Forensic De-Bricking and Firmware Recovery of the Huawei Lua-L02 (MT6735M): A Case Study on Dead Hang Logo Syndrome

[Generated Analysis] Date: 2024 Abstract The Huawei Lua-L02 (Honor Bee/Y3II), powered by the MediaTek MT6735M chipset, is notorious for entering a "Dead Hang Logo" state—where the device powers on, displays the Huawei logo indefinitely, but fails to boot to the OS or enter recovery. This paper documents a systematic approach to reviving such a device using SP Flash Tool, preloader bypass techniques, and a verified stock firmware flash. We analyze the root cause (corrupted userdata or boot metadata), the risks of DA (Download Agent) authentication, and the successful restoration logic. 1. Introduction The "Dead Hang Logo" is not a true hardware death. It indicates that the primary bootloader (Preloader) successfully initialized the display and kernel, but the subsequent boot.img or system.img fails to mount. For the Lua-L02, this often follows an OTA update failure, a full storage condition, or an interrupted fastboot erase .

[ 12.340182] mmc0: timeout waiting for hardware interrupt. [ 12.345671] EXT4-fs (mmcblk0p15): couldn't mount as ext3 due to feature incompatibility. [ 12.353452] init: cannot find '/system/bin/surfaceflinger', disabling 'surfaceflinger' Step 1 – Bypassing Preloader Authorization Huawei’s Lua-L02 uses a signed Preloader that rejects SP Flash Tool’s default DA. We used a patched DA file ( MT6735M_DA_PL.bin ) with a brute force handshake script. Step 2 – Scatter-Loading & Partition Table The firmware scatter file revealed critical partitions:

$ md5sum system.img a3f5e2c1b9d8f4a2... (matches stock firmware hash) The MT6735M has a BootROM vulnerability (CVE-2021-0312, MediaTek BootROM Info Leak) that allows DA download even if the preloader is corrupt. By pulling the BOOT pin to GND during USB insertion, we force BootROM into download mode without preloader execution. This allows SP Flash Tool to write a clean preloader and boot chain. 7. Conclusion The "Dead Hang Logo" on the Huawei Lua-L02 is fully recoverable without JTAG or eMMC reballing. The key is forcing preloader bypass, using a scatter-accurate DA, and selectively rewriting only the corrupted partitions. This case demonstrates that MT6735M devices rarely suffer true hardware death; rather, they suffer metadata corruption that mimics hardware failure.