I have bricked my brand new BraX3 phone. How can I fix it?

BraX3
1

Hello,

I received this week my brand new BraX3 phone. Thank you very much !
After I received it, I connected it to the wifi and installed the June update of iodéOS (OTA update).
Then, from my computer (on Arch Linux), I tried to unlock the bootloader (following these instructions, but after I executed fastboot flashing unlock and fastboot flashing unlock_critical (confirming with Volume Up) and restarted, the phone entered a boot loop.
I then used the SP Flash tool to “Readback” all partitions in auto mode (except the userdata partition). This succeeded, so I have a backup of all partitions that the “Readback” feature in auto mode saved (in the boot loop state).
Then I tried to use SP Flash tool with “Format All + Download” (as “Download only” would not work, but I understand now, looking at this forum, that I should probably have selected “Firmware upgrade” instead), hoping to put the phone back to a working state. For this I used iode-7.3-20260305-brax3-spflash (as this is the most recent “spflash” firmware I could find). This process failed with an empty error message.
Now I am not able to use SP Flash tool anymore (the same empty error message is always displayed when connecting to the phone, even when I want to perform a “Readback”).

When I connect the phone with USB, I can see in dmesg:

[ 8157.608308] usb 3-4.4: new high-speed USB device number 22 using xhci_hcd
[ 8157.683291] usb 3-4.4: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[ 8157.683298] usb 3-4.4: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 8157.726597] cdc_acm 3-4.4:1.0: ttyACM0: USB ACM device

I tried to use mtkclient without success:

