Add cmd for dumping efuses "da efuse". Improve config. Bump to 1.6.0

README.md

@@ -193,6 +193,13 @@ Example:
 python mtk payload --metamode FASTBOOT
 ```
 
+### Read efuses
+
+Example:
+
+```
+python mtk da efuse
+```
 
 ### Unlock bootloader
 

mtk

@@ -4,7 +4,7 @@
 import argparse
 from mtkclient.Library.mtk_main import Main, metamodes
 
-info = "MTK Flash/Exploit Client V1.5.9 (c) B.Kerler 2018-2022"
+info = "MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022"
 
 cmds = {
     "printgpt": "Print GPT Table information",
@@ -93,7 +93,9 @@ if __name__ == '__main__':
     parser_meta = subparsers.add_parser("meta", help="Enter meta mode")
 
     parser_da = subparsers.add_parser("da", help="Run da special commands")
-    da_cmds = parser_da.add_subparsers(dest='subcmd', help='Commands: peek poke keys unlock')
+    da_cmds = parser_da.add_subparsers(dest='subcmd', help='Commands: peek poke keys unlock memdump seccfg rpmb efuse')
+    da_efuse = da_cmds.add_parser("efuse", help="Read efuses")
+    da_efuse.add_argument('--preloader', help='Set the preloader filename for dram config')
     da_peek = da_cmds.add_parser("peek", help="Read memory")
     da_peek.add_argument('--preloader', help='Set the preloader filename for dram config')
     da_dump = da_cmds.add_parser("memdump", help="Dump whole memory areas")
@@ -355,10 +357,7 @@ if __name__ == '__main__':
     parser_ro.add_argument('--parttype', help='Partition type\n' +
                                               '\t\tEMMC: [user, boot1, boot2, gp1, gp2, gp3, gp4, rpmb]' +
                                               '\t\tUFS: [lu0, lu1, lu2, lu0_lu1]')
-
-    parser_ro.add_argument('--filename', help='Optional filename')
     parser_ro.add_argument('--crash', help='Enforce crash if device is in pl mode to enter brom mode')
-    parser_ro.add_argument('--socid', help='Read Soc ID')
 
     parser_w.add_argument('partitionname', help='Partition to write (separate by comma for multiple partitions)')
     parser_w.add_argument('filename', help='Filename for writing (separate by comma for multiple filenames)')

mtkclient/Library/hwcrypto.py

@@ -27,6 +27,7 @@ class crypto_setup:
     meid_addr = None
     socid_addr = None
     prov_addr = None
+    efuse_base = None
 
 
 class hwcrypto(metaclass=LogBase):

mtkclient/Library/mtk_da_cmd.py

@@ -8,7 +8,7 @@ from mtkclient.Library.utils import LogBase, logsetup, getint
 from mtkclient.config.payloads import pathconfig
 from mtkclient.Library.error import ErrorHandler
 from mtkclient.Library.utils import progress
-
+from mtkclient.config.brom_config import efuse
 
 class DA_handler(metaclass=LogBase):
     def __init__(self, mtk, loglevel=logging.INFO):
@@ -529,6 +529,16 @@ class DA_handler(metaclass=LogBase):
                 print(f"Failed to write {partfilename} to sector {str(pos // 0x200)} with " +
                       f"sector count {str(size // 0x200)}.")
 
+    def da_efuse(self):
+        if self.mtk.config.chipconfig.efuse_addr is not None:
+            base = self.mtk.config.chipconfig.efuse_addr
+            hwcode = self.mtk.config.hwcode
+            efuseconfig = efuse(base,hwcode)
+            for idx in range(len(efuseconfig.efuses)):
+                addr = efuseconfig.efuses[idx]
+                data = bytearray(self.mtk.daloader.peek(addr=addr, length=4))
+                self.info(f"EFuse Idx {hex(idx)}: {data.hex()}")
+
     def da_peek(self, addr: int, length: int, filename: str):
         bytestoread = length
         pos = 0
@@ -697,7 +707,7 @@ class DA_handler(metaclass=LogBase):
         elif cmd == "da":
             subcmd = args.subcmd
             if subcmd is None:
-                print("Available da cmds are: [peek, poke, generatekeys, seccfg, rpmb, meta, memdump]")
+                print("Available da cmds are: [peek, poke, generatekeys, seccfg, rpmb, meta, memdump, efuse]")
                 return
             if subcmd == "peek":
                 addr = getint(args.address)
@@ -741,6 +751,8 @@ class DA_handler(metaclass=LogBase):
