Mtkclient

MTKClient is a flashing tool for devices based on MediaTek SOCs that uses exploits in the SOC itself to edit partitions on the device.
== Benefits ==
The usage of MTKClient has a variety of benefits over other methods of device manipulation. For one, it is possible to unlock the bootloader of devices that either do not have an official unlocking method or do not support commands such as fastboot or heimdall. It is also possible to flash partitions that otherwise would be inaccessible through normal flashing methods. All of this is done through two modes that MediaTek SOCs have called Preloader and Boot Rom Mode (BROM Mode).
== Installation ==
MTKClient is already packaged under Alpine in the testing repository. Other distributions may have it packaged. If your distribution does not have MTKClient packaged, it is possible to git clone the repository and run the program from the cloned folder using Python. For older SOCs [mt6260 or lower], a recompiled kernel supporting the kamakiri attack exploit is required. (Instructions for compiling with the exploit supported are on MTKClient's git page.
== Connection ==
To put the device in BROM mode, device specific buttons need to be pressed. Refer to the device page for information on which buttons to press.
If you are attempting to port a device using MTKClient, your only options are to either search the internet for instances of other people using MTKClient with your device (XDA Developers Forums are a good source), or to go through trial and error. Sometimes it is possible to short pins on the device to ground to drop it into BROM mode, but that can be damage the device if done wrong, so make sure to check the MTKClient git README and issues for information before attempting to do so.
To make sure that the connection works and you have all the required authentication files, try to get the target config and the efuse values:
$ python mtk gettargetconfig
$ python mtk da efuse
== Backups ==
To back up the entire flash storage using MTKClient, connect the device to MTKClient and proceed with the following:
$ python mtk rf /path/to/the.img
And to restore the backup:
$ python mtk wf /path/to/the.img
== Bootloader Unlocking ==
To unlock the bootloader of a device using MTKClient, connect the device to MTKClient and proceed with the following:
 Factory Reset Device
$ python mtk e metadata,userdata,md_udc
 Unlock Bootloader
$ python mtk da seccfg unlock
 Reboot Device
$ python mtk reset
== Flashing With pmbootstrap ==
To flash with pmbootstrap, the flash method mtkclient needs to be selected either during pmbootstrap init or added to the deviceinfo file of a port. From there, flashing using pmbootstrap flasher is available.
== Flashing Directly ==
To flash partitions using MTKClient, connect the device to MTKClient and proceed with the following:
$ python mtk w <partition name> <path to image file>
To flash multiple partitions using MTKClient:
 Make sure to put the image paths in the same order you put the partitions to flash, otherwise the images will flash to the wrong partitions.
$ python mtk w <partition name, partition name> <path to image file, path to image file>
== See also ==
* MTKClient
* Initial Commit for Flashing Method
* Introduction to MTK Reverse Engineering by Bjoern Kerler, the creator of the tool