mtk --loader ./iode-7.3-20260305-brax3-spflash/download_agent/DA_BR.bin --preloader ./iode-7.3-20260305-brax3-spflash/preloader_k6835v1_64.bin printgpt --debugmode
cf here the (long) output of this command 
fuse library not installed
Main
Main - [LIB]: /usr/bin/mtk --loader ./iode-7.3-20260305-brax3-spflash/download_agent/DA_BR.bin --preloader ./iode-7.3-20260305-brax3-spflash/preloader_k6835v1_64.bin printgpt --debugmode
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile/iot device to brom mode
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.DeviceClass
DeviceClass - [LIB]: Couldn't detect the device. Is it connected ?
.
DeviceClass
DeviceClass - [LIB]:   CONFIGURATION 1: 0 mA ====================================
   bLength              :    0x9 (9 bytes)
   bDescriptorType      :    0x2 Configuration
   wTotalLength         :   0x43 (67 bytes)
   bNumInterfaces       :    0x2
   bConfigurationValue  :    0x1
   iConfiguration       :    0x0 
   bmAttributes         :   0x80 Bus Powered
   bMaxPower            :    0x0 (0 mA)
    INTERFACE 0: CDC Communication =========================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x0
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x1
     bInterfaceClass    :    0x2 CDC Communication
     bInterfaceSubClass :    0x2
     bInterfaceProtocol :    0x1
     iInterface         :    0x1 comm_if̦data_if̄Љ瀰
      ENDPOINT 0x83: Interrupt IN ==========================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :   0x83 IN
       bmAttributes     :    0x3 Interrupt
       wMaxPacketSize   :   0x40 (64 bytes)
       bInterval        :    0x1
    INTERFACE 1: CDC Data ==================================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x1
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x2
     bInterfaceClass    :    0xa CDC Data
     bInterfaceSubClass :    0x0
     bInterfaceProtocol :    0x0
     iInterface         :    0x2 data_if̄Љ瀰呪풅ཊꤛ漢䕄礤
      ENDPOINT 0x81: Bulk IN ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :   0x81 IN
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :  0x200 (512 bytes)
       bInterval        :    0x0
      ENDPOINT 0x1: Bulk OUT ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :    0x1 OUT
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :  0x200 (512 bytes)
       bInterval        :    0x0
DeviceClass
DeviceClass - [LIB]: Detaching kernel driver
DeviceClass
DeviceClass - [LIB]:   CONFIGURATION 1: 0 mA ====================================
   bLength              :    0x9 (9 bytes)
   bDescriptorType      :    0x2 Configuration
   wTotalLength         :   0x43 (67 bytes)
   bNumInterfaces       :    0x2
   bConfigurationValue  :    0x1
   iConfiguration       :    0x0 
   bmAttributes         :   0x80 Bus Powered
   bMaxPower            :    0x0 (0 mA)
    INTERFACE 0: CDC Communication =========================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x0
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x1
     bInterfaceClass    :    0x2 CDC Communication
     bInterfaceSubClass :    0x2
     bInterfaceProtocol :    0x1
     iInterface         :    0x1 comm_if̦data_if̄Љ瀰
      ENDPOINT 0x83: Interrupt IN ==========================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :   0x83 IN
       bmAttributes     :    0x3 Interrupt
       wMaxPacketSize   :   0x40 (64 bytes)
       bInterval        :    0x1
    INTERFACE 1: CDC Data ==================================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x1
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x2
     bInterfaceClass    :    0xa CDC Data
     bInterfaceSubClass :    0x0
     bInterfaceProtocol :    0x0
     iInterface         :    0x2 data_if̄Љ瀰呪풅ཊꤛ漢䕄礤
      ENDPOINT 0x81: Bulk IN ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :   0x81 IN
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :  0x200 (512 bytes)
       bInterval        :    0x0
      ENDPOINT 0x1: Bulk OUT ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :    0x1 OUT
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :  0x200 (512 bytes)
       bInterval        :    0x0
Port - Device detected :)
DeviceClass
DeviceClass - [LIB]: TX:fd
DeviceClass
DeviceClass - [LIB]: USB echo: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:fd
DeviceClass
DeviceClass - [LIB]: USB rdword: length(0x4)
DeviceClass
DeviceClass - [LIB]: RX:12090000
Preloader - Detected regular mode !
Preloader - 	CPU:			MT6835V/ZA(MTK Dimensity 6100+)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x1c007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x2001000
Preloader - 	Var1:			0xa
Preloader - Disabling Watchdog...
DeviceClass
DeviceClass - [LIB]: TX:d4
DeviceClass
DeviceClass - [LIB]: USB echo: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:d4
DeviceClass
DeviceClass - [LIB]: TX:1c007000
DeviceClass
DeviceClass - [LIB]: USB echo: length(0x4)
DeviceClass
DeviceClass - [LIB]: RX:1c007000
DeviceClass
DeviceClass - [LIB]: TX:00000001
DeviceClass
DeviceClass - [LIB]: USB echo: length(0x4)
DeviceClass
DeviceClass - [LIB]: RX:00000001
DeviceClass
DeviceClass - [LIB]: USB rword: length(0x2)
DeviceClass
DeviceClass - [LIB]: RX:0001
DeviceClass
DeviceClass - [LIB]: TX:22000064
DeviceClass
DeviceClass - [LIB]: USB echo: length(0x4)
DeviceClass
DeviceClass - [LIB]: RX:22000064
DeviceClass
DeviceClass - [LIB]: USB rword: length(0x2)
DeviceClass
DeviceClass - [LIB]: RX:0001
Preloader - HW code:			0x1209
DeviceClass
DeviceClass - [LIB]: TX:d8
DeviceClass
DeviceClass - [LIB]: USB echo: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:d8
DeviceClass
DeviceClass - [LIB]: USB rbyte: length(0x6)
DeviceClass
DeviceClass - [LIB]: RX:000000e00000
Preloader - Target config:		0xe0
Preloader - 	SBC enabled:		False
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		False
Preloader - 	SWJTAG enabled:		False
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		True
Preloader - 	Mem write auth:		True
Preloader - 	Cmd 0xC8 blocked:	True
Preloader - Get Target info
DeviceClass
DeviceClass - [LIB]: TX:fe
DeviceClass
DeviceClass - [LIB]: USB get_blver: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:fe
Preloader - BROM mode detected.
DeviceClass
DeviceClass - [LIB]: TX:ff
DeviceClass
DeviceClass - [LIB]: USB get_bromver: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:05
DeviceClass
DeviceClass - [LIB]: TX:fc
DeviceClass
DeviceClass - [LIB]: USB mtk_cmd: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:fc
DeviceClass
DeviceClass - [LIB]: USB mtk_cmd: length(0x8)
DeviceClass
DeviceClass - [LIB]: RX:8a00cb0000000000
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xcb00
Preloader - 	SW Ver:			0x0
DeviceClass
DeviceClass - [LIB]: TX:fe
DeviceClass
DeviceClass - [LIB]: USB get_meid: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:fe
DeviceClass
DeviceClass - [LIB]: TX:e1
DeviceClass
DeviceClass - [LIB]: USB get_meid: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:e1
DeviceClass
DeviceClass - [LIB]: USB get_meid: length(0x4)
DeviceClass
DeviceClass - [LIB]: RX:00000010
DeviceClass
DeviceClass - [LIB]: USB get_meid: length(0x10)
DeviceClass
DeviceClass - [LIB]: RX:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DeviceClass
DeviceClass - [LIB]: USB get_meid: length(0x2)
DeviceClass
DeviceClass - [LIB]: RX:0000
Preloader - ME_ID:			XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
DeviceClass
DeviceClass - [LIB]: TX:fe
DeviceClass
DeviceClass - [LIB]: USB get_socid: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:fe
DeviceClass
DeviceClass - [LIB]: TX:e7
DeviceClass
DeviceClass - [LIB]: USB get_socid: length(0x1)
DeviceClass
DeviceClass - [LIB]: RX:e7
DeviceClass
DeviceClass - [LIB]: USB get_socid: length(0x4)
DeviceClass
DeviceClass - [LIB]: RX:00000020
DeviceClass
DeviceClass - [LIB]: USB get_socid: length(0x20)
DeviceClass
DeviceClass - [LIB]: RX:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DeviceClass
DeviceClass - [LIB]: USB get_socid: length(0x2)
DeviceClass
DeviceClass - [LIB]: RX:0000
Preloader - SOC_ID:			XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
DaHandler - Device is unprotected.
DaHandler - Device is in BROM-Mode. Bypassing security.
DaHandler - Unprotected device, we assume we can patch directly !
DaHandler
DaHandler - [LIB]: Failed to dump preloader from ram, provide a valid one via --preloader option
DAconfig
DAconfig - [LIB]: No da_loader config set up
DAXML
DAXML - [LIB]: No valid da loader found... aborting.
DaHandler
DaHandler - [LIB]: Failed to upload da.

