How to use MTK Bypass to backup or flash secure boot MTK

[Tutorial] How to use MTK Bypass to backup or flash secure boot MTK

hovatek
Administrator

49,753

29-01-2021, 07:22 PM

#1

This is a step-by-step guide showing how to flash or backup a Mediatek (MTK) secure boot device without using a custom download agent (DA). This tool disables the SLA / DAA bootrom protection

A little history

Secure Boot Mediatek devices require loading a specific Download Agent (DA) file to permit flashing / backup operations. You can read more about Secure Boot, DA and Auth in this article. Up until this exploit was discovered, We'd been providing free Mediatek DA files @ https://www.hovatek.com/forum/thread-23784.html so feel free to check it out if this exploit doesn't yet support your secure boot MTK device's chipset.

Very Important Notice

You can also use mtkclient + SP flash tool to backup and flash secure boot devices.
This MTK-bypass procedure can be used to backup firmware, flash firmware or even format partitions on Mediatek secure boots without a custom DA
If you download the latest version of mtk bypass tool, then skip steps 3-6 in our guide (libusb-win32 is no longer needed), simply download & install USBdk @ https://github.com/daynix/UsbDk/releases
If you get a module not found error then uninstall all Python versions (and paths in environmental variables) on your PC and restart the process

Requirements

Download & install Python (python 3 is needed) @ https://www.python.org/downloads/
Download & install libusb-win32 @ https://sourceforge.net/projects/libusb-...e/download or USBdk @ https://github.com/daynix/UsbDk/releases if you're using the latest version of MTK bypass
Download & install MTK driver; currently using the manual mtk signed driver, simply right-click cdc-acm.inf and click install
Download MTK bypass utility @ https://github.com/MTK-bypass/bypass_uti...master.zip
Download exploits collection @ https://github.com/MTK-bypass/exploits_c...master.zip
PC must have an internet connection
Download SP flash tool (for this example)

How to backup / flash a MediaTek (MTK) secure boot device using MTK Bypass Utility

The steps below explain how to backup / flash a Mediatek (MTK) secure boot device without using a custom download agent (DA)

See the video below or @ https://youtu.be/Qoj162WW1So

Install Python and ensure to tick the checkbox Add Python x.x to PATH
Once successful, open a CMD prompt or powershell window and type the command below then press the Enter key. To confirm installation success, you can run the command a second time and you should get a requirement satisfied message seen below

Code:

pip install pyusb json5
Launch libusb-win32, tick Install a device filter then click Next
At this point (depending on your model), you need to hold both volume buttons, the volume up or the volume down button then connect the phone to the PC. In the case for Nokia 3, it's volume down
You should see MediaTek USB port, quickly select it and click "Install"
You'll get a message as seen below if successful, click Ok then you can exit the libusb tool. If not successful, then retry the previous step again
From the exploit collection folder, copy the payloads folder along with default_config.json5 file into the bypass utility folder
In the bypass utility folder, hold the shift key then right-click and select Open CMD or Powershell window here
In the powershell / cmd window, type the command below and press Enter. Use the second command if you get an error using the first. You should get a message, "Waiting for bootrom"

Code:

python main.py

Code:

py -3 main.py
At this point, either hold the volume up or volume down button on the phone then connect to the PC using a USB cable
Your device should be detected and you should see Protection disabled if it's successful. You can minimize the CMD / Powershell window
Leave the phone connected, launch SP flash tool, and click Options > Option
In the new window, click Connection
Select UART, select the com port, change baudrate to 921600 then close the window (you could also use USB high-speed connection)
You can now proceed to flash or backup firmware using tools like WWR MTK or SP flash tool and the default download DA

Important Notice

Before proceeding, ensure that a payload exists for your phone's chipset. For this, you can check the list @ https://github.com/MTK-bypass/exploits_c...r/payloads
If you happen to be using libusb standalone version and your device isn't getting detected properly then ensure to use the installer version listed under the requirements section
If at any point you disconnect the phone while flashing, you'll need to rerun the python main.py command to disable protection before you proceed again
If you wish to carry out multiple processes on a particular device e.g readback then format a partition, or failed flash and a reflash then you don't need to reboot the device for each process. After performing the first process, simply run main.py with the phone still connected then hold the boot key(s) + power key for about 15 seconds (it may vary on your device), your device should reboot back into mtk usb port and main.py will bypass protection allowing you proceed with the next process
Credits goes to the developers of the MTK-bypass tool chaosmaster , Dinolek as well as other contributors to the exploits
If you encounter an error like

Code:

Traceback (most recent call last): File "main.py", line 3, in <module> from src.exploit import exploit ImportError: No module named src.exploit
then ensure you're running the right main.py command for your installed python version (e.g py -3 main.py)
You're to run python main.py or py -3 main.py before every operation in whatever tool you're using

