bkerler/mtkclient

How bkerler/mtkclient works

MTKClient is a MediaTek device service tool for bootrom/preloader exploitation and flash operations. The principal workflow is to connect to a device, identify its chip and mode, exploit or upload a Download Agent (DA), then perform storage and partition operations. The repository also provides GUI controls, multiple DA protocol implementations, crypto/authentication support, and payload emulation. Some links below follow explicit README statements or SOURCE INDEX references; unsampled modules are represented only at subsystem level, and uncertain relationships are omitted.

Main entry points: mtk_daloader.py DA loader · mtk_class.py MTK controller · mtk_da_handler.py DA operations · xml_lib.py XML DA

Components 24

User interfaces

CLI mtk.py
GUI mtk_gui.py
Flash controls mtkclient/gui/readFlashPartitions.py

Device access

MTK controller mtkclient/Library/mtk_class.py
USB transport mtkclient/Library/Connection/usblib.py
Device handling mtkclient/Library/Connection/devicehandler.py
Chip profiles mtkclient/config/brom_config.py

Boot and security

Preloader protocol mtkclient/Library/mtk_preloader.py
Exploit dispatcher mtkclient/Library/exploit_handler.py
Heapbait exploit mtkclient/Library/Exploit/heapbait.py
Payload emulator src/stage1/emulate_payload.py
SLA authentication mtkclient/Library/Auth/sla.py

Download agents

DA operations mtkclient/Library/DA/mtk_da_handler.py
DA loader mtkclient/Library/DA/mtk_daloader.py
Legacy DA mtkclient/Library/DA/legacy/dalegacy_lib.py
XFlash DA mtkclient/Library/DA/xflash/xflash_lib.py
XML DA mtkclient/Library/DA/xmlflash/xml_lib.py
V6 extension mtkclient/Library/DA/xmlflash/extension/v6.py

Flash operations

Storage mapping mtkclient/Library/DA/storage.py
Partition parsing mtkclient/Library/Partitions/gpt.py
DA filesystem mtkclient/Library/Filesystem/mtkdafs.py
Hardware crypto mtkclient/Library/Hardware/hwcrypto.py

Other components

Operator
Device flash

Connections 24

Operator → CLI: runs tool README.md
Operator → GUI: uses README.md
GUI → MTK controller: initializes mtk_gui.py
GUI → Flash controls: opens controls mtk_gui.py
MTK controller → Preloader protocol: uses mtkclient/Library/mtk_class.py
MTK controller → DA loader: creates mtkclient/Library/mtk_class.py
MTK controller → Chip profiles: loads profiles mtkclient/Library/mtk_class.py
USB transport → Device handling: uses mtkclient/Library/Connection/usblib.py
Exploit dispatcher → Hardware crypto: uses mtkclient/Library/exploit_handler.py
Heapbait exploit → Exploit dispatcher: extends mtkclient/Library/Exploit/heapbait.py
Heapbait exploit → DA loader: uses mtkclient/Library/Exploit/heapbait.py
Heapbait exploit → XML DA: uses mtkclient/Library/Exploit/heapbait.py
Payload emulator → MTK controller: emulates payloads
DA operations → DA loader: uploads agent mtkclient/Library/DA/mtk_da_handler.py
DA loader → Legacy DA: dispatches mtkclient/Library/DA/mtk_daloader.py
DA loader → XFlash DA: dispatches mtkclient/Library/DA/mtk_daloader.py
DA loader → XML DA: dispatches mtkclient/Library/DA/mtk_daloader.py
XML DA → V6 extension: uses extension mtkclient/Library/DA/xmlflash/xml_lib.py
XML DA → SLA authentication: checks auth mtkclient/Library/DA/xmlflash/xml_lib.py
DA operations → DA filesystem: uses mtkclient/Library/DA/mtk_da_handler.py
DA operations → Partition parsing: reads table
DA operations → Device flash: reads and writes mtkclient/Library/DA/mtk_da_handler.py
Storage mapping → Device flash: maps storage mtkclient/Library/DA/storage.py
Flash controls → Partition parsing: shows partitions mtk_gui.py

More Python diagrams: nanonets/docstrange · se2p/pynguin · swapagarwal/jarvis-on-messenger · chainlit/cookbook · pyocd/pyocd

Drawn by GitDiagram on October 28, 2026 from the repository's file tree, README and source files. Read as Markdown ·