bootloader not unlocking with RPMB erase + seccfg unlock method

[ssg-enjoyer]

Device model

Redmi 12c

Codename

earth

SoC

MT6769Z

Firmware version

Hyperos 816.0.8.0.UCVEUXM

Which step failed?

Verification (fastboot oem lks)

Full terminal output

fastboot oem lks
> Lock state: locked
> OKAY [0.002s]

fastboot getvar unlocked
> unlocked: no
> Finished. Total time: 0.001s

fastboot getvar secure
> secure: yes
> Finished. Total time: 0.001s.
$./scan_lk.py lk_a.bin [*] Reading lk_a.bin...
[*] Size: 67,108,864 bytes
[*] Scanning...
══════════════════════════════════════════════════════════
  LK BINARY SCAN REPORT — MTKClient Unlock Analyzer
══════════════════════════════════════════════════════════

  File size  : 67,108,864 bytes (64.0 MB)
  MD5        : cad1238c747c5bfc2366b28b91953c5e
  SHA256     : 0d4f92db6274bd7a40379ea7dac915f7...

  ┌─────────────────────────────────────────┐
  │  VERDICT: COMPATIBLE                     │
  │  Score  : 100/100 (100%)                       │
  │  Method: RPMB erase (sector 57344) + sec│
  └─────────────────────────────────────────┘

  [MAGIC] Jz8PNRUF : ✓ FOUND
    @ 0x00107C74

  [RPMB] Type : UFS_Samsung_0x400000
    magic                : 0x3FE0
    lock_state_len       : 0x40E0
    signature_data       : 0x41E0

  [RSA]  Modulus : ✓ FOUND
    @ 0x00107FE4
    Key size: 2048 bits

  [SECCFG] Version : generic

  [FUNCTIONS] 7 detected:
    ✓ mi_check_magic: Checks RPMB magic — returns 0 (present) or 3 (absent)
    ✓ get_lock_state: Main lock state function — reads seccfg + RPMB
    ✓ seccfg_set_lock_state: Writes lock state to seccfg partition
    ✓ rpmb_read: Reads N bytes from RPMB
    ✓ rpmb_write: Writes N bytes to RPMB
    ✓ fastboot_oem_lks: Hidden fastboot OEM lock state commands
    ✓ verify_unlock_sig: RSA signature verification for unlock token

  [FASTBOOT] 8 OEM commands:
    ✓ oem lks @ 0x00099B78
    ✓ oem setmtklks @ 0x00099A38
    ✓ oem chkmtklks @ 0x00099A28
    ✓ flashing get_unlock_ability @ 0x00099BB8
    ✓ flashing unlock @ 0x00099B80
    ✓ flashing lock @ 0x00099B90
    ✓ oem unlock @ 0x00099BA0
    ✓ oem lock @ 0x00099BAC

══════════════════════════════════════════════════════════
  This device is compatible with the RPMB erase + seccfg unlock method.

Operating system

Arch linux

USB port type

USB 3.0/3.1 (blue port)

Did you use a preloader file?

No — let mtkclient auto-detect

What have you already tried?

I think i did every step right and scan_lk.py output says that it is compatible i have no idea why the bootloader stays locked. i even got the dm-verity error which the guide says it is a sign that i did the steps right.

[Jz8Root]

Two things to check before anything else.

1. Your lk_a.bin is 64 MB — that's not a bare LK binary.

A standard LK binary is 2–8 MB. 64 MB is a full partition dump (or super-partition) containing the LK embedded inside other data. scan_lk.py found the magic at 0x00107C74 in that file, which is correct for an LK — but the sector number it reported (57344) is only valid if the file IS the bare LK. If it's a partition dump, the RPMB sector calculation is off and you may have erased the wrong sector.

Also scan lk_b.bin — after an OTA, slot B can carry a different LK build than slot A. Run on both and use the result matching your active slot (fastboot getvar current-slot).

