Just some mtk tool for exploitation, reading/writing flash and doing crazy stuff. For windows, you need to install the stock mtk port and the usbdk driver (see instructions below). For linux, a patched kernel is only needed when using old kamakiri (see Setup folder) (except for read/write flash).
Once the mtk script is running, boot into brom mode by powering off device, press and hold either vol up + power or vol down + power and connect the phone. Once detected by the tool, release the buttons.
- These chipsets use a new protocol called V6 and the bootrom is patched, thus you need a valid da via --loader option.
- On some devices, preloader is deactivated, but you still use it by running "adb reboot edl".
- This only works with UNFUSED devices currently.
- For all devices with DAA, SLA and Remote-Auth activated no public solution currently exists (for various reasons).
- kamakiri [xyzz]
- linecode exploit [chimera]
- Chaosmaster
- Geert-Jan Kreileman (GUI, design & fixes)
- All contributors
User: user, Password:user (based on Ubuntu 22.04 LTS)
sudo apt install python3 git libusb-1.0-0 python3-pip libfuse2
(sudo) pacman -S python python-pip git libusb fuse2
or
yay -S python python-pip git libusb fuse2
sudo dnf install python3 git libusb1 fuse
git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt
pip3 install .
sudo usermod -a -G plugdev $USER
sudo usermod -a -G dialout $USER
sudo cp mtkclient/Setup/Linux/*.rules /etc/udev/rules.d
sudo udevadm control -R
sudo udevadm trigger
Make sure to reboot after adding the user to dialout/plugdev. If the device has a vendor interface 0xFF (like LG), make sure to add "blacklist qcaux" to the "/etc/modprobe.d/blacklist.conf".
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
brew install macfuse openssl
You may need to reboot
git clone https://github.com/bkerler/mtkclient
cd mtkclient
python3.9 -m venv mtk_venv
source mtk_venv/bin/activate
pip3 install --pre --no-binary capstone capstone
pip3 install PySide6 libusb
pip3 install -r requirements.txt
- Install python >= 3.9 and git
- If you install python from microsoft store, "python setup.py install" will fail, but that step isn't required.
- WIN+R
cmd
Download and install here
git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt
- Install normal MTK Serial Port driver (or use default Windows COM Port one, make sure no exclamation is seen)
- Get usbdk installer (.msi) from here and install it
- Test on device connect using "UsbDkController -n" if you see a device with 0x0E8D 0x0003
- Works fine under Windows 10 and 11 :D
Go to the Visual Studio Build Tools [download](https://visualstudio.microsoft.com/visual-cpp-build-tools) page.
Download the installer and run it.
In the installer, select the "Desktop development with C++" workload.
Ensure that the "MSVC v142 - VS 2019 C++ x64/x86 build tools" (or later) component is selected.
You can also check "Windows 10 SDK" if it’s not already selected.
Click on the "Install" button to begin the installation.
Follow the prompts to complete the installation.
Restart your computer if required.
- For linux (kamakiri attack), you need to recompile your linux kernel using this kernel patch :
sudo apt-get install build-essential libncurses-dev bison flex libssl-dev libelf-dev libdw-dev
git clone https://git.kernel.org/pub/scm/devel/pahole/pahole.git
cd pahole && mkdir build && cd build && cmake .. && make && sudo make install
sudo mv /usr/local/libdwarves* /usr/local/lib/ && sudo ldconfig
wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-`uname -r`.tar.xz
tar xvf linux-`uname -r`.tar.xz
cd linux-`uname -r`
patch -p1 < ../Setup/kernelpatches/disable-usb-checks-5.10.patch
cp -v /boot/config-$(uname -r) .config
make menuconfig
make
sudo make modules_install
sudo make install
- These aren't needed for current ubuntu (as make install will do, just for reference):
sudo update-initramfs -c -k `uname -r`
sudo update-grub
See Setup/kernels for ready-to-use kernel setups
- Reboot
sudo reboot
For the 'basics' you can use the GUI interface. This supports dumping partitions or the full flash for now. Run the following command:
python mtk_gui.py
python mtk.py --stock
python mtk.py script examples/run.exampleor
python mtk.py multi "cmd1;cmd2"
See the file "run.example" on how to structure the script file
- Dump boot and vbmeta
python mtk.py r boot,vbmeta boot.img,vbmeta.img
- Reboot the phone
python mtk.py reset
-
Download patched magisk for mtk: Download latest Magisk here
-
Install on target phone
- you need to enable usb-debugging via Settings/About phone/Version, Tap 7x on build number
- Go to Settings/Additional settings/Developer options, enable "OEM unlock" and "USB Debugging"
- Install magisk apk
adb install app-release.apk
- accept auth rsa request on mobile screen of course to allow adb connection
- Upload boot to /sdcard/Download
adb push boot.img /sdcard/Download
- Start magisk, tap on Install, select boot.img from /sdcard/Download, then:
adb pull /sdcard/Download/[displayed magisk patched boot filename here]
mv [displayed magisk patched boot filename here] boot.patched
-
Do the steps needed in section "Unlock bootloader below"
-
Flash magisk-patched boot and disable verity + verification on vbmeta
python mtk.py da vbmeta 3
python mtk.py w boot boot.patched
- Reboot the phone
python mtk.py reset
- Disconnect usb cable and enjoy your rooted phone :)
Example:
python mtk.py payload --metamode FASTBOOT
mtk.py r preloader preloader.bin --parttype boot1
mtk.py r preloader preloader.bin --parttype boot2
Example:
python mtk.py da efuse
- Erase metadata and userdata (and md_udc if existing):
python mtk.py e metadata,userdata,md_udc
- Unlock bootloader:
python mtk.py da seccfg unlock
for relocking use:
python mtk.py da seccfg lock
- Reboot the phone:
python mtk.py reset
and disconnect usb cable to let the phone reboot.
