Hovatek Forum DEVELOPMENT Android [Development] How to unlock Mediatek bootloader using mtkclient
Can't login? Please, reset your password.
Hovatek is recruiting! Apply Now


[Development] How to unlock Mediatek bootloader using mtkclient

[Development] How to unlock Mediatek bootloader using mtkclient

Pages (5): 1 2 3 4 5 Next
hovatek
hovatek
hovatek
Administrator
49,566
30-09-2021, 12:59 PM
#1



This guide will explain how to unlock a Mediatek device's bootloader using MTKclient. This will come in handy for those who can't unlock bootloader using fastboot. This was tested on the LG K51.

Warning: Your data will be wiped so backup important stuff first

Requirements


Steps to unlock Mediatek Bootloader using mtkclient


Follow the steps below to unlock a Mediatek device's bootloader using mtkclient


See the video below or @ https://youtu.be/OU8hRpZCC0I


  1. Open the mtkclient folder, right-click the address bar at the top and copy the address

    [Image: How-to-unlock-Mediatek-bootloader-using-...t-1-2.webp]

  2. Launch Command prompt and type cd (type space) then paste the address you copied and tap enter

    [Image: How-to-unlock-Mediatek-bootloader-using-...t-2-2.webp]

  3. You're set to run commands

    [Image: How-to-unlock-Mediatek-bootloader-using-...t-2-2.webp]

  4. Run the following commands

    Code:

    python setup.py install
    pip3 install -r requirements.txt

    or

    Code:

    py -3 setup.py install
    py -3 -m pip install -r requirements.txt

  5. Run the data wipe command then connect your device in BROM Mode

    Code:

    python mtk e metadata,userdata,md_udc

    or

    Code:

    py -3 mtk e metadata,userdata,md_udc

  6. Run the bootloader unlock command then re-connect your device in BROM Mode

    For older mtkclient versions:

    Code:

    python mtk xflash seccfg unlock

    or

    Code:

    py -3 mtk xflash seccfg unlock

    For newer mtkclient versions:

    Code:

    python mtk da seccfg unlock

    or

    Code:

    py -3 mtk da seccfg unlock

  7. Wait till it's done then disconnect and boot


Credits
Credits to Warlockguitarman for the groundwork and discovering the exploit (from Chimera), and also to the developer of mtkclient for integrating the exploit.

Important Notice
  • How you boot into BROM varies with the device so look it up for your model.
  • To re-lock Bootloader wipe seccfg or run

    For older mtkclient versions:

    Code:

    python mtk xflash seccfg lock

    or

    Code:

    py -3 mtk xflash seccfg lock

    For new mtkclient versions
    Code:

    python mtk da seccfg lock

    or

    Code:

    py -3 mtk da seccfg lock
  • If you encounter an error using python in commands then try py -3
  • If you get '[LIB]: ←[31mError on sending emi: unpack requires a buffer of 12 bytes←[0m' then delete mtkclient/Loader/MTK_AllInOne_DA_5.1824.bin
  • If you get '[LIB]: ←[33mNo preloader given. Operation may fail due to missing dram setup.←[0m
    DAXFlash - Uploading stage 2...' then ensure to add the --preloader flag with the preloader.bin for your model
  • If you encounter 'pip3' is not recognized as an internal command or external, an operable program or a batch file. then try
    Code:

    py -3 -m pip install -r requirements.txt
  • You can also use MTK Client GUI by running
    Code:

    python mtk_gui

    or

    Code:

    py -3 mtk_gui

Video Transcript
Quote:In this video tutorial, I'll be explaining how to unlock the Bootloader of a Mediatek Android device using mtkclient. First, you need to have installed your Mediatek VCOM drivers, you also need to have installed usbdk drivers, I'll link to these. Then you need to install python also, preferably the latest python and make sure you tick install environmental variable and then you need to download mtkclient. I'll link to all these alright? Now, once you have this in place, you open the MTKclient, right-click up here, click copy address, you open command prompt, and you cd to the mtkclient directory. Now, from this directory, you run the following commands. I already ran this command. Now, to unlock the bootloader, you run this command.

