MT6890/0x992 Nokia Gateway 2: target config 0xe5, DA1 rejected with DAA 0x7017

Open
  • Is something wrong?
#445 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
embedded-iot, security

Research direction

Start by reading issues #88, #302, and #404 and tracing where mtkclient authenticates DA1 versus where Carbonara and HeapBait run; the issue names these boundaries but no source files or tests. Check whether supported read-only commands or existing 0x992 payloads can answer the questions without exposing ME_ID. Done means documenting the supported path or confirming that matching Nokia authentication is required, with evidence from reproducible sanitized logs.

Written by the indexing model from the issue text.

Description

Device
  • Nokia FastMile 5G Gateway 2
  • Model: 5G19-01W-A
  • Part number: 3TG02241AABA
  • Carrier: Safaricom (Kenya)
  • SoC: MT6880/MT6890 / T750, HW code 0x992
  • Storage: 3.38 GiB BIWIN eMMC (same geometry reported by another exact unit)
  • Host: macOS, device enumerates as 0e8d:0003 in BROM automatically

The gateway stopped booting after a power cycle. It has no Wi-Fi or Ethernet service and always enters BROM. Factory reset has no effect. I am trying to make a read-only eMMC backup before attempting recovery.

BootROM security state
HW code:        0x992
HW subcode:     0x8a00
HW version:     0xca01
SW version:     0x1
Target config:  0xe5
SBC:            true
SLA:            false
DAA:            true
SWJTAG:         true
Mem read auth:  true
Mem write auth: true
Cmd 0xC8:       blocked

The ME_ID is intentionally omitted but is available privately if it is technically useful.

Results so far
  1. BROM handshake and target-config reads are repeatable.
  2. Generic Kamakiri payload (generic_patcher_payload.bin, 0x538 bytes) is transmitted, but does not execute/respond after Done sending payload.
  3. The generic MTK_DA_V6.bin contains an exact 0x992 entry, but DA1 is rejected with 0x7017 DAA_Security_Error.
  4. Fibocom's official auth_sv5.auth for the FM350/T750 family is rejected with 0x7009.
  5. A BlueNokia/Motorola auth_sv5 candidate is also rejected with 0x7009.
  6. The eMMC-capable Quectel DA_BR.bin used successfully with SP Flash Tool on the unprotected device in #302 is available and verified, but the Nokia rejects it at the same pre-DA authentication boundary.

Relevant existing issues appear to cover different boundaries:

  • #88: MT6880/MT6890 DA support; examples are target config 0x0 or a protected Fibocom unit with its matching auth.
  • #302: same IDs and eMMC, but target config 0x0.
  • #404: another 0x7017 case, but MT6897 rather than 0x992.
Questions
  1. Is there any supported pre-DA exploit path for MT6890/T750 0x992 with target config 0xe5, or is an OEM-matching Nokia auth/signed DA1 strictly required?
  2. Can Carbonara or HeapBait help in this situation? From the current code, both appear to run only after an accepted DA1, so I assume they cannot cross this boundary.
  3. Is there a useful read-only command that can identify the expected root certificate/auth signer without exposing the device ME_ID?
  4. Are there newer 0x992 payloads or branches worth testing before moving to direct eMMC ISP recovery?

No write or erase operation has been attempted. I can provide sanitized debug logs, DA hashes and repeat tests on macOS if useful.

Dominant language
Python
Stars
1.5k
Forks
309
Avg merge
1d 7h
Merged PRs (30d)
2

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from bkerler/mtkclient

All issues in bkerler/mtkclient

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.