mtkclient/README.md

# mtkclient
Just some mtk tool for exploitation, reading/writing flash and doing crazy stuff. For linux, a patched kernel is only needed for kamakiri (see Setup folder) (except for read/write flash).
For windows, you need to install the stock mtk port and the usbdk driver (see instructions below).

Once the mtk script is running, boot into brom mode by powering off device, press and hold either
vol up + power or vol down + power and connect the phone. Once detected by the tool,
release the buttons.

## Credits
- kamakiri [xyzz]
- linecode exploit [chimera]
- Chaosmaster
- All contributors

## Installation

### Use Re LiveDVD (everything ready to go):
[Download Re Live DVD](https://drive.google.com/file/d/1VUK0toC6I0jhJ4ZTFPREhSXFTkSe9_gl/view?usp=sharing)
User: livedvd, Password:livedvd

### Use FireISO as LiveDVD:
[Download FireIso Live DVD](https://github.com/amonet-kamakiri/fireiso/releases/tag/v2.0.0)


## Install

### Linux

#### Install python >=3.8, git and other deps

```
sudo apt install python3 git libusb1.0
```

#### Grab files 
```
git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt
python3 setup.py build
python3 setup.py install
```

#### Install rules
```
sudo adduser $USER dialout
sudo adduser $USER plugdev
sudo cp Setup/Linux/*.rules /etc/udev/rules.d
sudo udevadm control -R
```
Make sure to reboot after adding the user to dialout/plugdev.


### Windows

#### Install python + git
- Install python 3.9 and git
- If you install python from microsoft store, "python setup.py install" will fail, but that step isn't required.
- WIN+R ```cmd```

#### Grab files and install
```
git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt
```

#### Get latest UsbDk 64-Bit
- Install normal MTK Serial Port driver (or use default Windows COM Port one, make sure no exclamation is seen)
- Get usbdk installer (.msi) from [here](https://github.com/daynix/UsbDk/releases/) and install it
- Test on device connect using "UsbDkController -n" if you see a device with 0x0E8D 0x0003
- Works fine under Windows 10 and 11 :D

## Use kamakiri (optional, only needed for mt6260 or older)

- For linux (kamakiri attack), you need to recompile your linux kernel using this kernel patch :
```
sudo apt-get install build-essential libncurses-dev bison flex libssl-dev libelf-dev libdw-dev
git clone https://git.kernel.org/pub/scm/devel/pahole/pahole.git
cd pahole && mkdir build && cd build && cmake .. && make && sudo make install
sudo mv /usr/local/libdwarves* /usr/local/lib/ && sudo ldconfig
```

```
wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-`uname -r`.tar.xz
tar xvf linux-`uname -r`.tar.xz
cd linux-`uname -r`
patch -p1 < ../Setup/kernelpatches/disable-usb-checks-5.10.patch
cp -v /boot/config-$(uname -r) .config
make menuconfig
make
sudo make modules_install 
sudo make install
```

- These aren't needed for current ubuntu (as make install will do, just for reference):

```
sudo update-initramfs -c -k `uname -r`
sudo update-grub
```

See Setup/kernels for ready-to-use kernel setups


- Reboot

```
sudo reboot
```

## Compile payloads (optional)

### Install gcc armeabi compiler

```
sudo apt-get install gcc-arm-none-eabi
```

### Compile

See src/readme.build for detailed instructions.

```
cd src
make
```


## Usage

### Bypass SLA, DAA and SBC (using generic_patcher_payload)
`` 
./mtk payload
`` 
If you want to use SP Flash tool afterwards, make sure you select "UART" in the settings, not "USB".

### Dump brom
- Device has to be in bootrom mode, or da mode has to be crashed to enter damode
- if no option is given, either kamakiri or da will be used (da for insecure targets)
- if "kamakiri" is used as an option, kamakiri is enforced
- Valid options are : "kamakiri" (via usb_ctrl_handler attack), "amonet" (via gcpu)
  and "hashimoto" (via cqdma)

```
./mtk dumpbrom --ptype=["amonet","kamakiri","hashimoto"] [--filename=brom.bin]
```

For to dump unknown bootroms, use brute option :
```
./mtk brute
```
If it's successful, please add an issue over here and append the bootrom in order to add full support.


### Dump preloader
- Device has to be in bootrom mode and preloader has to be intact on the device
```
./mtk dumppreloader --ptype=["amonet","kamakiri","kamakiri2","hashimoto"] [--filename=preloader.bin]
```


### Run original/patched preloader and disable sbc
- Boot in Brom or crash to Brom
```
./mtk plstage --preloader=preloader.bin
```

### Read memory using patched preloader
- Boot in Brom or crash to Brom
```
./mtk peek [addr] [length] --preloader=patched_preloader.bin
```

### Run custom payload

```
./mtk payload --payload=payload.bin [--var1=var1] [--wdt=wdt] [--uartaddr=addr] [--da_addr=addr] [--brom_addr=addr]
```

### Run stage2 in bootrom
`` 
./mtk stage
`` 

### Run stage2 in preloader
`` 
./mtk plstage
`` 

### Leave stage2 and reboot
`` 
./stage2 reboot
`` 

### Read rpmb in stage2 mode
`` 
./stage2 rpmb
`` 

### Read preloader in stage2 mode
`` 
./stage2 preloader
`` 

### Read memory as hex data in stage2 mode
`` 
./stage2 memread [start addr] [length]
`` 

### Read memory to file in stage2 mode
`` 
./stage2 memread [start addr] [length] --filename filename.bin
`` 

### Write hex data to memory in stage2 mode
`` 
./stage2 memwrite [start addr] --data [data as hexstring]
`` 

### Write memory from file in stage2 mode
`` 
./stage2 memwrite [start addr] --filename filename.bin
`` 

### Extract keys
`` 
./stage2 keys --mode [sej, dxcc]
`` 
For dxcc, you need to use plstage instead of stage

### Crash da in order to enter brom

```
./mtk crash [--vid=vid] [--pid=pid] [--interface=interface]
```

### Read flash

Dump boot partition to filename boot.bin via preloader

```
./mtk r boot boot.bin
```

Dump boot partition to filename boot.bin via bootrom

```
./mtk r boot boot.bin [--preloader=Loader/Preloader/your_device_preloader.bin]
```


Read full flash to filename flash.bin (use --preloader for brom)

```
./mtk rf flash.bin
```

Dump all partitions to directory "out". (use --preloader for brom)

```
./mtk rl out
```

Show gpt (use --preloader for brom)

```
./mtk printgpt
```


### Write flash
(use --preloader for brom)

Write filename boot.bin to boot partition

```
./mtk w boot boot.bin
```

Write filename flash.bin as full flash (currently only works in da mode)

```
./mtk wf flash.bin
```

Write all files in directory "out" to the flash partitions

```
./mtk wl out
```

### Erase flash

Erase boot partition (use --preloader for brom)
```
./mtk e boot
```

### I need logs !

- Run the mtk tool with --debugmode. Log will be written to log.txt (hopefully)

## Rules / Infos

### Chip details / configs
- Go to config/brom_config.py
- Unknown usb vid/pids for autodetection go to config/usb_ids.py