Video Transcript

Quote:In this video tutorial, I'm going to be showing how to backup firmware or flash firmware to a Mediatek secure boot device without using a custom download agent. Now, for the sake of this tutorial, I'm going to be using Nokia 3. Its a secure boot device and we're also going to be making use of these tools. Actually, these tools, the download links for them will be in the description. So we're going to start off by installing python. When installing python, ensure to click Add Python to path then click Install Now. The tool we're going to be using is called MTK bypass. What you need to download is bypass utility and exploit connection. You can download python and libusb. Links will be in the description. To download from Github, just click on the item you wish to download then click Code. Download Zip. By the way, the developer and contributors to this tool, full credit goes to them. Python is still installing. Successful. You can now close. Quickly open the command prompt window. Now in command prompt, type and Enter this command. You can right-click to paste then press Enter. Ensure you have an internet connection while running this command. You should get this message; you're using PIP version 20. Once you get this message, you're good to go. You can now close. Install LIbusb, launch. Now, you need to install Mediatek drivers. I'm using a signed driver, the link is at the forum. This is the manual Mediatek signed driver. Just right-click on the inf file and install. Successful. OK. Lastly, you'll need to extract these two items, the files you downloaded from Github. Now, open exploit, copy payload folder and default config. Paste them into the MTK bypass utility folder and you should have something like this. Now, return back to libusb , install a device filter, next. At this point, what you want to do now is to connect the phone to Mediatek MTK USB Port mode. To do this, on some devices, you hold volume up. On some devices, you hold volume down. Now, in the case of Nokia 3, volume down works so I'm going to hold volume down button and connect the USB port. Now, once I do this, I'll need to quickly select Mediatek USB port and install. Lets see how it goes. Volume down button and then I connect the USB. MTK USB port. OK, it says here successful. Your phone might power on, its all good and fine. Just switch it back off it it does. Now, once that is done, you can minimize or close. Now, we need to open a command prompt window here or power shell window. You can do this by holding Shift key then right-click. Now, you need to type python main.py. Basically, we're trying to launch this file. Hit Enter. You might get an error message; python was not found. If you get this message, you need to launch python 3 launcher by typing py -3 then the file you want to run which is main.py. Now you'll get this message; waiting for bootrom. At this point, you're going to re-connect the phone using the same volume down button and connect the USB cable. Now, if successful, you should see this message; protection disabled. You can see Secure Boot device is true. Now, don't disconnect the phone, simply minimize then launch SP flash tool. Now, for the sake of this tutorial, I'm just going to be flashing boot and recovery only but of course you can backup, you can format partitions, whatever you wish to do. Now, go to options.. OK I've selected (scatter) file. I want to flash only boot and recovery so I select boot and recovery. Now, you need to configure SP flash tool connection settings. Option , Option, Connection. Set it to UART. COM port depends on what you have here; Mediatek COM port 10 and finally the speed. You can now close and click the Download button. Now, if all goes well, the device should start flashing using the default download agent. You should get a successful message once you're done. You can now disconnect the device and power it on. Basically, this is how you flash or backup firmware from a Mediatek secure boot device without using a custom Download Agent. All you just need to do is make sure that the MTK bypass has exploit for your chipset which you'll find under the payload folder. You'll find different chipsets. Right now, this is what they have as at the time of creating this guide. Thank you for watching, ensure to subscribe for more tutorials.

This post was last modified: 08-11-2023, 07:28 PM by hovatek.

XRed_CubeX
Junior Member

29

30-01-2021, 11:01 AM

#2

Tested on Meizu M5c (MT6737m) and works perfectly.
Also tested on Meizu m3s (MT6750) and gave no problems.

This post was last modified: 30-01-2021, 09:08 PM by XRed_CubeX.

a4Abhi
Junior Member

15

30-01-2021, 12:59 PM

#3

Will it be able to connect Meta Mode in Xiaomi Poco c3 or Redmi 9 ??
Actually Iam having Poco C3but unable to Boot it into Meta Mode even after Boot loader unlocked on MIUI 12.

thabitu
Techie Member

71

30-01-2021, 02:23 PM

#4

Can we use miracle box instead of spft?

XRed_CubeX
Junior Member

29

30-01-2021, 04:31 PM

#5

(30-01-2021, 02:23 PM)thabitu Can we use miracle box instead of spft?

In theory, yes.
This exploit mainly deals with disabling the need for the download agent but for only one session so every time the phone restarts you should rerun the exploit, with the miracle box I'm not 100% sure if it would work but I'm pretty sure it would need a few more settings to work perfectly

Maaz Khalid
Junior Member

21

31-01-2021, 10:23 AM

#6

I'm getting this when i try to disable protection (See attachment)

Attached Files

Screenshot (3).png
Size: 60.04 KB / Downloads: 387

XRed_CubeX
Junior Member

29

31-01-2021, 10:31 AM

#7

(31-01-2021, 10:23 AM)Maaz Khalid I'm getting this when i try to disable protection (See attachment)

Install libusb-win32 filter to Mediatek USB Port

hovatek
Administrator

49,753

31-01-2021, 11:07 AM

#8

(30-01-2021, 11:01 AM)XRed_CubeX Tested on Meizu M5c (MT6737m) and works perfectly.
Also tested on Meizu m3s (MT6750) and gave no problems.

thanks for testing & confirming

hovatek
Administrator

49,753

31-01-2021, 11:09 AM

#9

(30-01-2021, 12:59 PM)a4Abhi Will it be able to connect Meta Mode in Xiaomi Poco c3 or Redmi 9 ??
Actually Iam having Poco C3but unable to Boot it into Meta Mode even after Boot loader unlocked on MIUI 12.

unlikely, this bypass uses the mtk usb port (brom), to get to meta mode, the device needs to first be detected as mtk vcom preloader before whatever tool you use will attempt to reboot to meta mode

hovatek
Administrator

49,753

31-01-2021, 11:10 AM

#10

(30-01-2021, 02:23 PM)thabitu Can we use miracle box instead of spft?

i'd say no, not unless you know a way to set miracle box / thunder to use UART instead of USB
i don't think miracle has such a settings but i maybe wrong

View a Printable Version

Users browsing this thread:
2 Guest(s)

A little history

Requirements

How to backup / flash a MediaTek (MTK) secure boot device using MTK Bypass Utility

Find us

Call us

Mail us

Useful Links

Actions