2. Locate the magic directly in your RPMB dump — don't trust the sector from scan_lk.py.

python3 mtk.py da rpmb r rpmb_dump.bin
grep -boa "Jz8PNRUF" rpmb_dump.bin

Output will look like: 14680064:Jz8PNRUF

Your sector = byte_offset / 256. On MT6781 that's 57344, on MT6833 it's 65504 — on MT6769Z we don't know yet. This is the number to pass to --sector.

3. Switch to a USB 2.0 port (black, not blue).

USB 3.x ports cause silent packet corruption on RPMB writes with mtkclient. The dm-verity error confirms your BROM session ran — but the RPMB erase may have silently failed or hit the wrong sector.

Run the grep first and share the output — that'll tell us exactly where the magic is on your device.

[Jz8Root]

any update on this?

[ssg-enjoyer]

using the black usb port i ran :
$ mtk da rpmb r rpmb_dump.bin
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile/iot device to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

...........

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

..Port - Device detected :)
Preloader - Detected regular mode !
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 1CD939782682FA878642C916D9D1015B
Preloader - SOC_ID: 1089A51D60A0833F2F6C9DB45193ECAA79C72E69EC77EC078D997170ADE09FA7
Preloader
Preloader - [LIB]: Auth file is required. Use --auth option.
DaHandler - Device is protected.
DaHandler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: /usr/lib/python3.14/site-packages/mtkclient/payloads/mt6768_payload.bin
Port - Device detected :)
DaHandler
DaHandler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - EMMC FWVer: 0x0
DAXFlash - EMMC ID: Y2P064
DAXFlash - EMMC CID: 9b010059325030363400b20c027a3ad1
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size: 0x0
DAXFlash - EMMC GP2 Size: 0x0
DAXFlash - EMMC GP3 Size: 0x0
DAXFlash - EMMC GP4 Size: 0x0
DAXFlash - EMMC RPMB Size: 0x1000000
DAXFlash - EMMC USER Size: 0xe8f800000
DAXFlash - Extensions were accepted. Jumping to extensions...
DAXFlash - Boot to succeeded.
DAXFlash - DA Extensions successfully added at 0x4fff0000
Main - Handling da commands ...
Progress: |██████████| 100.0% RPMB read: (0x1000000/0x1000000), 83.0 KB/s s left eft
XFlashExt - Done reading rpmb to rpmb_dump.bin
$ grep -boa "Jz8PNRUF" rpmb_dump.bin
14680064:Jz8PNRUF

[Jz8Root]

Perfect, that's exactly the info we needed. Let's finish this.

Your magic sector is confirmed at 57344 (14680064 / 256 = 57344) — same as MT6781 (fleur) and MT6769Z (fire/piotrurban). Consistent with the Samsung UFS 0x400000 layout on the MT6768/MT6769 family. Good.

Also confirmed from your log:

• Kamakiri exploit ran cleanly on mt6768_payload.bin
• BROM-Mode reached
• DA V5 loaded, extensions active
• RPMB read completed at 83 KB/s

Now the actual erase + unlock. Three commands, fresh BROM entry between each:

Step 1 — Erase RPMB magic (4 sectors starting at 57344)

python3 mtk.py da rpmb e --sector 57344 --sectors 4

This overwrites only the magic region. Your rpmb_dump.bin from before is your backup — keep it safe.

Step 2 — Write seccfg to UNLOCK
Fresh BROM entry (unplug → hold Vol+ and Vol- → replug → screen stays black):

python3 mtk.py da seccfg unlock

Look for DaHandler - Successfully wrote seccfg. in the output.

Step 3 — Verify in fastboot
Fully power off the phone. Then hold Vol- while plugging USB to enter fastboot:

fastboot oem lks           # expected: lks = 0
fastboot getvar unlocked   # expected: unlocked: yes
fastboot getvar secure     # expected: secure: no

Step 4 — Clear dm-verity state (MANDATORY on first boot)
The dm-verity "device is corrupt" screen you saw earlier means the unlock is partially applied but userdata is still trusted under the old state. Wipe before booting to system:

fastboot erase userdata
fastboot erase metadata
fastboot reboot

First boot after this goes through the HyperOS setup wizard fresh. Subsequent boots will just show the orange "unlocked" warning for ~10 s, which is normal.

