[hovatek]

This guide will explain how to unlock a Mediatek device's bootloader using MTKclient. This will come in handy for those who can't unlock bootloader using fastboot . This was tested on the LG K51

Warning: Your data will be wiped so backup important stuff first

Requirements

• Install Mediatek drivers @ https://www.hovatek.com/forum/thread-440.html
  
• Download and install USBDK @ https://github.com/daynix/UsbDk/releases/
  
• Download and install python @ https://www.python.org/downloads/ (ensure to tick the checkbox Add Python x.x to PATH)
  
• Download MTKClient @ https://github.com/bkerler/mtkclient/arc...s/main.zip and extract
  
• Internet connection
  

Steps to unlock Mediatek Bootloader using mtkclient

Follow the steps below to unlock a Mediatek device's bootloader using mtkclient

See the video below or @ https://youtu.be/OU8hRpZCC0I

1. Open the mtkclient folder, right-click the address bar at the top and copy the address
   
   
   
   
   
   
2. Launch Command prompt and type cd <space> then paste the address you copied and tap enter
   
   
   
   
   
   
3. You're set to run commands
   
   
   
   
   
   
4. Run the following commands
   
   
   Code:

   python setup.py install
pip3 install -r requirements.txt
   
   
5. Run the data wipe command then connect your device in BROM Mode
   
   
   Code:

   python mtk e metadata,userdata,md_udc
   
   
6. Run the bootloader unlock command then re-connect your device in BROM Mode
   
   
   Code:

   python mtk xflash seccfg unlock
   
   or
   
   
   Code:

   python mtk da seccfg unlock
   
   
7. Disconnect and boot
   
   

Credits
Credits to Warlockguitarman for the ground work and discovering the exploit (from Chimera), also to the developer of mtkclient for integrating the exploit.

Important Notice

• How you boot into BROM varies with device so look it up for your model.
  
• To re-lock Bootloader wipe seccfg or run
  
  Code:

  python mtk xflash seccfg lock
  or
  
  Code:

  python mtk da seccfg lock
• If you encounter an error using python in commands then try py -3
  
• If you get '[LIB]: ←[31mError on sending emi: unpack requires a buffer of 12 bytes←[0m' then delete mtkclient/Loader/MTK_AllInOne_DA_5.1824.bin
  
• If you get '[LIB]: ←[33mNo preloader given. Operation may fail due to missing dram setup.←[0m
  DAXFlash - Uploading stage 2...' then ensure to add the --preloader flag with the preloader.bin for your model
  
• If you encounter 'pip3' is not recognized as an internal command or external, an operable program or a batch file. then try
  
  Code:

  py -3 -m pip install -r requirements.txt

Video Transcript

In this video tutorial, I'll be explaining how to unlock the Bootloader of a Mediatek Android device using mtkclient. First, you need to have installed your Mediatek VCOM drivers, you also need to have installed usbdk drivers, I'll link to these. Then you need to install python also, preferably the latest python and make sure you tick install environmental variable and then you need to download mtkclient. I'll link to all these alright? Now, once you have this in place, you open the MTKclient, right-click up here, click copy address, you open command prompt, and you cd to the mtkclient directory. Now, from this directory, you run the following commands. I already ran this command. Now, to unlock the bootloader, you run this command.

Your partitions might vary. I'm working on an LG K51. Now, you power off the device and boot it to BROM mode. Your button combination might vary. For this K51, its volume down and Google Home key buttons so I'll hold these and connect ..and release and finally, you run this command. I'm going to have to disconnect and re-run so.. I need to first power off my K51 to run the second command or to execute it rather. BROM mode and connect. So now you can disconnect and power up and your bootloader should be unlocked. So that's how to unlock the bootloader of a Mediatek Android device using mtkclient

[Trunks614]

How do I boot my phone into BROM mode? I'm aware of recovery mode and factory mode but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.

[Trunks614]

How do I boot my phone into BROM mode? I'm aware of recovery mode (volume up + power button) and factory mode (volume down + power button) but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.

[hovatek]

How do I boot my phone into BROM mode? I'm aware of recovery mode (volume up + power button) and factory mode (volume down + power button) but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.

Try both volume buttons

[Novan Banyu]

Does this work on redmi 9 mt6768

and how to boot into broom mode for redmi 9 devices

[X3non]

Does this work on redmi 9 mt6768

you'd have to try it out to find out

and how to boot into broom mode for redmi 9 devices

again, you'd have to try different keys on your device to find out which key gets you brom mode
usual suspect is vol down, you can try single or double keys combo

[nerolee304]

Will this work on bootloader that has password encryption like Nokia bootloader Nokia has to send you unlock.key you have to flash it before unlocking bootloader

[X3non]

Will this work on bootloader that has password encryption like Nokia bootloader Nokia has to send you unlock.key you have to flash it before unlocking bootloader

only one way to find out, and that's to try it out yourself. the nokia device in question must be using a mediatek chipset

[El_comentarista]

I had already tried mtkclient, however I get this error at the final stage of the process:
"Unknown seccfg partition header. Aborting unlock."

MT8163. Generic chinese tablet W108a. The seccfg file attached

[hovatek]

I had already tried mtkclient, however I get this error at the final stage of the process:
"Unknown seccfg partition header. Aborting unlock."

MT8163. Generic chinese tablet W108a. The seccfg file attached

How did you extract this file?