                 self.da_poke(addr=addr, data=data, filename=filename)
             elif subcmd == "generatekeys":
                 mtk.daloader.keys()
+            elif subcmd == "efuse":
+                self.da_efuse()
             elif subcmd == "seccfg":
                 v = mtk.daloader.seccfg(args.flag)
                 if v[0]:

mtkclient/Library/xflash_ext.py

@@ -489,6 +489,7 @@ class xflashext(metaclass=LogBase):
         setup.blacklist = self.config.chipconfig.blacklist
         setup.gcpu_base = self.config.chipconfig.gcpu_base
         setup.dxcc_base = self.config.chipconfig.dxcc_base
+        setup.efuse_base = self.config.chipconfig.efuse_addr
         setup.da_payload_addr = self.config.chipconfig.da_payload_addr
         setup.sej_base = self.config.chipconfig.sej_base
         setup.read32 = self.readmem

mtkclient/config/brom_config.py

@@ -2,6 +2,205 @@ class damodes:
     DEFAULT = 0
     XFLASH = 1
 
+class efuse:
+    def __init__(self, base, hwcode):
+        if hwcode in [0x6570, 0x6580, 0x321, 0x335]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x60,base+0x180,base+0x184, base+0x188,
+                      base+0x120, base+0x130, base+0x140, base+0x144, base+0x18C,
+                      base+0x190, base+0x194, base+0x198, base+0x19C, base+0x1A0,
+                      0x8000000, base+0x1A4, base+0x1A8,base+0x1AC,base+0x1B0,
+                      base+0x270, base+0x300, base+0x304, base+0x308, base+0x30C,
+                      base+0x310, base+0x314]
+        elif hwcode in [0x551]:
+            self.efuses=[  base + 0x20, base + 0x30, base + 0x38, base + 0x40, base + 0x44,
+                        base + 0x48, base + 0x60, base + 0x260, base + 0x264, base + 0x268,
+                        base + 0x120, base + 0x130, base + 0x140, base + 0x144, base + 0x26C,
+                        base + 0x270, base + 0x274, base + 0x760, base + 0x7A0, 0x8000000,
+                        0x8000000, base + 0x4C, base + 0x50, base + 0x7A4, base + 0x7B0,
+                        base + 0x278, base + 0x27C, base + 0x280, base + 0x284, base + 0x58,
+                        base + 0x54, base + 0x288, 0x8000000, 0x8000000, 0x8000008, base+0x580,
+                        base+0x7C8]
+        elif hwcode in [0x6582, 0x6595, 0x6752, 0x6795, 0x6592]:
+            self.efuses = [base + 0x20, base + 0x30, base + 0x38, base + 0x40, base + 0x44,
+                        base + 0x48, base + 0x60, base + 0x100, base + 0x104, base + 0x108,
+                        base + 0x120, base + 0x130, base + 0x140, base + 0x144, base + 0x170,
+                        base + 0x174, base + 0x178, base + 0x17C, base + 0x180, base + 0x184,
+                        0x8000000, base+0x188, base+0x504, base+0x514,base+0x518,
+                        base+0x51C, base+0x520, base+0x524, base+0x528, base+0x52C,
+                        base+0x530, base+0x534, base+0x538, base+0x540, base+0x544,
+                        base+0x548, base+0x4C4, base+0x4C8]
+        elif hwcode in [0x6572]:
+            self.efuses=[0x40,0x100000,base+0x20,base+0x30,base+0x38,
+                      base+0x40,base+0x44, base+0x48,base+0x60,base+0x100,
+                      base+0x104, base+0x108, base+0x120, base+0x130, base+0x140,
+                      base+0x144, base+0x170, base+0x174, base+0x178, base+0x17C,
+                      base+0x180, base+0x184, 0x8000008, base+0x10C, base+0x110,
+                      base+0x114,base+0x118, base+0x11c]
+        elif hwcode in [0x601, 0x326, 0x6757, 0x8695]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x60,base+0x180,base+0x184, base+0x188,
+                      base+0x120, base+0x130, base+0x140, base+0x144, base+0x18C,
+                      base+0x190, base+0x194, base+0x27C, base+0x540, 0x8000000,
+                      0x8000000, base+0x4C]
+        elif hwcode in [0x688]:
+            self.efuses=[
+                base + 0x514, 0xFFFFFFFF, 0xE030312, base + 0x408, 0xFFFFFFFF,
+                1, base + 0x518, 0xFFFFFFFF, 0xF030313, base + 0x408, 0xFFFFFFFF,