---

One note on your original scan_lk output: it said lk_a.bin was 64 MB, which is a partition dump (the actual LK inside is only ~4 MB). The scanner still found the magic at the right offset inside that dump, but the sector number it reported was speculative. That's why we verified with grep -boa on the RPMB dump — that's the authoritative source. You did that step correctly.

If this works, you'll be the first earth (Redmi 12C, MT6769Z) hardware confirmation. Please post fastboot oem lks output after step 3 and I'll add MT6769Z + Redmi 12C to Tier 1 in COMPATIBILITY.md.

If anything goes sideways at step 1 or 2, share the full log and we'll dig. You're at the last mile.

[ssg-enjoyer]

ok here it is and as you can despite everything seemingly fine it isn't working: $ mtk da rpmb e --sector 57344 --sectors 4
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile/iot device to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

..........Port - Device detected :)
Preloader - Detected regular mode !
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 1CD939782682FA878642C916D9D1015B
Preloader - SOC_ID: 1089A51D60A0833F2F6C9DB45193ECAA79C72E69EC77EC078D997170ADE09FA7
Preloader
Preloader - [LIB]: Auth file is required. Use --auth option.
DaHandler - Device is protected.
DaHandler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: /usr/lib/python3.14/site-packages/mtkclient/payloads/mt6768_payload.bin
Port - Device detected :)
DaHandler
DaHandler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - EMMC FWVer: 0x0
DAXFlash - EMMC ID: Y2P064
DAXFlash - EMMC CID: 9b010059325030363400b20c027a3ad1
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size: 0x0
DAXFlash - EMMC GP2 Size: 0x0
DAXFlash - EMMC GP3 Size: 0x0
DAXFlash - EMMC GP4 Size: 0x0
DAXFlash - EMMC RPMB Size: 0x1000000
DAXFlash - EMMC USER Size: 0xe8f800000
DAXFlash - Extensions were accepted. Jumping to extensions...
DAXFlash - Boot to succeeded.
DAXFlash - DA Extensions successfully added at 0x4fff0000
Main - Handling da commands ...
XFlashExt - Generating sej rpmbkey...
Sej - AES128 CBC - HACC init
Sej - AES128 CBC - HACC run
Sej - AES128 CBC - HACC terminate
XFlashExt - Setting rpmbkey: ok
XFlashExt - Derived rpmb key: 77b39e7629813d6bf4d1d38ebb06a1935e3c175b192306da83e31f0ef1e37050
Done |██████████| 100.0% RPMB erase: (0x400/0x400),0.00 MB/s
XFlashExt - Done erasing rpmb
$ mtk reset
Main - Handling da commands ...
DeviceClass - [Errno 2] Entity not found
Reset command was sent. Disconnect usb cable to power off.
$ mtk da seccfg unlock
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile/iot device to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.

