Bootloader still verify vbmeta after unlocked

[telecomadm1145]

Phone: Redmi Note 10 Pro 5G

OS: MIUI 14

Log:

Microsoft Windows [版本 10.0.22631.4602]
(c) Microsoft Corporation。保留所有权利。

C:\Users\15874\Downloads\mtkclient-127c353b397bd2681f63d3b16fd5b3dfa369e8e6>python mtk.py da seccfg unlock
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...........

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...........

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


......Port - Device detected :)
Preloader -     CPU:                    MT6893(Dimensity 1200)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212000
Preloader -     Var1:                   0xa
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x950
Preloader - Target config:              0xe7
Preloader -     SBC enabled:            True
Preloader -     SLA enabled:            True
Preloader -     DAA enabled:            True
Preloader -     SWJTAG enabled:         True
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          True
Preloader -     Mem write auth:         True
Preloader -     Cmd 0xC8 blocked:       True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xca00
Preloader -     SW Ver:                 0x0
Preloader - ME_ID:                      65221E292D6DE2403F66ECD277EEFFC4
Preloader - SOC_ID:                     C99A7013C9A3074FAADDF6974D7CCD9050662DA9F7C379C90C1EF9452A56303A
Preloader
Preloader - [LIB]: Auth file is required. Use --auth option.
DaHandler - Device is protected.
DaHandler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt6893_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: C:\Users\15874\Downloads\mtkclient-127c353b397bd2681f63d3b16fd5b3dfa369e8e6\mtkclient\payloads\mt6893_payload.bin
Port - Device detected :)
DaHandler
DaHandler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS ID:       KLUEG8UHDC-B0E
DAXFlash - UFS MID:      0xce
DAXFlash - UFS CID:      ce014b4c55454738554844432d423045
DAXFlash - UFS FWVer:    30323030
DAXFlash - UFS Serial:   353439393939393861653165
DAXFlash - UFS LU0 Size: 0x3b96000000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - HW-CODE         : 0x950
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCA00
DAXFlash - SW-VERSION      : 0x0
DAXFlash - CHIP-EVOLUTION  : 0x1
DAXFlash - DA-VERSION      : 1.0
DAXFlash - Extensions were accepted. Jumping to extensions...
DAXFlash - Boot to succeeded.
DAXFlash - DA Extensions successfully added
XFlashExt - Detected V4 Lockstate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
DaHandler
DaHandler - [LIB]: Device is already unlocked

C:\Users\15874\Downloads\mtkclient-127c353b397bd2681f63d3b16fd5b3dfa369e8e6>python mtk.py da seccfg lock
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

DAXFlash - HW-CODE         : 0x950
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCA00
DAXFlash - SW-VERSION      : 0x0
DAXFlash - CHIP-EVOLUTION  : 0x1
DAXFlash - DA-VERSION      : 1.0
XFlashExt - Detected V4 Lockstate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Progress: |██████████| 100.0% Write (0x1/0x1, ) 0.05 MB/s
DaHandler - Successfully wrote seccfg.

C:\Users\15874\Downloads\mtkclient-127c353b397bd2681f63d3b16fd5b3dfa369e8e6>python mtk.py da seccfg unlock
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

DAXFlash - HW-CODE         : 0x950
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCA00
DAXFlash - SW-VERSION      : 0x0
DAXFlash - CHIP-EVOLUTION  : 0x1
DAXFlash - DA-VERSION      : 1.0
XFlashExt - Detected V4 Lockstate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Progress: |██████████| 100.0% Write (0x1/0x1, ) 0.06 MB/s
DaHandler - Successfully wrote seccfg.

C:\Users\15874\Downloads\mtkclient-127c353b397bd2681f63d3b16fd5b3dfa369e8e6>python mtk.py r seccfg seccfg.img
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

DAXFlash - HW-CODE         : 0x950
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCA00
DAXFlash - SW-VERSION      : 0x0
DAXFlash - CHIP-EVOLUTION  : 0x1
DAXFlash - DA-VERSION      : 1.0
DaHandler - Requesting available partitions ....
DaHandler - Dumping partition "seccfg"
Progress: |██████████| 100.0% Read (0x4000/0x4000, ) 24.97 MB/s
DaHandler - Dumped sector 77824 with sector count 2048 as seccfg.img.

C:\Users\15874\Downloads\mtkclient-127c353b397bd2681f63d3b16fd5b3dfa369e8e6>

seccfg.zip

flashing either empty vbmeta or patched vbmeta won't work, the bootloader still verifies it.