+                2, base + 0x51C, 0xFFFFFFFF, 0x10030314, base + 0x408,
+                0xFFFFFFFF, 3, base + 0x520, 0xFFFFFFFF, 0x11030315,
+                base + 0x408, 0xFFFFFFFF, 4, base + 0x524, 0xFFFFFFFF,
+                0x12030316, base + 0x408, 0xFFFFFFFF, 5, base + 0x850,
+                0xFFFFFFFF, 0x13040317, base + 0x408, 0xFFFFFFFF, 0xFFFFFFFF,
+                base + 0x854, 0xFFFFFFFF, 0x14040318, base + 0x408, 0xFFFFFFFF,
+                0xFFFFFFFF, base + 0x858, 0xFFFFFFFF, 0x15040319, base + 0x408,
+                0xFFFFFFFF, 0xFFFFFFFF, base + 0x85C, 0xFFFFFFFF, 0x1604031A,
+                base + 0x408, 0xFFFFFFFF, 0xFFFFFFFF, base + 0x830, 0x7F,
+                0x1805012A, base + 0x52C, 0x7F000000, 0xFFFFFFFF, base + 0x80C,
+                0xFFFFFFFF, 0x5012B, base + 0x554, 0xFFFFFFFF, 0xFFFFFFFF,
+                base + 0x020, 0x1417, 0x5011B, base + 0x52C, 0x1417, 0xFFFFFFFF,
+                base + 0x060, 0x27F, 0x5011C, base + 0x530, 0x27F, 0xFFFFFFFF,
+                base + 0x4A0, 3, 0x1405011D, base + 0x530, 0x300000, 0xFFFFFFFF,
+                base + 0x4C4, 0xFFFFFFFF, 0x5011E, base + 0x540, 0xFFFFFFFF,
+                6, base + 0x4C8, 0xFFFFFFFF, 0x5011F, base + 0x544, 0xFFFFFFFF,
+                7, base + 0x808, 0x8000, 0x50120, base + 0xA48, 0x8000,
+                0xFFFFFFFF, base + 0x4A4, 8, 0x1C050121, base + 0x550,
+                0x80000000, 0xFFFFFFFF, base + 0x4C0, 1, 0xF050122, base + 0x534,
+                0x8000, 0xFFFFFFFF, base + 0x4CC, 0x1FF, 0x10050123,
+                base + 0x534, 0x1FF0000, 0xFFFFFFFF, base + 0x068, 0x1F,
+                0x7050124, base + 0x534, 0xF80, 0xFFFFFFFF, base + 0x028,
+                6, 0x1C050125, base + 0x530, 0x60000000, 0xFFFFFFFF,
+                base + 0x020, base + 0x030, base + 0x038, base + 0x040, base + 0x044,
+                base + 0x048, base + 0x04C, base + 0x050, 0x8000000, 0x8000000,
+                0xA, 0x8000008, base + 0x140, base + 0x144, base + 0x148,
+                base + 0x14C, base + 0x7A0, base + 0x7A4, base + 0x7A8, base + 0x7AC,
+                0x8000000, base + 0x7B0, base + 0x7B4, base + 0x7B8, base + 0x7BC,
+                base + 0x7C0, base + 0x7C4, base + 0x7C8, base + 0x7CC, 0x1D,
+                0x1E, base + 0x060, base + 0x130, base + 0x11C, base + 0x120,
+                base + 0x260, base + 0x264, base + 0x268
+            ]
+        elif hwcode in [0x699, 0x766]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x4C,base+0x50,0x8000000,base+0x6A4,
+                      0xA,0x8000008, base+0x140, base+0x144, base+0x148,
+                      base+0x14C, base+0x7A0, base+0x7A4, base+0x7A8, base+0x7AC,
+                      0x8000000, base+0x7B0, base+0x7B4,base+0x7B8,base+0x7BC,
+                      base+0x7C0, base+0x7C4, base+0x7C8, base+0x7CC, 0x1D,
+                      0x1E, base+0x60, base+0x130, base+0x100, base+0x120,
+                      0x8000000, 0x8000000, 0x8000000, base+0x6A8, base+0x6AC,
+                      base+0x5BC, base+0x5A8, base+0x580]
+        elif hwcode in [0x788]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x4C,base+0x50,0x8000000,base+0x6A4,
+                      0xA,0x8000008, base+0x140, base+0x144, base+0x148,
+                      base+0x14C, base+0x7A0, base+0x7A4, base+0x7A8, base+0x7AC,
+                      0x8000000, base+0x7B0, base+0x7B4,base+0x7B8,base+0x7BC,
+                      base+0x7C0, base+0x7C4, base+0x7C8, base+0x7CC, 0x1D,
+                      0x1E, base+0x60, base+0x130, base+0x11C, base+0x120,
+                      base+0x260, base+0x264, base+0x268, base+0x6A8, base+0x6AC,
+                      base+0x5BC, base+0x580, base+0x928, base+0x810, base+0x430,
+                      base+0x40c, 0x20200, base+0x430, base+0x40c, 0x30301,
+                      base+0x430, base+0x40C, 0x40402, base+0x430, base+0x40C,
+                      0x50503, base+0x430, base+0x40C, 0x60604, base+0x70]
+        elif hwcode in [0x717]:
+            self.efuses = [base + 0x20, base + 0x30, base + 0x38, base + 0x40, base + 0x44,
+                    base + 0x48, base + 0x4C, base + 0x50, 0x8000000, base + 0x6A4,
+                    0xA, 0x8000008, base + 0x140, base + 0x144, base + 0x148,
+                    base + 0x14C, base + 0x7A0, base + 0x7A4, base + 0x7A8, base + 0x7AC,
+                    0x8000000, base + 0x7B0, base + 0x7B4, base + 0x7B8, base + 0x7BC,
+                    base + 0x7C0, base + 0x7C4, base + 0x7C8, base + 0x7CC, 0x1D,
+                    0x1E, base + 0x60, base + 0x130, base + 0x100, base + 0x120,
+                    base + 0x598, 0x8000000, 0x8000000, base + 0x6A8, base + 0x6AC,
+                    base + 0x5BC, base + 0x5A8, base + 0x580]
+        elif hwcode in [0x690]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x4C,base+0x50,0x8000000,base+0x6A4,
+                      0xA,0x8000008, base+0x140, base+0x144, base+0x148,
+                      base+0x14C, base+0x7A0, base+0x7A4, base+0x7A8, base+0x7AC,
+                      0x8000000, base+0x7B0, base+0x7B4,base+0x7B8,base+0x7BC,
+                      base+0x7C0, base+0x7C4, base+0x7C8, base+0x7CC, 0x1D,
+                      0x1E, base+0x60, base+0x130, base+0x100, base+0x120,
+                      base+0x260, base+0x264, base+0x268, base+0x6A8, base+0x6AC]
+        elif hwcode in [0x707, 0x725, 0x813]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x4C,base+0x50,base+0x6A0,base+0x6A4,
+                      0xA,0x8000008, base+0x140, base+0x144, base+0x148,
+                      base+0x14C, base+0x7A0, base+0x7A4, base+0x7A8, base+0x7AC,
+                      0x8000000, base+0x7B0, base+0x7B4,base+0x7B8,base+0x7BC,
+                      base+0x7C0, base+0x7C4, base+0x7C8, base+0x7CC, 0x1D,
+                      0x1E, base+0x60, base+0x130, base+0x11C, base+0x120,
+                      base+0x260, base+0x264, base+0x268, base+0x6A8, base+0x6AC,
+                      base+0x5b4, base+0x5b8, base+0x5bc, base+0x5c0, base+0x5c4,
+                      base+0x5c8, base+0x5cc, base+0x5d0, base+0x5d4, base+0x5d8,
+                      base+0x5dc, base+0x5e0, base+0x580]
+        elif hwcode in [0x279]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x60,base+0x180,base+0x184,base+0x188,
+                      base+0x120, base+0x130, base+0x140, base+0x144, base+0x18C,
+                      base+0x190, base+0x194, base+0x71C, base+0x720, base+0x710,
+                      0x8000000, base+0x4C, base+0x50,base+0x54,base+0x58,
+                      base+0x198, base+0x19c, base+0x1A0, base+0x1A4, 0x1A8,
+                      base+0x714, base+0x718, base+0x724, base+0x8D8, 0x8000008]
+        elif hwcode in [0x562]:
+            self.efuses = [base + 0x20, base + 0x30, base + 0x38, base + 0x40, base + 0x44,
+                        base + 0x48, base + 0x4C, base + 0x260, base+0x264, base + 0x268,
+                        0xA, base+0x130, base + 0x140, base + 0x144, base + 0x148,
+                        base + 0x14C, base + 0x7A8, base + 0x7AC, base + 0x7A0, base + 0x11C,
+                        0x8000000, base + 0x4C, base + 0x50, base + 0x7A4, base + 0x7B0,
+                        base + 0x120, base + 0x7B4, base + 0x7B8, base + 0x7BC, 0x1D,
+                        0x1E, base + 0x288, base + 0x7CC, base + 0x770, 0x8000008,
+                        base + 0x7C0, base + 0x7C4, base + 0x7C8, base + 0x94C]
+        elif hwcode in [0x989, 0x996, 0x816]:
+            self.efuses=[base+0x20,base+0x30,base+0x38,base+0x40,base+0x44,
+                      base+0x48,base+0x4C,base+0x50,base+0x6A0,base+0x6A4,
+                      0xA,0x8000008, base+0x140, base+0x144, base+0x148,
+                      base+0x14C, base+0x7A0, base+0x7A4, base+0x7A8, base+0x7AC,
+                      0x8000000, base+0x7B0, base+0x7B4,base+0x7B8,base+0x7BC,
+                      base+0x7C0, base+0x7C4, base+0x7C8, base+0x7CC, 0x1D,
+                      0x1E, base+0x60, base+0x130, base+0x11C, base+0x120,