..........Port - Device detected :)
Preloader - Detected regular mode !
Preloader - CPU: MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x707
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 1CD939782682FA878642C916D9D1015B
Preloader - SOC_ID: 1089A51D60A0833F2F6C9DB45193ECAA79C72E69EC77EC078D997170ADE09FA7
Preloader
Preloader - [LIB]: Auth file is required. Use --auth option.
DaHandler - Device is protected.
DaHandler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt6768_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: /usr/lib/python3.14/site-packages/mtkclient/payloads/mt6768_payload.bin
Port - Device detected :)
DaHandler
DaHandler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - EMMC FWVer: 0x0
DAXFlash - EMMC ID: Y2P064
DAXFlash - EMMC CID: 9b010059325030363400b20c027a3ad1
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size: 0x0
DAXFlash - EMMC GP2 Size: 0x0
DAXFlash - EMMC GP3 Size: 0x0
DAXFlash - EMMC GP4 Size: 0x0
DAXFlash - EMMC RPMB Size: 0x1000000
DAXFlash - EMMC USER Size: 0xe8f800000
DAXFlash - Extensions were accepted. Jumping to extensions...
DAXFlash - Boot to succeeded.
DAXFlash - DA Extensions successfully added at 0x4fff0000
Main - Handling da commands ...
XFlashExt - Detected V4 Lockstate
Sej - AES128 CBC - HACC init
Sej - AES128 CBC - HACC run
Sej - AES128 CBC - HACC terminate
Sej - AES128 CBC - HACC init
Sej - AES128 CBC - HACC run
Sej - AES128 CBC - HACC terminate
SecCfgV4 - hwtype found: V4
Sej - AES128 CBC - HACC init
Sej - AES128 CBC - HACC run
Sej - AES128 CBC - HACC terminate
Done |██████████| 100.0% Write: (0x200/0x200),0.00 MB/s
DaHandler - Successfully wrote seccfg.
$ mtk reset
Main - Handling da commands ...
DeviceClass - [Errno 2] Entity not found
Reset command was sent. Disconnect usb cable to power off.
$ fastboot oem lks
(bootloader) lks = 1
OKAY [ 0.011s]
Finished. Total time: 0.011s
$ fastboot getvar unlocked
unlocked: no
Finished. Total time: 0.000s
$ fastboot getvar secure
secure: yes
Finished. Total time: 0.000s
$ fastboot erase userdata
******** Did you mean to fastboot format this f2fs partition?
Erasing 'userdata' FAILED (remote: 'not allowed in locked state')
fastboot: error: Command failed
$ fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.051s

i also get the dm-verity error again. And i think i accidentally used the blue port instead of the black one

[Jz8Root]

Good news: your RPMB erase and seccfg write both reported success at the protocol level, but none of the flags moved (lks=1, unlocked: no, secure: yes — all unchanged). That's the exact USB 3.0 silent corruption signature I flagged in my first comment on this thread — and you caught it yourself at the end: "i think i accidentally used the blue port instead of the black one". The write gets acked by mtkclient's protocol layer but never physically committed to flash on this chipset family over a 3.0 controller.

Here's how to fix it, black (USB 2.0) port only, no exceptions this time:

Step 1 — verify whether the erase actually landed

python3 mtk.py da rpmb r rpmb_dump2.bin
grep -boa "Jz8PNRUF" rpmb_dump2.bin

• If this still prints an offset (e.g. 14680064:Jz8PNRUF) → the erase never landed, redo it.
• If it prints nothing → the erase worked, and the problem is isolated to the seccfg step below.

Step 2 — redo the erase (only if the magic is still there)
Fresh BROM entry (unplug → hold Vol+/Vol- → replug), black port:

python3 mtk.py da rpmb e --sector 57344 --sectors 4

Step 3 — redo seccfg unlock
Fresh BROM entry again — don't chain it directly after step 2 without physically reconnecting — black port:

python3 mtk.py da seccfg unlock

Step 4 — verify before touching userdata

fastboot oem lks           # must read 0
fastboot getvar unlocked   # must read yes
fastboot getvar secure     # must read no

Don't run fastboot erase userdata until all three of those actually flip. Right now they're identical to before you ran anything, which confirms nothing physically committed despite the "Successfully wrote seccfg" log line.

One more thing to rule out: some laptops have a "black" port on the front panel that's internally wired to the xHCI 3.0 controller anyway (bad board routing). If a second attempt on the same port still silently fails, try a different physical port, a USB 2.0 hub, or a different machine entirely.

You're one clean run away from being Tier 1 for earth (Redmi 12C, MT6769Z). Post the fastboot oem lks output once you're through step 4 and I'll add it to COMPATIBILITY.md.