-replay.py -i 18 | [2023-11-25 03:05:41,098] Waiting for device in BROM mode (0E8D:0003) 19 | [2023-11-25 03:05:51,101] Found device 20 | [2023-11-25 03:05:51,106] Handshake completed! 21 | [2023-11-25 03:05:51,106] HW code: 6582 22 | [2023-11-25 03:05:51,107] HW subcode: 8A00 23 | [2023-11-25 03:05:51,107] HW version: CA01 24 | [2023-11-25 03:05:51,108] SW version: 0001 25 | [2023-11-25 03:05:51,108] BROM version: 05 26 | [2023-11-25 03:05:51,109] ME ID: B1F3A071E9696973393497AA1C323C2D 27 | [2023-11-25 03:05:51,109] Raw target config value: 00000000 28 | [2023-11-25 03:05:51,109] Secure boot: NO 29 | [2023-11-25 03:05:51,109] Serial link auth: NO 30 | [2023-11-25 03:05:51,109] Download agent auth: NO 31 | [2023-11-25 03:05:51,110] Closing device 32 | ``` 33 | 34 | # Dump log 35 | ``` 36 | $ ./spft-replay.py -p ../payloads/build/release/piggyback/mt6582-usb-dump.bin -pr 37 | [2023-11-25 03:06:21,577] Waiting for device in BROM mode (0E8D:0003) 38 | [2023-11-25 03:06:47,647] Found device 39 | [2023-11-25 03:06:47,651] Handshake completed! 40 | [2023-11-25 03:06:47,652] Payload size 67584 bytes (0x00010800) 41 | [2023-11-25 03:06:47,652] HW code: 6582 42 | [2023-11-25 03:06:47,652] Identify 43 | [2023-11-25 03:06:47,653] HW subcode: 8A00 44 | [2023-11-25 03:06:47,654] HW version: CA01 45 | [2023-11-25 03:06:47,654] SW version: 0001 46 | [2023-11-25 03:06:47,655] 0x10206044: 00000380 47 | [2023-11-25 03:06:47,655] Initialize PMIC 48 | [2023-11-25 03:06:47,655] Disable watchdog 49 | [2023-11-25 03:06:47,657] Initialize RTC 50 | [2023-11-25 03:06:47,657] Identify software components 51 | [2023-11-25 03:06:47,657] Cannot get PRELOADER version in BROM mode 52 | [2023-11-25 03:06:47,658] ME ID: B1F3A071E9696973393497AA1C323C2D 53 | [2023-11-25 03:06:47,658] Cannot get PRELOADER version in BROM mode 54 | [2023-11-25 03:06:47,658] Initialize external memory interface 55 | [2023-11-25 03:06:47,658] Send payload 56 | [2023-11-25 03:06:47,661] Uploaded 1024 out of 67584 bytes (1%) 57 | [2023-11-25 03:06:47,732] Uploaded 67584 out of 67584 bytes (100%) 58 | [2023-11-25 03:06:47,733] Received DA checksum: BADB 59 | [2023-11-25 03:06:47,733] Jump to payload 60 | [2023-11-25 03:06:47,733] Wait for remaining data 61 | [2023-11-25 03:06:47,734] Waiting for custom payload response 62 | [2023-11-25 03:06:47,760] Received HELLO sequence 63 | [2023-11-25 03:06:47,761] Reading 65536 bytes 64 | [2023-11-25 03:06:47,903] Saved to dump-1.bin 65 | [2023-11-25 03:06:47,904] Reading 65536 bytes 66 | [2023-11-25 03:06:48,066] Saved to dump-2.bin 67 | [2023-11-25 03:06:48,066] Reading 131072 bytes 68 | [2023-11-25 03:06:48,381] Saved to dump-3.bin 69 | [2023-11-25 03:06:48,382] Received GOODBYE sequence 70 | [2023-11-25 03:06:48,382] Closing device 71 | ``` 72 | 73 | # Dump procedure 74 | 1. (`spft-replay` waits for a connection here) 75 | 2. Hold the Vol+ key 76 | 3. Connect the USB cable, release the key once device connects in BROM mode 77 | 4. Wait till `spft-replay` finishes 78 | 5. Disconnect the USB cable 79 | 6. Hold Power key for 10 seconds or reconnect the battery (requires unscrewing 2 philips head screws) to reset the device to its normal state 80 | -------------------------------------------------------------------------------- /mediatek/MT8382V 1521-XAHHAH CTTBA531/dump-1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT8382V 1521-XAHHAH CTTBA531/dump-1.bin -------------------------------------------------------------------------------- /mediatek/MT8382V 1521-XAHHAH CTTBA531/dump-2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT8382V 1521-XAHHAH CTTBA531/dump-2.bin -------------------------------------------------------------------------------- /mediatek/MT8382V 1521-XAHHAH CTTBA531/dump-3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/MT8382V 1521-XAHHAH CTTBA531/dump-3.bin -------------------------------------------------------------------------------- /mediatek/mt6572.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6572.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt6580.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6580.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt6589.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6589.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt6750.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6750.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt6753.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6753.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt6765.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6765.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt6768.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6768.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt6771.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt6771.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt8163.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt8163.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt8167.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt8167.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt8173.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt8173.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt8186.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt8186.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt8382v.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt8382v.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt8735v.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt8735v.bootrom.bin -------------------------------------------------------------------------------- /mediatek/mt8735w.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/mediatek/mt8735w.bootrom.bin -------------------------------------------------------------------------------- /qualcomm/qsd8650.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/qualcomm/qsd8650.bootrom.bin -------------------------------------------------------------------------------- /rockchip/rk3288.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/rockchip/rk3288.bootrom.bin -------------------------------------------------------------------------------- /rockchip/rk3399.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/rockchip/rk3399.bootrom.bin -------------------------------------------------------------------------------- /sunxi/sunxi-s3.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/sunxi/sunxi-s3.bootrom.bin -------------------------------------------------------------------------------- /ti/am335x.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/ti/am335x.bootrom.bin -------------------------------------------------------------------------------- /ti/imx6d.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/ti/imx6d.bootrom.bin -------------------------------------------------------------------------------- /ti/imx8mq.bootrom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Zenofex/SoC-BootROMs/a5d57b00ca04d57af717a31ffd8ba70fd7133c95/ti/imx8mq.bootrom.bin --------------------------------------------------------------------------------