If you are getting a dm-verity error on Android 11, just press the power button, then the device should boot and show a yellow warning about unlocked bootloader and then the device should boot within 5 seconds.
Dump boot partition to filename boot.bin via preloader
python mtk.py r boot boot.bin
Dump boot partition to filename boot.bin via bootrom
python mtk.py r boot boot.bin [--preloader=Loader/Preloader/your_device_preloader.bin]
Dump preloader partition to filename preloader.bin via bootrom
python mtk.py r preloader preloader.bin --parttype=boot1 [--preloader=Loader/Preloader/your_device_preloader.bin]
Read full flash to filename flash.bin (use --preloader for brom)
python mtk.py rf flash.bin
Read full flash to filename flash.bin (use --preloader for brom) for IoT devices (MT6261/MT2301):
python mtk.py rf flash.bin --iot
Read flash offset 0x128000 with length 0x200000 to filename flash.bin (use --preloader for brom)
python mtk.py ro 0x128000 0x200000 flash.bin
Dump all partitions to directory "out". (use --preloader for brom)
python mtk.py rl out
Show gpt (use --preloader for brom)
python mtk.py printgpt
Mount the flash as a filesystem
python mtk.py fs /mnt/mtk
(use --preloader for brom)
Write filename boot.bin to boot partition
python mtk.py w boot boot.bin
Write filename flash.bin as full flash (currently only works in da mode)
python mtk.py wf flash.bin
Write all files in directory "out" to the flash partitions
python mtk.py wl out
write file flash.bin to flash offset 0x128000 with length 0x200000 (use --preloader for brom)
python mtk.py wo 0x128000 0x200000 flash.bin
Erase boot partition
python mtk.py e boot
Erase boot sectors
python mtk.py es boot [sector count]
Peek memory
python mtk.py da peek [addr in hex] [length in hex] [optional: -filename filename.bin for reading to file]
Poke memory
python mtk.py da poke [addr in hex] [data as hexstring or -filename for reading from file]
Read rpmb (Only xflash for now)
python mtk.py da rpmb r [will read to rpmb.bin]
Write rpmb [Currently broken, xflash only]
python mtk.py da rpmb w filename
Generate and display rpmb1-3 key
python mtk.py da generatekeys
Unlock / Lock bootloader
python mtk.py da seccfg [lock or unlock]
python mtk.py payload
If you want to use SP Flash tool afterwards, make sure you select "UART" in the settings, not "USB".
- Device has to be in bootrom mode and preloader has to be intact on the device
python mtk.py dumppreloader [--ptype=["amonet","kamakiri","kamakiri2","hashimoto"]] [--filename=preloader.bin]
- Device has to be in bootrom mode, or da mode has to be crashed to enter damode
- if no option is given, either kamakiri or da will be used (da for insecure targets)
- if "kamakiri" is used as an option, kamakiri is enforced
- Valid options are : "kamakiri" (via usb_ctrl_handler attack), "amonet" (via gcpu) and "hashimoto" (via cqdma)
python mtk.py dumpbrom --ptype=["amonet","kamakiri","hashimoto"] [--filename=brom.bin]
For to dump unknown bootroms, use brute option :
python mtk.py brute
If it's successful, please add an issue over here and append the bootrom in order to add full support.
python mtk.py crash [--vid=vid] [--pid=pid] [--interface=interface]
- Boot in Brom or crash to Brom
python mtk.py peek [addr] [length] --preloader=patched_preloader.bin
python mtk.py payload --payload=payload.bin [--var1=var1] [--wdt=wdt] [--uartaddr=addr] [--da_addr=addr] [--brom_addr=addr]
python mtk.py stage
python mtk.py plstage
- Boot in Brom or crash to Brom
python mtk.py plstage --preloader=preloader.bin
python stage2.py reboot
python stage2.py rpmb
python stage2.py preloader
python stage2.py memread [start addr] [length]
python stage2.py memread [start addr] [length] --filename filename.bin
python stage2.py memwrite [start addr] --data [data as hexstring]
python stage2.py memwrite [start addr] --filename filename.bin
python stage2.py keys --mode [sej, dxcc]
For dxcc, you need to use plstage instead of stage
- Run the mtk tool with --debugmode. Log will be written to log.txt (hopefully)
- Go to config/brom_config.py
- Unknown usb vid/pids for autodetection go to config/usb_ids.py