SM-X230 / HW 0x1375: BROM loop with DAA enabled — supported recovery path or further diagnostics? #394

astrobyte-dev · 2026-10-10T10:24:02Z

astrobyte-dev
Oct 10, 2026

I'm looking for guidance on the appropriate mtkclient diagnostic/recovery path for a Samsung Galaxy Tab A11+ SM-X230 stuck in BROM.

This is a support question, not a confirmed mtkclient bug. We have inspected the source but have not yet run mtkclient's initialization or exploit routines against the tablet.

Device and symptoms

Samsung Galaxy Tab A11+, SM-X230, acquired second-hand in this condition.
Completely black screen; no visible logo, charging indicator, recovery or Download Mode.
Windows 11 detects USB\VID_0E8D&PID_0003 as COM3.
Approximately 4.5 seconds connected, 1.4 seconds disconnected, repeating without host commands.
Firmware version, Samsung BIT revision and CSC are unknown.
No firmware or DA has been uploaded; no storage writes or erases performed.
Case remains unopened.

Direct serial diagnostics

We used a small PowerShell script with System.IO.Ports.SerialPort, 115200 baud, 8N1, to capture protocol responses without mtkclient's automatic initialization.

Handshake:
  TX A0 0A 50 05
  RX 5F F5 AF FA

GET_HW_CODE (FD):
  13 75 00 00
  HW code: 0x1375
  Status: 0x0000

GET_HW_SW_VER (FC):
  8A 00 CA 00 00 00 00 00

GET_VERSION (FF):
  05

GET_BL_VER (FE):
  FE — interpreted as BROM

GET_TARGET_CONFIG (D8):
  00 00 00 E5 00 00
  Config: 0xE5
  Status: 0x0000

  SBC: enabled
  SLA: disabled at this interface
  DAA: enabled
  Memory-read authentication: enabled
  Memory-write authentication: enabled
  C8 blocked: enabled

READ32 (D1), address 0, count 1:
  Status 0x1D08; no memory data returned

JUMP_BL (D6):
  Echo received
  Status words: 0000 / 0000
  USB disconnected, then returned as the same BROM port

Hardware code 0x1375 maps to MT6878 in the inspected configuration; Samsung identifies the tablet platform as MT8775.

ROM log

Both DF and legacy DD returned this 106-byte log:

F0: 102B 0000
F3: 1001 0000 [0200]
F3: 1001 0000
F7: 0000 0000
V0: 0000 0000 [0001]
DC: 0000 0000

Captured logs remained identical after JUMP_BL and after physically disconnecting/reconnecting the tablet.

Charging, an unplugged long-power-button attempt, and a Windows USB-device restart produced no detectable improvement. Actual battery power removal has not been performed.

Source inspection so far

mtkclient commit inspected:

cd25cf9c1ff6d36e82697ac2c798e69e9cfb78c3

Our inspection found:

No 0x1375 entry in the bundled DA binaries checked.
Several exploit-related pointers absent/commented out in the 0x1375 configuration.
The inspected XML DA-stage exploit paths appear to require an accepted DA first.

These are our interpretations of the source, not proof that all available methods are unsupported or that the tablet's BROM is patched.

Questions

What exact mtkclient command/options would you recommend for a useful initial diagnostic log on this device? Can automatic watchdog/register writes and DA loading be controlled for that first attempt?
Is there an applicable BROM exploit or recovery path for 0x1375 with this security configuration that we have overlooked?
Is a Samsung-compatible signed DA required before the currently supported DA-stage methods become usable?
Does the ROM log or the accepted JUMP_BL followed by return to BROM help distinguish a firmware problem from storage/power failure?

I'm the device owner and accept the risk of experimental recovery. My goal is to restore boot, not remove an account lock. I can provide the serial script, raw logs and further captures.

Thanks for any guidance.

Navigation Menu

Repository navigation

SM-X230 / HW 0x1375: BROM loop with DAA enabled — supported recovery path or further diagnostics? #394

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

SM-X230 / HW 0x1375: BROM loop with DAA enabled — supported recovery path or further diagnostics? #394

Uh oh!

Uh oh!

astrobyte-dev Oct 10, 2026

Device and symptoms

Direct serial diagnostics

ROM log

Source inspection so far

Questions

Replies: 0 comments

astrobyte-dev
Oct 10, 2026