(I have replaced by xxx the real ME_ID and SOC_ID)

How can I fix the issue ?

Thank you in advance for your answer !

(By the way, I tried to solve this with Claude Opus 4.8, but my chat was paused because it was flagged by “Safety filters”, that’s so frustrating !)

1 Like
2

I am still trying to get advice or assistance for phone getting stuck in a boot loop also. Had not tried flashing or any commands. My daughter was just sending and saving one contact at a time from her current phone, when it started.

3

I have done a lot of things to my 2nd BraX3 to get Ubuntu Touch on it and then back to iode’ and got it into some boot loops and error messages when using SPFlash on it to load up iode’. I would say flash Lunar OS on it. That seems to always work without errors. Your IMEI numbers and serial number is probably also gone. They are on the box it came in.

Here is the LunarOS page:

I don’t think it is possible to hard brick the BraX3. U got a soft brick which is recoverable!! :nerd_face:

2 Likes
4

Thank you @Lazarus for your answer! I hope it is indeed only soft bricked and recoverable as you say.
However, I have not yet found the way to repair it.
When using SP Flash, I always get error_msg: (cf the screenshot below) whatever I try (readback or download), including when trying to flash this Lunar OS image which I found in this post.

SP Flash terminal output:

com port clue: COM://.
scan device succeed, symbolic_link: COM:///dev/ttyACM0@/dev/[email protected]
connect brom START, connection options: ,	auth file: ,	cert file: .
connect brom failed, error code: -1, error msg: .

image
image1126×725 55 KB

5

I am sorry to read that your phone is stuck in a boot loop without doing any special command. I don’t know how to help you, but try not to do the same mistake I did: avoid “Format all + Download” in SP Flash !

6

Hold the power button till it shuts down and keep holding it so it doesn’t restart. Then flash with SPFlash.

7

Lunar OS download used to be on that link I left. I used it just fine. The file u found may be different.