+                      base+0x260, base+0x264, base+0x268, base+0x6A8, base+0x6AC,
+                      base+0x5b4, base+0x5b8, base+0x5bc, base+0x5c0, base+0x5c4,
+                      base+0x5c8, base+0x5cc, base+0x5d0, base+0x5d4, base+0x5d8,
+                      base+0x5dc, base+0x5e0, base+0x580, base+0x5E4, base+0x5e8]
+        elif hwcode in [0x8163]:
+            self.efuses = [base + 0x20, base + 0x30, base + 0x38, base + 0x40, base + 0x44,
+                        base + 0x48, base + 0x60, base + 0x100, base + 0x104, base + 0x108,
+                        base+ 0x120, base+0x130, base + 0x140, base + 0x144, base + 0x170,
+                        base + 0x174, base + 0x178, base + 0x17C, base + 0x180, base + 0x184,
+                        0x8000000, base + 0x188, base + 0x1B0, base + 0x1B4, base + 0x1B8,
+                        base + 0x1BC, base + 0x1C0, base + 0x1C4, base + 0x1C8, base + 0x1CC,
+                        base + 0x4C, base + 0x50, base + 0x54, base + 0x90, base + 0x94,
+                        base + 0x98, base + 0x9C, base + 0xA0, base + 0xA4, base + 0xA8,
+                        base + 0xAC]
+        elif hwcode in [0x8167]:
+            self.efuses = [base+0x20, base+0x30, base+0x38, base+0x40, base+0x44,
+                        0x8000000, base+0x60, base+0x260, base+0x264, base+0x268,
+                        base+0x120, base+0x130, base+0x140, base+0x144, base+0x26C,
+                        base+0x270, base+0x274, base+0x278, base+0x27C, base+0x280,
+                        0x8000000, base+0x284, base+0x850, base+0x854, base+0x858,
+                        base+0x85C, base+0x860, base+0x864, base+0x868, base+0x86C,
+                        base+0x320, 0x8000008, base+0x560, base+0x90, base+0x94,
+                        base+0x98, base+0x9C, base+0xA0, base+0xA4, base+0xA8,
+                        base+0xAC, base+0x250, base+0x254, base+0x258, base+0x25C,
+                        base+0x300, base+0x304, base+0x308, base+0x30C, 0x8000000,
+                        base+0x310, base+0x540, base+0x544, base+0x548, base+0x54C,
+                        base+0x550, base+0x558, base+0x55C, base+0x050, 0x8000000,
+                        base+0x180, base+0x184, base+0x188, base+0x18C, base+0x190,
+                        base+0x194, base+0x198, base+0x580, base+0x584, base+0x588,
+                        base+0x58C, base+0x590, base+0x594, base+0x598, base+0x068,
+                        base+0x028, base+0x070, base+0x074, base+0x078, base+0x07C
+                        ]
+        elif hwcode in [0x8176]:
+            self.efuses = [base + 0x20, base + 0x30, base + 0x38, base + 0x40, base + 0x44,
+                        base + 0x274, base + 0x60, base + 0x100, base + 0x104, base + 0x108,
+                        base + 0x120, base + 0x130, base + 0x140, base + 0x144, base + 0x170,
+                        base + 0x174, base + 0x178, base + 0x17C, base + 0x180, base + 0x184,
+                        0x8000000, base + 0x188, base + 0x504, base + 0x514, base + 0x700,
+                        base + 0x704, base + 0x708, base + 0x70C, base + 0x528, base + 0x52C,
+                        base + 0x530, base + 0x534, base + 0x538, base + 0x540, base + 0x544,
+                        base + 0x548, base + 0x4C4, base + 0x4C8, base + 0x4B0, base + 0x4B8,
+                        base + 0x90, base + 0x94, base + 0x98, base + 0x9C, base + 0xA0,
+                        base + 0xA4, base + 0xA8, base + 0xAC]
 
 class chipconfig:
     def __init__(self, var1=None, watchdog=None, uart=None, brom_payload_addr=None,
@@ -9,7 +208,8 @@ class chipconfig:
                  gcpu_base=None, ap_dma_mem=None, name="", description="", dacode=None,
                  meid_addr=None, socid_addr=None, blacklist=(), blacklist_count=None,
                  send_ptr=None, ctrl_buffer=(), cmd_handler=None, brom_register_access=None,
-                 damode=damodes.DEFAULT, loader=None, prov_addr=None, misc_lock=None):
+                 damode=damodes.DEFAULT, loader=None, prov_addr=None, misc_lock=None,
