MTK reverse engineering and flash tool
  • Python 96.1%
  • C 3.7%
  • Makefile 0.1%
Find a file
Bjoern Kerler 2c9f4d7860
Some checks failed
Python application / Test (push) Has been cancelled
Merge pull request #236 from omicronns/main
Fix reading multiple partitions with read command
2026-06-09 10:04:27 +02:00
.github Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
examples Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
mtkclient fix reading multiple partitions with read command 2026-05-31 13:03:58 +02:00
Setup/Linux Fix syntax for Suzy-Q USB device rule 2026-04-14 19:35:10 +02:00
src/stage1 Add kamakiri support for mt6575 2026-02-16 08:13:07 +01:00
Tools Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
.flake8 Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
.gitignore Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
learning_resources.md Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
LICENSE Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
MANIFEST.in Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
mtk.bat Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
mtk.py Add basic ssr crypto support (not yet working !), add uart2usb logging, reworked xml handling + patcher, updated brom config, fixed issues with dump internal. 2026-03-31 20:33:44 +02:00
mtk_api.py Add more fixes and ssr stuff 2026-05-03 11:59:18 +02:00
mtk_console.spec Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
mtk_gui.bat Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
mtk_gui.py Add basic ssr crypto support (not yet working !), add uart2usb logging, reworked xml handling + patcher, updated brom config, fixed issues with dump internal. 2026-03-31 20:33:44 +02:00
mtk_iot_api.py Add more fixes and ssr stuff 2026-05-03 11:59:18 +02:00
mtk_standalone.spec Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
mtk_tcpip_client.py Add more fixes and ssr stuff 2026-05-03 11:59:18 +02:00
mtk_tcpip_server.py Add more fixes and ssr stuff 2026-05-03 11:59:18 +02:00
pyproject.toml Switch from fusepy to mfusepy 2026-05-21 23:28:02 +02:00
README-INSTALL.md Update instructions for fedora, fix dalegacy write issue 2026-01-31 00:03:16 +01:00
README-INSTALL.zh-CN.md Update instructions for fedora, fix dalegacy write issue 2026-01-31 00:03:16 +01:00
README-USAGE.md Update README-USAGE.md 2026-05-06 15:50:40 +03:00
README-USAGE.zh-CN.md Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
README-WINDOWS.md Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
README-WINDOWS.zh-CN.md Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
README.md Add basic ssr crypto support (not yet working !), add uart2usb logging, reworked xml handling + patcher, updated brom config, fixed issues with dump internal. 2026-03-31 20:33:44 +02:00
README.zh-CN.md Add basic ssr crypto support (not yet working !), add uart2usb logging, reworked xml handling + patcher, updated brom config, fixed issues with dump internal. 2026-03-31 20:33:44 +02:00
requirements.txt Switch from fusepy to mfusepy 2026-05-21 23:28:02 +02:00
run.example Improve error handling, fix missing logs folder creation on debug mode, fix xml issues, fix gui progress handling 2026-01-22 18:47:37 +01:00
shell.nix Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
stage2.py Initial release (new version 2.1.2) 2026-01-18 12:38:32 +01:00
uv.lock Switch from fusepy to mfusepy 2026-05-21 23:28:02 +02:00

Language: 🇺🇸 🇨🇳

MTKClient

Logo

Just some mtk tool for exploitation, reading/writing flash and doing crazy stuff. For windows, you need to install the stock mtk port and the usbdk driver (see instructions below). For linux, a patched kernel is only needed when using old kamakiri (see Setup folder) (except for read/write flash).

Once the mtk script is running, boot into brom mode by powering off device, press and hold either vol up + power or vol down + power and connect the phone. Once detected by the tool, release the buttons.

MT6781, MT6789, MT6855, MT6886, MT6895, MT6983, MT8985

  • These chipsets use a new protocol called V6 and the bootrom is patched. You need to use the --loader option and a proper loader from the Loaders/V6 directory. Bootrom won't work, you need to use preloader mode (no hw buttons pressed, just connect). On some devices, preloader is deactivated, but you can reactivate it by running "adb reboot edl".

Credits

  • kamakiri [xyzz]
  • linecode exploit [chimera]
  • heapbait exploit [chimera], creds to [R0rt1z2],[Shomy]
  • Chaosmaster
  • Geert-Jan Kreileman (GUI, design & fixes)
  • All contributors

Installation

See linux/macos installation hints

See windows installation hints

See automated Windows installer

Usage

See usage instructions

Use Re LiveDVD (everything ready to go, based on Ubuntu):

User: user, Password:user (based on Ubuntu 22.04 LTS)

Live DVD V6

I have issues ....... please send logs and full console details !

  • Run the mtk tool with --debugmode. Log will be written to log.txt (hopefully)

Rules / Infos

Chip details / configs

  • Go to config/brom_config.py
  • Unknown usb vid/pids for autodetection go to config/usb_ids.py

Other Stuff

Learning resources