@plamen the Lunar OS download u posted something that disappeared! Please help!:light_bulb:

8

My daughter isn’t even trying to flash anything (I don’t even know what it means!) She simply text messaged her new temp cell# individual contacts and saved them individually.
She has shut phone down hard as someone suggested, and she tried running the battery completely down, then recharging, and still the boot up loop. We are getting no help from support. :frowning: :face_with_diagonal_mouth:

9

Hopefully her contacts are backed somewhere and anything else important. U can get into recovery mode using the buttons from when it is powered down and then reset the phone. This explains how:

To enter recovery mode on a BraX3 device for a factory reset, power off the phone and hold the Power button and Volume Up key together until the device enters recovery mode.

Once in recovery mode, use the Volume keys to navigate the menu and the Power button to confirm selections. Highlight the Wipe data/factory reset option and confirm to erase all data and restore the device to its original sta… how get BraX3 into recovery mode using buttons for factory reset - Brave Search

1 Like
10

I just received my Brax3 phone the other day and the phone is now bricked after unlocking the bootloader.

After receiving the phone, I also installed the June update of iodéOS (v7.5) as an OTA update. I then attempted to unlock the bootloader, following the directions as outlined here.

This caused the phone to get stuck in a bootloop (Orange status, rebooting every 5 seconds), stuck in fastboot mode.

I then tried to use the SP Flash tool to flash the latest iode ROM available ( brax3/iode-7.3-20260305-brax3-spflash.zip · master · ota / release · GitLab ). The Download mode kicked in on one of the phones’ reboot cycles, but then error’d out. I then attempted the firmware upgrade option, which appeared to work, as it downloaded all the OS img files to the phone one after another, but then threw an error message at the end.

The phone then went black and the phone now won’t turn on at all. When I plug it into the PC, I hear the USB connection sound repeating quickly (about once every 3 sec.), with nothing happening on the device display.

I’ve tried holding the power button for up to a min, and tried all combinations with the Vol + and - buttons. And nothing appears to happen. The phone just appears to rapidly bootloop when I plug it into my PC, and the device never registers visibly in Windows.

Is there anything I can do?

1 Like
11

Have u tried flashing Lunar OS on it? That seems to always work but their download disappeared. That was here:

12

@plamen where is the Lunar OS download?

1 Like
13

The phone won’t even register with SP Flash anymore. I just constantly hear the USB connection sound in windows repeating and the screen stays black.

Before I attempted the firmware upgrade it would at least boot to the fastboot screen and then restart again. But now I just see a black screen and hear the USB connection sound repeating every 3-5 sec.

Could flashing the firmware upgrade completely wipe the recovery partition? I wish I could just pull the battery.

14

I’m at a loss. I called for the tech support guy here named Plamen. Perhaps he can help!

15

The support email is pretty much useless. I just get a canned response telling me to post my issue on the forums… I’m trying to inquire about getting an RMA on this device and sending it back to them for a replacement.

I don’t think I’ll attempt to root the device again, which is a shame, because that’s one of the reasons I bought this phone. So many phones today don’t allow you to unlock the bootloader.

After waiting nearly 6 months for this phone, this is all very disappointing and frustrating.

16

Well maybe he will come here! I will call again for u!

@plamen you’re expertise is needed for a bricked BraX3 phone!

1 Like
17

I have a new Brax3 in this condition. Is there an RMA path for this device?

18

These posts didn’t pop up till the second batch of BraX3 phones came out. U need to get your hands on the unbrickable BraX3 phones from the first batch!! :smiling_face_with_sunglasses:

19

I was able to pull my devices Preloader configuration, using a tool called “mtkclient” ( GitHub - bkerler/mtkclient: Mediatek Flash and Repair Utility · GitHub ).

The phone still won’t turn on or go to fastboot or recovery mode. But here is what it showed. Does all of this appear normal?

