README-USAGE.md

Usage

Using MTKTools via the graphical user interface:

For the 'basics' you can use the GUI interface. This supports dumping partitions or the full flash for now. Run the following command:

python mtk_gui.py

Using brom mode exploit :

python mtk.py --preloader [preloader]

Dump preloader via

python mtk.py dumppreloader

Changing uart to usb logging to see more log details in DA (XML only):

python mtk.py printgpt --logchannel="USB"

alternatively take the preloader from firmware

Using preloader mode exploit :

python mtk.py --loader [MTK_AllInOne.bin or DA_BR.bin or DALoader]

and for Xiaomi 13C using unpatched loader:

python mtk.py --loader [MTK_AllInOne.bin or DA_BR.bin or DALoader] --stock

Using stock mtk functionality without exploits :

python mtk.py --stock

List supported devices (here: show only Xiaomi devices) :

python mtk.py devices --filter Xiaomi

Run multiple commands

python mtk.py script examples/run.example

or

python mtk.py multi "cmd1;cmd2"

See the file "run.example" on how to structure the script file

Root the phone (Tested with android 9 - 12)

1. Dump boot and vbmeta

python mtk.py r boot,vbmeta boot.img,vbmeta.img

2. Reboot the phone

python mtk.py reset

3. Download patched magisk for mtk: Download latest Magisk here

4. Install on target phone

• you need to enable usb-debugging via Settings/About phone/Version, Tap 7x on build number
• Go to Settings/Additional settings/Developer options, enable "OEM unlock" and "USB Debugging"
• Install magisk apk

adb install app-release.apk

• accept auth rsa request on mobile screen of course to allow adb connection
• on Xiaomi phones if installation fails try to turn off MIUI optimization in Developer options, restart, and try again

5. Upload boot to /sdcard/Download

adb push boot.img /sdcard/Download

6. Start magisk, tap on Install, select boot.img from /sdcard/Download, then:

adb pull /sdcard/Download/[displayed magisk patched boot filename here]
mv [displayed magisk patched boot filename here] boot.patched

7. Do the steps needed in section "Unlock bootloader below"

8. Flash magisk-patched boot and disable verity + verification on vbmeta

python mtk.py da vbmeta 3
python mtk.py w boot boot.patched

9. Reboot the phone

python mtk.py reset

10. Disconnect usb cable and enjoy your rooted phone :)

Unlock flow for stock mtk with android >=9

1. Unlock seccfg

python mtk.py da seccfg unlock

2. Wipe userdata,metadata,md_udc,cache partitions

python mtk.py e userdata,metadata,md_udc,cache

2. Disable verity + verification on vbmeta

python mtk.py da vbmeta 3

Boot to meta mode via payload

Example:

python mtk.py payload --metamode FASTBOOT

Dump preloader

mtk.py r preloader preloader.bin --parttype boot1

Dump serialnumber / special partition

mtk.py r preloader preloader.bin --parttype boot2

Read efuses

Example:

python mtk.py da efuse

Unlock bootloader

1. Erase metadata and userdata (and md_udc if existing):

python mtk.py e metadata,userdata,md_udc

2. Unlock bootloader:

python mtk.py da seccfg unlock

for relocking use:

python mtk.py da seccfg lock

3. Reboot the phone:

python mtk.py reset

and disconnect usb cable to let the phone reboot.

If you are getting a dm-verity error on Android 11, just press the power button, then the device should boot and show a yellow warning about unlocked bootloader and then the device should boot within 5 seconds.

Read flash

Dump boot partition to filename boot.bin via preloader

python mtk.py r boot boot.bin

Dump boot partition to filename boot.bin via bootrom

python mtk.py r boot boot.bin [--preloader=Loader/Preloader/your_device_preloader.bin]

Dump preloader partition to filename preloader.bin via bootrom

python mtk.py r preloader preloader.bin --parttype=boot1 [--preloader=Loader/Preloader/your_device_preloader.bin]