+                 efuse_addr=None):
         self.var1 = var1
         self.watchdog = watchdog
         self.uart = uart
@@ -37,6 +237,7 @@ class chipconfig:
         self.damode = damode
         self.loader = loader
         self.misc_lock = misc_lock
+        self.efuse_addr = efuse_addr
 
     # Credits to cyrozap and Chaosmaster for some values
     """
@@ -248,9 +449,10 @@ hwconfig = {
         # no dxcc
         cqdma_base=0x1020ac00,
         ap_dma_mem=0x11000000 + 0x1A0,  # AP_P_DMA_I2C_RX_MEM_ADDR
+        efuse_addr=0x10009000,
         damode=damodes.XFLASH,
         dacode=0x6570,
-        name="MT6570"),
+        name="MT6570/MT8321"),
     0x6571: chipconfig(  # var1
         watchdog=0x10007400,
         # uart
@@ -286,6 +488,7 @@ hwconfig = {
         brom_register_access=(0x40bd48, 0x40befc),
         meid_addr=0x11142C34,
         misc_lock=0x1000141C,
+        efuse_addr=0x10009000,
         damode=damodes.DEFAULT,  #
         dacode=0x6572,
         name="MT6572",
@@ -349,6 +552,7 @@ hwconfig = {
                        ctrl_buffer=0x00103060,
                        cmd_handler=0x0000C113,
                        brom_register_access=(0xb8e0, 0xba94),
+                       efuse_addr=0x10206000,
                        misc_lock=0x10001838,
                        meid_addr=0x1030B4,
                        damode=damodes.DEFAULT,
@@ -373,11 +577,12 @@ hwconfig = {
         ctrl_buffer=0x00103078,
         cmd_handler=0x0000B2E7,
         brom_register_access=(0xa8d0, 0xaa84),
+        efuse_addr=0x10206000,
         meid_addr=0x1030CC,
         misc_lock=0x10002050,
         damode=damodes.DEFAULT,  #
         dacode=0x6582,
-        name="MT6582/MT6574",
+        name="MT6582/MT6574/MT8382",
         loader="mt6582_payload.bin"),
     0x6583: chipconfig(  # var1
         watchdog=0x10000000,  # fixme
@@ -415,9 +620,10 @@ hwconfig = {
         brom_register_access=(0xa838, 0xa9ec),
         meid_addr=0x1030A8,
         misc_lock=0x10002050,
+        efuse_addr=0x10206000,
         dacode=0x6592,
         damode=damodes.DEFAULT,  #
-        name="MT6592",
+        name="MT6592/MT8392",
         loader="mt6592_payload.bin"),
     0x6595: chipconfig(var1=0xA,
                        watchdog=0x10007000,
@@ -436,6 +642,7 @@ hwconfig = {
                        cmd_handler=0x0000BD53,
                        brom_register_access=(0xb4ec, 0xb6a0),
                        meid_addr=0x1030A4,
+                       efuse_addr=0x10206000,
                        dacode=0x6595,
                        damode=damodes.DEFAULT,  #
                        name="MT6595",
@@ -461,6 +668,7 @@ hwconfig = {
         brom_register_access=(0x98cc, 0x9a94),
         meid_addr=0x1030B0,
         misc_lock=0x10001838,
+        efuse_addr=0x11c50000,
         damode=damodes.DEFAULT,  #
         dacode=0x6735,
         name="MT6735/T,MT8735A",
@@ -484,9 +692,10 @@ hwconfig = {
         cmd_handler=0x0000A18F,
         brom_register_access=(0x98dc, 0x9aa4),
         meid_addr=0x1030B0,
+        efuse_addr=0x10206000,
         damode=damodes.DEFAULT,  #
         dacode=0x6735,
-        name="MT6737M",
+        name="MT6737M/MT6735G",
         loader="mt6737_payload.bin"),
     # MT6738
     0x699: chipconfig(
@@ -511,9 +720,10 @@ hwconfig = {
         socid_addr=0x102b08,
         prov_addr=0x10720C,
         misc_lock=0x1001a100,
+        efuse_addr=0x11c00000,
         damode=damodes.XFLASH,
         dacode=0x6739,
-        name="MT6739/MT6731",
+        name="MT6739/MT6731/MT8765",
         loader="mt6739_payload.bin"),
     0x601: chipconfig(
         var1=0xA,
@@ -527,6 +737,7 @@ hwconfig = {
         cqdma_base=0x10212C00,
         ap_dma_mem=0x11000000 + 0x1A0,  # AP_DMA_I2C_1_RX_MEM_ADDR
         # blacklist
+        efuse_addr=0x10206000,
         misc_lock=0x10001838,
         damode=damodes.XFLASH,
         dacode=0x6755,
@@ -543,6 +754,7 @@ hwconfig = {
         cqdma_base=0x10212C00,
         ap_dma_mem=0x11000000 + 0x1A0,  # AP_DMA_I2C_0_RX_MEM_ADDR