Your partitions might vary. I'm working on an LG K51. Now, you power off the device and boot it to BROM mode. Your button combination might vary. For this K51, its volume down and Google Home key buttons so I'll hold these and connect ..and release and finally, you run this command. I'm going to have to disconnect and re-run so.. I need to first power off my K51 to run the second command or to execute it rather. BROM mode and connect. So now you can disconnect and power up and your bootloader should be unlocked. So that's how to unlock the bootloader of a Mediatek Android device using mtkclient
This post was last modified: 05-11-2023, 12:02 PM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
Trunks614
Trunks614
Trunks614
Enthusiastic Member
7
02-10-2021, 03:58 PM
#2
How do I boot my phone into BROM mode? I'm aware of recovery mode and factory mode but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.
Trunks614
Trunks614
Trunks614
Enthusiastic Member
7
02-10-2021, 04:18 PM
#3
(02-10-2021, 03:58 PM)Trunks614 How do I boot my phone into BROM mode? I'm aware of recovery mode (volume up + power button) and factory mode (volume down + power button) but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.
hovatek
hovatek
hovatek
Administrator
49,566
03-10-2021, 05:10 AM
#4
(02-10-2021, 04:18 PM)Trunks614 How do I boot my phone into BROM mode? I'm aware of recovery mode (volume up + power button) and factory mode (volume down + power button) but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.

Try both volume buttons

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
Novan Banyu
Novan Banyu
Novan Banyu
Newbie
1
15-10-2021, 08:32 AM
#5



Does this work on redmi 9 mt6768

and how to boot into broom mode for redmi 9 devices
X3non
X3non
X3non
Recognized Contributor
22,062
15-10-2021, 05:27 PM
#6
(15-10-2021, 08:32 AM)Novan Banyu Does this work on redmi 9 mt6768

you'd have to try it out to find out


(15-10-2021, 08:32 AM)Novan Banyu and how to boot into broom mode for redmi 9 devices

again, you'd have to try different keys on your device to find out which key gets you brom mode
usual suspect is vol down, you can try single or double keys combo
nerolee304
nerolee304
nerolee304
Junior Member
26
23-10-2021, 11:29 PM
#7
Will this work on bootloader that has password encryption like Nokia bootloader Nokia has to send you unlock.key you have to flash it before unlocking bootloader
X3non
X3non
X3non
Recognized Contributor
22,062
25-10-2021, 09:33 AM
#8
(23-10-2021, 11:29 PM)nerolee304 Will this work on bootloader that has password encryption like Nokia bootloader Nokia has to send you unlock.key you have to flash it before unlocking bootloader

only one way to find out, and that's to try it out yourself. the nokia device in question must be using a mediatek chipset
El_comentarista
El_comentarista
El_comentarista
Enthusiastic Member
5
27-04-2022, 03:52 PM
#9
I had already tried mtkclient, however I get this error at the final stage of the process:
"Unknown seccfg partition header. Aborting unlock."

MT8163. Generic chinese tablet W108a. The seccfg file attached
Attached Files
.zip
seccfg.zip
Size: 417 bytes / Downloads: 13
hovatek
hovatek
hovatek
Administrator
49,566
30-04-2022, 07:48 AM
#10



(27-04-2022, 03:52 PM)El_comentarista I had already tried mtkclient, however I get this error at the final stage of the process:
"Unknown seccfg partition header. Aborting unlock."

MT8163. Generic chinese tablet W108a. The seccfg file attached

How did you extract this file?
This post was last modified: 30-04-2022, 07:53 AM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
Pages (5): 1 2 3 4 5 Next
Users browsing this thread:
 2 Guest(s)
Users browsing this thread:
 2 Guest(s)
YtWhTl
live chat
whatsapp telegram instagram