Read full flash to filename flash.bin (use --preloader for brom)

python mtk.py rf flash.bin

Read full flash to filename flash.bin (use --preloader for brom) for IoT devices (MT6261/MT2301):

python mtk.py rf flash.bin --iot

Read flash offset 0x128000 with length 0x200000 to filename flash.bin (use --preloader for brom)

python mtk.py ro 0x128000 0x200000 flash.bin

Dump all partitions to directory "out". (use --preloader for brom)

python mtk.py rl out

Show gpt (use --preloader for brom)

python mtk.py printgpt

Mount the flash as a filesystem

python mtk.py fs /mnt/mtk

Write flash

(use --preloader for brom)

Write filename boot.bin to boot partition

python mtk.py w boot boot.bin

Write filename flash.bin as full flash (currently only works in da mode)

python mtk.py wf flash.bin

Write all files in directory "out" to the flash partitions

python mtk.py wl out

write file flash.bin to flash offset 0x128000 with length 0x200000 (use --preloader for brom)

python mtk.py wo 0x128000 0x200000 flash.bin

Erase flash

Erase boot partition

python mtk.py e boot

Erase boot sectors

python mtk.py es boot [sector count]

DA commands:

Peek memory

python mtk.py da peek [addr in hex] [length in hex] [optional: -filename filename.bin for reading to file]

Poke memory

python mtk.py da poke [addr in hex] [data as hexstring or -filename for reading from file]

Read rpmb (Only xflash for now)

python mtk.py da rpmb r [will read to rpmb.bin]

Write rpmb [Currently broken, xflash only]

python mtk.py da rpmb w filename

Generate and display rpmb1-3 key

python mtk.py da generatekeys

Unlock / Lock bootloader

python mtk.py da seccfg [lock or unlock]

---

Bypass SLA, DAA and SBC (using generic_patcher_payload)

shell python mtk.py payload If you want to use SP Flash tool afterwards, make sure you select "UART" in the settings, not "USB".

Dump preloader

• Device has to be in bootrom mode and preloader has to be intact on the device

python mtk.py dumppreloader [--ptype=["amonet","kamakiri","kamakiri2","hashimoto"]] [--filename=preloader.bin]

Dump brom

• Device has to be in bootrom mode, or da mode has to be crashed to enter damode
• if no option is given, either kamakiri or da will be used (da for insecure targets)
• if "kamakiri" is used as an option, kamakiri is enforced
• Valid options are : "kamakiri" (via usb_ctrl_handler attack), "amonet" (via gcpu) and "hashimoto" (via cqdma)

python mtk.py dumpbrom --ptype=["amonet","kamakiri","hashimoto"] [--filename=brom.bin]

For to dump unknown bootroms, use brute option :

python mtk.py brute

If it's successful, please add an issue over here and append the bootrom in order to add full support.

---

Crash da in order to enter brom

python mtk.py crash [--vid=vid] [--pid=pid] [--interface=interface]

Read memory using patched preloader

• Boot in Brom or crash to Brom

python mtk.py peek [addr] [length] --preloader=patched_preloader.bin

Run custom payload

python mtk.py payload --payload=payload.bin [--var1=var1] [--wdt=wdt] [--uartaddr=addr] [--da_addr=addr] [--brom_addr=addr]

---

Stage2 usage

Run python mtk.py stage (brom) or mtk plstage (preloader)

Run stage2 in bootrom

shell python mtk.py stage

Run stage2 in preloader

shell python mtk.py plstage

Run stage2 plstage in bootrom

• Boot in Brom or crash to Brom

python mtk.py plstage --preloader=preloader.bin

Use stage2 tool

Leave stage2 and reboot

shell python stage2.py reboot

Read rpmb in stage2 mode

shell python stage2.py rpmb

Read preloader in stage2 mode

shell python stage2.py preloader

Read memory as hex data in stage2 mode

shell python stage2.py memread [start addr] [length]

Read memory to file in stage2 mode

shell python stage2.py memread [start addr] [length] --filename filename.bin

Write hex data to memory in stage2 mode

shell python stage2.py memwrite [start addr] --data [data as hexstring]

Write memory from file in stage2 mode

shell python stage2.py memwrite [start addr] --filename filename.bin

Extract keys

shell python stage2.py keys --mode [sej, dxcc] For dxcc, you need to use plstage instead of stage