Preloader - Detected regular mode !
Preloader -     CPU:                    MT6835V/ZA(MTK Dimensity 6100+)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x1c007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x2001000
Preloader -     Var1:                   0xa
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x1209
Preloader - Target config:              0xe0
Preloader -     SBC enabled:            False
Preloader -     SLA enabled:            False
Preloader -     DAA enabled:            False
Preloader -     SWJTAG enabled:         False
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          True
Preloader -     Mem write auth:         True
Preloader -     Cmd 0xC8 blocked:       True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xcb00
Preloader -     SW Ver:                 0x0
Preloader - ME_ID:                      3DFEA431EE671AD7D17F8BDCB8FFCA98
Preloader - SOC_ID:                     95A3A463AA742513C0098527BF064DE50041805B31865FDC1B0EDFB055D95C3D

I have a feeling if I pulled the battery the phone may actually boot into fastboot or recovery mode. But I can’t get at the battery and it’ll take forever to die with the display not turned on.

Does anyone know a safe way to open the phone and get access to the battery?

1 Like
20

Thank you @TheCanuckdian for your post.

It seems my phone and yours are stuck in the same state.

I don’t think disconnecting and reconnecting the battery would actually change something (even though I would also be happy to know how to do that) because mtkclient communicates with the phone during the boot phase (so the phone actually rebooted if you got this log).

I don’t have enough knowledge to understand what this target config actually means. There is this ticket open on mtkclient about this specific problem. I hope we can get an answer either here or there.

I am wondering if this part of the config could be a problem:

Preloader -     Mem read auth:          True
Preloader -     Mem write auth:         True
Preloader -     Cmd 0xC8 blocked:       True

I have another phone (not a BraX3 but with a MediaTek cpu), for which mtkclient works, and it has this config (where these three items are False):

Preloader - Detected regular mode !
Preloader - 	CPU:			MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0xa
Preloader - Disabling Watchdog...
Preloader - HW code:			0x788
Preloader - Target config:		0x0
Preloader - 	SBC enabled:		False
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		False
Preloader - 	SWJTAG enabled:		False
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca00
Preloader - 	SW Ver:			0x0
Preloader - ME_ID:			XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Preloader - SOC_ID:			XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
DaHandler - Device is unprotected.
DaHandler - Device is in BROM-Mode. Bypassing security.
DaHandler - Unprotected device, we assume we can patch directly !
...

@Lazarus As you have a working BraX3, would you be able to tell us what target config you get with mtkclient in BROM-Mode with your non-bricked BraX3 to see if it is the same, with a command such as the following one (with preloader_raw.img and DA_BR.bin coming from your copy of LunarOS you were talking about):

mtk printgpt --preloader brax3-lunaros/preloader_raw.img --loader brax3-lunaros/download_agent/DA_BR.bin

Note that on my side I have these checksums for the files:

sha256sum brax3-lunaros/preloader_raw.img brax3-lunaros/download_agent/DA_BR.bin
64b218d2ea054af02017abffff52310806702d827e7b775376ea7e15ce655434  brax3-lunaros/preloader_raw.img
97e22d89126a1aabedb2773b8f4ac50ea0dcb58c6e8c4cb95abe5a0b95ea0fe3  brax3-lunaros/download_agent/DA_BR.bin

And I get this result with my BraX3 (with the ME_ID and SOC_ID replaced with X):

Preloader - Detected regular mode !
Preloader - 	CPU:			MT6835V/ZA(MTK Dimensity 6100+)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x1c007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x2001000
Preloader - 	Var1:			0xa
Preloader - Disabling Watchdog...
Preloader - HW code:			0x1209
Preloader - Target config:		0xe0
Preloader - 	SBC enabled:		False
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		False
Preloader - 	SWJTAG enabled:		False
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		True
Preloader - 	Mem write auth:		True
Preloader - 	Cmd 0xC8 blocked:	True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xcb00
Preloader - 	SW Ver:			0x0
Preloader - ME_ID:			XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Preloader - SOC_ID:			XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
DaHandler - Device is unprotected.
DaHandler - Device is in BROM-Mode. Bypassing security.
DaHandler - Unprotected device, we assume we can patch directly !
DAXML - Uploading xflash stage 1 from DA_BR.bin
XmlFlashExt - Patching da2 ...
DA2 32-Bit detected.
XmlFlashExt
XmlFlashExt - [LIB]: Write not allowed not patched.
XmlFlashExt - Patched hash binding
DAXML - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x2000000
Preloader - Jumping to 0x2000000: ok.
DeviceClass
DeviceClass - [LIB]: Device disconnected