         # blacklist
+        efuse_addr=0x10206000,
         damode=damodes.DEFAULT,  #
         dacode=0x6752,
         name="MT6752"),
@@ -589,6 +801,7 @@ hwconfig = {
         cmd_handler=0x0000A5FF,
         brom_register_access=(0x9d4c, 0x9f14),
         meid_addr=0x1030AC,
+        efuse_addr=0x10206000,
         damode=damodes.XFLASH,
         dacode=0x6755,
         name="MT6755/MT6750/M/T/S",
@@ -614,6 +827,7 @@ hwconfig = {
         brom_register_access=(0xa030, 0xa0e8),
         meid_addr=0x1030B4,
         misc_lock=0x10001838,
+        efuse_addr=0x10206000,
         damode=damodes.XFLASH,
         dacode=0x6757,
         name="MT6757/MT6757D",
@@ -639,6 +853,7 @@ hwconfig = {
         brom_register_access=(0xdc74, 0xdd2c),
         meid_addr=0x102bf8,
         socid_addr=0x102c08,
+        efuse_addr=0x10450000,
         damode=damodes.XFLASH,
         dacode=0x6758,
         name="MT6758",
@@ -692,6 +907,7 @@ hwconfig = {
         socid_addr=0x102b08,
         prov_addr=0x1054F4,
         misc_lock=0x1001a100,
+        efuse_addr=0x11c50000,
         damode=damodes.XFLASH,
         dacode=0x6761,
         name="MT6761/MT6762/MT3369/MT8766B",
@@ -719,6 +935,7 @@ hwconfig = {
         socid_addr=0x102b88,
         prov_addr=0x106804,
         misc_lock=0x1001a100,
+        efuse_addr=0x11f10000,
         damode=damodes.XFLASH,
         dacode=0x6763,
         name="MT6763",
@@ -746,6 +963,7 @@ hwconfig = {
         socid_addr=0x102b08,
         prov_addr=0x1054F4,
         misc_lock=0x1001a100,
+        efuse_addr=0x11c50000,
         damode=damodes.XFLASH,
         dacode=0x6765,
         name="MT6765/MT8768t",
@@ -773,9 +991,10 @@ hwconfig = {
         socid_addr=0x102b08,
         prov_addr=0x1054F4,
         misc_lock=0x1001a100,
+        efuse_addr=0x11ce0000,
         damode=damodes.XFLASH,
         dacode=0x6768,
-        name="MT6768",
+        name="MT6768/MT6769",
         description="Helio P65/G85 k68v1",
         loader="mt6768_payload.bin"),
     0x788: chipconfig(
@@ -800,6 +1019,7 @@ hwconfig = {
         socid_addr=0x102B48,
         prov_addr=0x1065C0,
         misc_lock=0x1001a100,
+        efuse_addr=0x11f10000,
         damode=damodes.XFLASH,
         dacode=0x6771,
         name="MT6771/MT8385/MT8183/MT8666",
@@ -837,6 +1057,7 @@ hwconfig = {
                       socid_addr=0x102B48,
                       prov_addr=0x1065C0,
                       misc_lock=0x1001a100,
+                      efuse_addr=0x11c10000,
                       damode=damodes.XFLASH,
                       dacode=0x6779,
                       name="MT6779",
@@ -862,6 +1083,7 @@ hwconfig = {
         brom_register_access=(0xe9dc, 0xea94),
         meid_addr=0x102B98,
         socid_addr=0x102BA8,
+        efuse_addr=0x11cb0000,
         damode=damodes.XFLASH,
         dacode=0x6781,
         name="MT6781",
@@ -889,6 +1111,7 @@ hwconfig = {
                       socid_addr=0x102B48,
                       prov_addr=0x1065C0,
                       misc_lock=0x1001a100,
+                      efuse_addr=0x11c10000,
                       damode=damodes.XFLASH,
                       dacode=0x6785,
                       name="MT6785",
@@ -913,6 +1136,7 @@ hwconfig = {
         cmd_handler=0x0000A313,  #
         brom_register_access=(0x9a60, 0x9c28),
         meid_addr=0x1030A0,
+        efuse_addr=0x10206000,
         damode=damodes.DEFAULT,  #
         dacode=0x6795,
         name="MT6795",
@@ -938,6 +1162,7 @@ hwconfig = {
         brom_register_access=(0xa18c, 0xa354),
         meid_addr=0x1030AC,
         misc_lock=0x10002050,
+        efuse_addr=0x10206000,
         damode=damodes.XFLASH,
         dacode=0x6797,
         name="MT6797/MT6767",
@@ -963,6 +1188,7 @@ hwconfig = {
         brom_register_access=(0xf9c0, 0xfa78),
         meid_addr=0x1033B8,
         socid_addr=0x1033C8,
+        efuse_addr=0x11F10000,
         damode=damodes.XFLASH,
         dacode=0x6799,
         name="MT6799",
@@ -989,6 +1215,7 @@ hwconfig = {
         meid_addr=0x102b98,
