# bkerler/mtkclient architecture

> Architecture diagram of the GitHub repository bkerler/mtkclient, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bkerler/mtkclient
- Repository: https://github.com/bkerler/mtkclient

## Overview

MTKClient is a MediaTek device service tool for bootrom/preloader exploitation and flash operations. The principal workflow is to connect to a device, identify its chip and mode, exploit or upload a Download Agent (DA), then perform storage and partition operations. The repository also provides GUI controls, multiple DA protocol implementations, crypto/authentication support, and payload emulation. Some links below follow explicit README statements or SOURCE INDEX references; unsampled modules are represented only at subsystem level, and uncertain relationships are omitted.

Main entry points: [`mtkclient/Library/DA/mtk_daloader.py`](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/mtk_daloader.py) (DA loader), [`mtkclient/Library/mtk_class.py`](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/mtk_class.py) (MTK controller), [`mtkclient/Library/DA/mtk_da_handler.py`](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/mtk_da_handler.py) (DA operations), [`mtkclient/Library/DA/xmlflash/xml_lib.py`](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/xmlflash/xml_lib.py) (XML DA)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["User interfaces"]
  node_cli["CLI<br/>[mtk.py]"]
  node_gui["GUI<br/>[mtk_gui.py]"]
  node_gui_views["Flash controls"]
end

subgraph group_device["Device access"]
  node_controller["MTK controller<br/>[mtk_class.py]"]
  node_transport["USB transport<br/>[usblib.py]"]
  node_device_handler["Device handling<br/>[devicehandler.py]"]
  node_chip_config["Chip profiles<br/>[brom_config.py]"]
end

subgraph group_boot["Boot and security"]
  node_preloader["Preloader protocol<br/>[mtk_preloader.py]"]
  node_exploitation["Exploit dispatcher<br/>[exploit_handler.py]"]
  node_heapbait["Heapbait exploit<br/>[heapbait.py]"]
  node_payload_emulator["Payload emulator<br/>[emulate_payload.py]"]
  node_auth["SLA authentication<br/>[sla.py]"]
end

subgraph group_agent["Download agents"]
  node_da_handler["DA operations<br/>[mtk_da_handler.py]"]
  node_da_loader["DA loader<br/>[mtk_daloader.py]"]
  node_legacy_da["Legacy DA<br/>[dalegacy_lib.py]"]
  node_xflash_da["XFlash DA<br/>[xflash_lib.py]"]
  node_xml_da["XML DA<br/>[xml_lib.py]"]
  node_v6_da["V6 extension<br/>[v6.py]"]
end

subgraph group_operations["Flash operations"]
  node_storage["Storage mapping<br/>[storage.py]"]
  node_partitions["Partition parsing<br/>[gpt.py]"]
  node_filesystem["DA filesystem<br/>[mtkdafs.py]"]
  node_crypto["Hardware crypto<br/>[hwcrypto.py]"]
end

node_user(("Operator"))
node_flash[("Device flash")]

node_user -->|"runs tool"| node_cli
node_user -->|"uses"| node_gui
node_gui -->|"initializes"| node_controller
node_gui -->|"opens controls"| node_gui_views
node_controller -->|"uses"| node_preloader
node_controller -->|"creates"| node_da_loader
node_controller -->|"loads profiles"| node_chip_config
node_transport -->|"uses"| node_device_handler
node_exploitation -->|"uses"| node_crypto
node_heapbait -->|"extends"| node_exploitation
node_heapbait -->|"uses"| node_da_loader
node_heapbait -->|"uses"| node_xml_da
node_payload_emulator -.->|"emulates payloads"| node_controller
node_da_handler -->|"uploads agent"| node_da_loader
node_da_loader -->|"dispatches"| node_legacy_da
node_da_loader -->|"dispatches"| node_xflash_da
node_da_loader -->|"dispatches"| node_xml_da
node_xml_da -->|"uses extension"| node_v6_da
node_xml_da -->|"checks auth"| node_auth
node_da_handler -->|"uses"| node_filesystem
node_da_handler -.->|"reads table"| node_partitions
node_da_handler -->|"reads and writes"| node_flash
node_storage -->|"maps storage"| node_flash
node_gui_views -->|"shows partitions"| node_partitions

