mtkclient

Just some mtk tool for exploitation, reading/writing flash and doing crazy stuff. For linux, a patched kernel is only needed for kamakiri (see Setup folder) (except for read/write flash). For windows, you need to install zadig driver and replace pid 0003 / pid 2000 driver with WinUSB one (not ! libusb0/libusbK).

Once the mtk script is running, boot into brom mode by powering off device, press and hold either vol up + power or vol down + power and connect the phone. Once detected by the tool, release the buttons.

Credits

• kamakiri [xyzz]
• kamakiri2 (to be renamed) [most likely chimera or pandora, need to be confirmed]
• Chaosmaster
• All contributors

Installation

Use Re LiveDVD (everything ready to go):

Download Re Live DVD User: livedvd, Password:livedvd

Use FireISO as LiveDVD:

Download FireIso Live DVD

Install

Linux

Install python >=3.8, git and other deps

sudo apt install python3 git libusb1.0

Grab files

git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt
python3 setup.py build
python3 setup.py install

Install rules

sudo adduser $USER dialout
sudo adduser $USER plugdev
sudo cp Setup/Linux/*.rules /etc/udev/rules.d
sudo udevadm control -R

Use kamakiri (optional, only needed for mt6260 or older)

• For linux (kamakiri attack), you need to recompile your linux kernel using this kernel patch :

sudo apt-get install build-essential libncurses-dev bison flex libssl-dev libelf-dev libdw-dev
git clone https://git.kernel.org/pub/scm/devel/pahole/pahole.git
cd pahole && mkdir build && cd build && cmake .. && make && sudo make install
sudo mv /usr/local/libdwarves* /usr/local/lib/ && sudo ldconfig

wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-`uname -r`.tar.xz
tar xvf linux-`uname -r`.tar.xz
cd linux-`uname -r`
patch -p1 < ../Setup/kernelpatches/disable-usb-checks-5.10.patch
cp -v /boot/config-$(uname -r) .config
make menuconfig
make
sudo make modules_install 
sudo make install

• These aren't needed for current ubuntu (as make install will do, just for reference):

sudo update-initramfs -c -k `uname -r`
sudo update-grub

See Setup/kernels for ready-to-use kernel setups

• Reboot

sudo reboot

Windows

Install python + git

• Install python 3.9 and git from Microsoft Store

• WIN+R cmd

Grab files and install

git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt

Get latest zadig (>=2.5) and install WinUSB driver

• Get from https://zadig.akeo.ie
• Start zadig, select Options -> List all devices
• Connect powered off device via usb, and in list choose device with USB ID "0E8D""0003"
• Select WinUSB and press Button "Replace Driver"

Compile payloads (optional)

Install gcc armeabi compiler

sudo apt-get install gcc-arm-none-eabi

Compile

See src/readme.build for detailed instructions.

cd src
make

Usage

Bypass SLA, DAA and SBC (using generic_patcher_payload)

./mtk payload If you want to use SP Flash tool afterwards, make sure you select "UART" in the settings, not "USB".

Dump brom

• Device has to be in bootrom mode, or da mode has to be crashed to enter damode
• if no option is given, either kamakiri or da will be used (da for insecure targets)
• if "kamakiri" is used as an option, kamakiri is enforced
• Valid options are : "kamakiri" (via usb_ctrl_handler attack), "amonet" (via gcpu) and "hashimoto" (via cqdma)

./mtk dumpbrom --ptype=["amonet","kamakiri","hashimoto"] [--filename=brom.bin]

Dump preloader

• Device has to be in bootrom mode and preloader has to be intact on the device

./mtk dumppreloader --ptype=["amonet","kamakiri","kamakiri2","hashimoto"] [--filename=preloader.bin]

Run original/patched preloader and disable sbc

• Boot in Brom or crash to Brom

./mtk plstage --preloader=preloader.bin

Read memory using patched preloader

• Boot in Brom or crash to Brom

./mtk peek [addr] [length] --preloader=patched_preloader.bin

Run custom payload

./mtk payload --payload=payload.bin [--var1=var1] [--wdt=wdt] [--uartaddr=addr] [--da_addr=addr] [--brom_addr=addr]

Run stage2 in bootrom

./mtk stage

Run stage2 in preloader

./mtk plstage

Leave stage2 and reboot

./stage2 reboot

Read rpmb in stage2 mode

./stage2 rpmb

Read preloader in stage2 mode

./stage2 preloader

Read memory as hex data in stage2 mode

./stage2 memread [start addr] [length]

Read memory to file in stage2 mode

./stage2 memread [start addr] [length] --filename filename.bin

Write hex data to memory in stage2 mode

./stage2 memwrite [start addr] --data [data as hexstring]

Write memory from file in stage2 mode

./stage2 memwrite [start addr] --filename filename.bin

Extract keys

./stage2 keys --mode [sej, dxcc] For dxcc, you need to use plstage instead of stage

Crash da in order to enter brom

./mtk crash [--vid=vid] [--pid=pid] [--interface=interface]

Read flash

Dump boot partition to filename boot.bin via preloader

./mtk r boot boot.bin

Dump boot partition to filename boot.bin via bootrom

./mtk r boot boot.bin [--preloader=Loader/Preloader/your_device_preloader.bin]

Read full flash to filename flash.bin (use --preloader for brom)

./mtk rf flash.bin

Dump all partitions to directory "out". (use --preloader for brom)

./mtk rl out

Show gpt (use --preloader for brom)

./mtk printgpt

Write flash

(use --preloader for brom)

Write filename boot.bin to boot partition

./mtk w boot boot.bin

Write filename flash.bin as full flash (currently only works in da mode)

./mtk wf flash.bin

Write all files in directory "out" to the flash partitions

./mtk wl out

Erase flash

Erase boot partition (use --preloader for brom)

./mtk e boot

I need logs !

• Run the mtk tool with --debugmode. Log will be written to log.txt (hopefully)

Rules / Infos

Chip details / configs

• Go to config/brom_config.py
• Unknown usb vid/pids for autodetection go to config/usb_ids.py