Mtkclient

MTKClient is a flashing tool for devices based on MediaTek SOCs that uses exploits in the SOC itself to edit partitions on the device.

Benefits

The usage of MTKClient has a variety of benefits over other methods of device manipulation. For one, it is possible to unlock the bootloader of devices that either do not have an official unlocking method or do not support commands such as fastboot or heimdall. It is also possible to flash partitions that otherwise would be inaccessible through normal flashing methods. All of this is done through two modes that MediaTek SOCs have called Preloader and Boot Rom Mode (BROM Mode).

Installation

MTKClient is already packaged under Alpine in the testing repository. [1] Other distributions may have it packaged. If your distribution does not have MTKClient packaged, it is possible to git clone the repository and run the program from the cloned folder using Python. For older SOCs [mt6260 or lower], a recompiled kernel supporting the kamakiri attack exploit is required. (Instructions for compiling with the exploit supported are on MTKClient's git page.

Connection

To put the device in BROM mode, device specific buttons need to be pressed. Refer to the device page for information on which buttons to press.

If you are attempting to port a device using MTKClient, your only options are to either search the internet for instances of other people using MTKClient with your device (XDA Developers Forums are a good source), or to go through trial and error. Sometimes it is possible to short pins on the device to ground to drop it into BROM mode, but that can be damage the device if done wrong, so make sure to check the MTKClient git README and issues for information before attempting to do so.

Backups

To back up the entire flash storage using MTKClient, connect the device to MTKClient and proceed with the following:

$ python mtk rf /path/to/the.img

And to restore the backup:

$ python mtk wf /path/to/the.img

Bootloader Unlocking

To unlock the bootloader of a device using MTKClient, connect the device to MTKClient and proceed with the following:

  Factory Reset Device
$ python mtk e metadata,userdata,md_udc
  Unlock Bootloader
$ python mtk da seccfg unlock
  Reboot Device
$ python mtk reset

Flashing With pmbootstrap

To flash with pmbootstrap, the flash method mtkclient needs to be selected either during pmbootstrap init or added to the deviceinfo file of a port. From there, flashing using pmbootstrap flasher is available.

Flashing Directly

To flash partitions using MTKClient, connect the device to MTKClient and proceed with the following:

$ python mtk w <partition name> <path to image file>

To flash multiple partitions using MTKClient:

  Make sure to put the image paths in the same order you put the partitions to flash, otherwise the images will flash to the wrong partitions.
$ python mtk w <partition name, partition name> <path to image file, path to image file>

See also

MTKClient Initial Commit for Flashing Method