         socid_addr=0x102ba8,
         prov_addr=0x1066B4,
+        efuse_addr=0x11c10000,
         damode=damodes.XFLASH,
         dacode=0x6833,
         name="MT6833",
@@ -1015,6 +1242,7 @@ hwconfig = {
                       socid_addr=0x102b88,
                       prov_addr=0x1066C0,
                       misc_lock=0x1001A100,
+                      efuse_addr=0x11c10000,
                       damode=damodes.XFLASH,
                       dacode=0x6853,
                       name="MT6853",
@@ -1042,6 +1270,7 @@ hwconfig = {
         socid_addr=0x102B88,
         prov_addr=0x1066C0,
         misc_lock=0x1001A100,
+        efuse_addr=0x11c10000,
         damode=damodes.XFLASH,
         dacode=0x6873,
         name="MT6873",
@@ -1068,6 +1297,7 @@ hwconfig = {
         meid_addr=0x102b98,
         socid_addr=0x102ba8,
         prov_addr=0x1066C0,
+        efuse_addr=0x11f10000,
         damode=damodes.XFLASH,
         dacode=0x6877,  # todo
         name="MT6877",
@@ -1096,6 +1326,7 @@ hwconfig = {
         socid_addr=0x102B88,
         prov_addr=0x1066C0,
         misc_lock=0x1001A100,
+        efuse_addr=0x11c10000,
         damode=damodes.XFLASH,
         dacode=0x6885,
         name="MT6885/MT6883/MT6889/MT6880/MT6890",
@@ -1122,6 +1353,7 @@ hwconfig = {
         meid_addr=0x102B98,
         socid_addr=0x102BA8,
         prov_addr=0x1066C0,
+        efuse_addr=0x11c10000,
         damode=damodes.XFLASH,
         dacode=0x6893,
         name="MT6893",
@@ -1222,6 +1454,7 @@ hwconfig = {
         brom_register_access=(0xc400, 0xc5c8),
         meid_addr=0x1031C0,
         misc_lock=0x10002050,
+        efuse_addr=0x10206000,
         damode=damodes.DEFAULT,  #
         dacode=0x8163,
         name="MT8163",
@@ -1245,6 +1478,7 @@ hwconfig = {
                        brom_register_access=(0xd6f2, 0xd7ac),
                        meid_addr=0x103478,
                        socid_addr=0x103488,
+                       efuse_addr=0x10009000,
                        damode=damodes.XFLASH,
                        dacode=0x8167,
                        name="MT8167/MT8516/MT8362",
@@ -1269,6 +1503,7 @@ hwconfig = {
         brom_register_access=(0x13c18, 0x13d78),
         meid_addr=0x106438,
         socid_addr=0x106448,
+        efuse_addr=0x10009000,
         damode=damodes.XFLASH,
         dacode=0x8168,
         name="MT8168/MT6357",
@@ -1320,6 +1555,7 @@ hwconfig = {
         meid_addr=0x1230B0,
         misc_lock=0x1202050,
         # socid_addr
+        efuse_addr=0x10206000,
         dacode=0x8173,
         damode=damodes.DEFAULT,
         # description
@@ -1344,6 +1580,7 @@ hwconfig = {
         # brom_register_access
         # meid_addr
         # socid_addr
+        efuse_addr=0x11c10000,
         misc_lock=0x1001A100,
         dacode=0x8195,
         damode=damodes.XFLASH,
@@ -1370,6 +1607,7 @@ hwconfig = {
         brom_register_access=(0xd034, 0xd194),
         meid_addr=0x104638,
         socid_addr=0x104648,
+        efuse_addr=0x11c50000,
         dacode=0x8512,
         damode=damodes.XFLASH,
         # description
@@ -1393,6 +1631,7 @@ hwconfig = {
         # brom_register_access
         # meid_addr
         # socid_addr
+        efuse_addr=0x10009000,
         dacode=0x8518,
         damode=damodes.XFLASH,
         name="MT8518 VoiceAssistant"
@@ -1439,6 +1678,7 @@ hwconfig = {
         cmd_handler=0x0000CAA7,
         brom_register_access=(0xc298, 0xc3f8),
         meid_addr=0x1032B8,
+        efuse_addr=0x10206000,
         damode=damodes.XFLASH,
         dacode=0x8695,
         name="MT8695",  # mantis
@@ -1462,6 +1702,7 @@ hwconfig = {
         # brom_register_access
         # meid_addr
         # socid_addr
+        efuse_addr=0x11c10000,
         damode=damodes.XFLASH,
         dacode=0x8696,
         # description

setup.py

@@ -4,7 +4,7 @@ import os
 
 setup(
     name='mtkclient',
-    version='1.5.9',
+    version='1.6.0',
     packages=find_packages(),
     long_description=open("README.md").read(),
     scripts=['mtk','stage2'],