How to unlock Mediatek bootloader using mtkclient

[Development] How to unlock Mediatek bootloader using mtkclient

hovatek
Administrator

49,778

30-09-2021, 12:59 PM

#1

This guide will explain how to unlock a Mediatek device's bootloader using MTKclient. This will come in handy for those who can't unlock bootloader using fastboot. This was tested on the LG K51.

Warning: Your data will be wiped so backup important stuff first

Requirements

Install Mediatek drivers
Download and install USBDK @ https://github.com/daynix/UsbDk/releases/
Download and install Python @ https://www.python.org/downloads/ (ensure to tick the checkbox Add Python x.x to PATH)
Download MTKClient @ https://github.com/bkerler/mtkclient/arc...s/main.zip and extract
Internet connection

Steps to unlock Mediatek Bootloader using mtkclient

Follow the steps below to unlock a Mediatek device's bootloader using mtkclient

See the video below or @ https://youtu.be/OU8hRpZCC0I

Open the mtkclient folder, right-click the address bar at the top and copy the address
Launch Command prompt and type cd (type space) then paste the address you copied and tap enter
You're set to run commands
Run the following commands

Code:

python setup.py install pip3 install -r requirements.txt

or

Code:

py -3 setup.py install py -3 -m pip install -r requirements.txt
Run the data wipe command then connect your device in BROM Mode

Code:

python mtk.py e metadata,userdata,md_udc

or

Code:

py -3 mtk.py e metadata,userdata,md_udc
Run the bootloader unlock command then re-connect your device in BROM Mode

For older mtkclient versions:

Code:

python mtk.py xflash seccfg unlock

or

Code:

py -3 mtk.py xflash seccfg unlock

For newer mtkclient versions:

Code:

python mtk.py da seccfg unlock

or

Code:

py -3 mtk.py da seccfg unlock
Wait till it's done then disconnect and boot

Credits
Credits to Warlockguitarman for the groundwork and discovering the exploit (from Chimera), and also to the developer of mtkclient for integrating the exploit.

Important Notice

If you encounter "error: Microsoft Visual C++ 14.0 or greater is required" then follow the guide @ https://www.hovatek.com/forum/thread-47409.html
How you boot into BROM varies with the device so look it up for your model.
To re-lock Bootloader wipe seccfg or run

For older mtkclient versions:

Code:

python mtk.py xflash seccfg lock

or

Code:

py -3 mtk.py xflash seccfg lock

For new mtkclient versions

Code:

python mtk.py da seccfg lock

or

Code:

py -3 mtk.py da seccfg lock
If you encounter an error using python in commands then try py -3
If you get '[LIB]: ←[31mError on sending emi: unpack requires a buffer of 12 bytes←[0m' then delete mtkclient/Loader/MTK_AllInOne_DA_5.1824.bin
If you get '[LIB]: ←[33mNo preloader given. Operation may fail due to missing dram setup.←[0m
DAXFlash - Uploading stage 2...' then ensure to add the --preloader flag with the preloader.bin for your model
If you encounter 'pip3' is not recognized as an internal command or external, an operable program or a batch file. then try

Code:

py -3 -m pip install -r requirements.txt
You can also use MTK Client GUI by running

Code:

python mtk_gui.py

or

Code:

py -3 mtk_gui.py

Video Transcript

Quote:In this video tutorial, I'll be explaining how to unlock the Bootloader of a Mediatek Android device using mtkclient. First, you need to have installed your Mediatek VCOM drivers, you also need to have installed usbdk drivers, I'll link to these. Then you need to install python also, preferably the latest python and make sure you tick install environmental variable and then you need to download mtkclient. I'll link to all these alright? Now, once you have this in place, you open the MTKclient, right-click up here, click copy address, you open command prompt, and you cd to the mtkclient directory. Now, from this directory, you run the following commands. I already ran this command. Now, to unlock the bootloader, you run this command.

Your partitions might vary. I'm working on an LG K51. Now, you power off the device and boot it to BROM mode. Your button combination might vary. For this K51, its volume down and Google Home key buttons so I'll hold these and connect ..and release and finally, you run this command. I'm going to have to disconnect and re-run so.. I need to first power off my K51 to run the second command or to execute it rather. BROM mode and connect. So now you can disconnect and power up and your bootloader should be unlocked. So that's how to unlock the bootloader of a Mediatek Android device using mtkclient

This post was last modified: 24-10-2024, 10:13 AM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

Trunks614
Enthusiastic Member

7

02-10-2021, 03:58 PM

#2

How do I boot my phone into BROM mode? I'm aware of recovery mode and factory mode but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.

Trunks614
Enthusiastic Member

7

02-10-2021, 04:18 PM

#3

(02-10-2021, 03:58 PM)Trunks614 How do I boot my phone into BROM mode? I'm aware of recovery mode (volume up + power button) and factory mode (volume down + power button) but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.

hovatek
Administrator

49,778

03-10-2021, 05:10 AM

#4

(02-10-2021, 04:18 PM)Trunks614 How do I boot my phone into BROM mode? I'm aware of recovery mode (volume up + power button) and factory mode (volume down + power button) but I've never tried or seen BROM mode before. Please help. I use a Gionee a1 lite.

Try both volume buttons

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

Novan Banyu
Newbie

1

15-10-2021, 08:32 AM

#5

Does this work on redmi 9 mt6768

and how to boot into broom mode for redmi 9 devices

hovatek
Administrator

49,778

15-10-2021, 05:27 PM

#6

(15-10-2021, 08:32 AM)Novan Banyu Does this work on redmi 9 mt6768

you'd have to try it out to find out

(15-10-2021, 08:32 AM)Novan Banyu and how to boot into broom mode for redmi 9 devices

again, you'd have to try different keys on your device to find out which key gets you brom mode
usual suspect is vol down, you can try single or double keys combo

nerolee304
Junior Member

26

23-10-2021, 11:29 PM

#7

Will this work on bootloader that has password encryption like Nokia bootloader Nokia has to send you unlock.key you have to flash it before unlocking bootloader

hovatek
Administrator

49,778

25-10-2021, 09:33 AM

#8

(23-10-2021, 11:29 PM)nerolee304 Will this work on bootloader that has password encryption like Nokia bootloader Nokia has to send you unlock.key you have to flash it before unlocking bootloader

only one way to find out, and that's to try it out yourself. the nokia device in question must be using a mediatek chipset

El_comentarista
Enthusiastic Member

5

27-04-2022, 03:52 PM

#9

I had already tried mtkclient, however I get this error at the final stage of the process:
"Unknown seccfg partition header. Aborting unlock."

MT8163. Generic chinese tablet W108a. The seccfg file attached

Attached Files

seccfg.zip
Size: 417 bytes / Downloads: 15

hovatek
Administrator

49,778

30-04-2022, 07:48 AM

#10

(27-04-2022, 03:52 PM)El_comentarista I had already tried mtkclient, however I get this error at the final stage of the process:
"Unknown seccfg partition header. Aborting unlock."

MT8163. Generic chinese tablet W108a. The seccfg file attached

How did you extract this file?

This post was last modified: 30-04-2022, 07:53 AM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

View a Printable Version

Users browsing this thread:
1 Guest(s)

Requirements

Steps to unlock Mediatek Bootloader using mtkclient

Find us

Call us

Mail us

Useful Links

Actions