click node_cli "https://github.com/bkerler/mtkclient/blob/main/mtk.py"
click node_gui "https://github.com/bkerler/mtkclient/blob/main/mtk_gui.py"
click node_gui_views "https://github.com/bkerler/mtkclient/blob/main/mtkclient/gui/readFlashPartitions.py"
click node_controller "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/mtk_class.py"
click node_transport "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Connection/usblib.py"
click node_device_handler "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Connection/devicehandler.py"
click node_chip_config "https://github.com/bkerler/mtkclient/blob/main/mtkclient/config/brom_config.py"
click node_preloader "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/mtk_preloader.py"
click node_exploitation "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/exploit_handler.py"
click node_heapbait "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Exploit/heapbait.py"
click node_payload_emulator "https://github.com/bkerler/mtkclient/blob/main/src/stage1/emulate_payload.py"
click node_auth "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Auth/sla.py"
click node_da_handler "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/mtk_da_handler.py"
click node_da_loader "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/mtk_daloader.py"
click node_legacy_da "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/legacy/dalegacy_lib.py"
click node_xflash_da "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/xflash/xflash_lib.py"
click node_xml_da "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/xmlflash/xml_lib.py"
click node_v6_da "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/xmlflash/extension/v6.py"
click node_storage "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/storage.py"
click node_partitions "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Partitions/gpt.py"
click node_filesystem "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Filesystem/mtkdafs.py"
click node_crypto "https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Hardware/hwcrypto.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_gui,node_gui_views toneBlue
class node_controller,node_transport,node_device_handler,node_chip_config,node_flash toneAmber
class node_preloader,node_exploitation,node_heapbait,node_payload_emulator,node_auth toneMint
class node_da_handler,node_da_loader,node_legacy_da,node_xflash_da,node_xml_da,node_v6_da toneRose
class node_storage,node_partitions,node_filesystem,node_crypto,node_user toneIndigo
```

## Components

### User interfaces

- [CLI](https://github.com/bkerler/mtkclient/blob/main/mtk.py): `mtk.py`
- [GUI](https://github.com/bkerler/mtkclient/blob/main/mtk_gui.py): `mtk_gui.py`
- [Flash controls](https://github.com/bkerler/mtkclient/blob/main/mtkclient/gui/readFlashPartitions.py): `mtkclient/gui/readFlashPartitions.py`

### Device access

- [MTK controller](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/mtk_class.py): `mtkclient/Library/mtk_class.py`
- [USB transport](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Connection/usblib.py): `mtkclient/Library/Connection/usblib.py`
- [Device handling](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Connection/devicehandler.py): `mtkclient/Library/Connection/devicehandler.py`
- [Chip profiles](https://github.com/bkerler/mtkclient/blob/main/mtkclient/config/brom_config.py): `mtkclient/config/brom_config.py`

### Boot and security

- [Preloader protocol](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/mtk_preloader.py): `mtkclient/Library/mtk_preloader.py`
- [Exploit dispatcher](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/exploit_handler.py): `mtkclient/Library/exploit_handler.py`
- [Heapbait exploit](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Exploit/heapbait.py): `mtkclient/Library/Exploit/heapbait.py`
- [Payload emulator](https://github.com/bkerler/mtkclient/blob/main/src/stage1/emulate_payload.py): `src/stage1/emulate_payload.py`
- [SLA authentication](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Auth/sla.py): `mtkclient/Library/Auth/sla.py`

### Download agents

- [DA operations](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/mtk_da_handler.py): `mtkclient/Library/DA/mtk_da_handler.py`
- [DA loader](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/mtk_daloader.py): `mtkclient/Library/DA/mtk_daloader.py`
- [Legacy DA](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/legacy/dalegacy_lib.py): `mtkclient/Library/DA/legacy/dalegacy_lib.py`
- [XFlash DA](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/xflash/xflash_lib.py): `mtkclient/Library/DA/xflash/xflash_lib.py`
- [XML DA](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/xmlflash/xml_lib.py): `mtkclient/Library/DA/xmlflash/xml_lib.py`
- [V6 extension](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/xmlflash/extension/v6.py): `mtkclient/Library/DA/xmlflash/extension/v6.py`

### Flash operations

- [Storage mapping](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/DA/storage.py): `mtkclient/Library/DA/storage.py`
- [Partition parsing](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Partitions/gpt.py): `mtkclient/Library/Partitions/gpt.py`
- [DA filesystem](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Filesystem/mtkdafs.py): `mtkclient/Library/Filesystem/mtkdafs.py`
- [Hardware crypto](https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Hardware/hwcrypto.py): `mtkclient/Library/Hardware/hwcrypto.py`

### Other components

- **Operator**
- **Device flash**

## Connections

- Operator → CLI: runs tool (evidence: `README.md`)
- Operator → GUI: uses (evidence: `README.md`)
- GUI → MTK controller: initializes (evidence: `mtk_gui.py`)
- GUI → Flash controls: opens controls (evidence: `mtk_gui.py`)
- MTK controller → Preloader protocol: uses (evidence: `mtkclient/Library/mtk_class.py`)
- MTK controller → DA loader: creates (evidence: `mtkclient/Library/mtk_class.py`)
- MTK controller → Chip profiles: loads profiles (evidence: `mtkclient/Library/mtk_class.py`)
- USB transport → Device handling: uses (evidence: `mtkclient/Library/Connection/usblib.py`)
- Exploit dispatcher → Hardware crypto: uses (evidence: `mtkclient/Library/exploit_handler.py`)
- Heapbait exploit → Exploit dispatcher: extends (evidence: `mtkclient/Library/Exploit/heapbait.py`)
- Heapbait exploit → DA loader: uses (evidence: `mtkclient/Library/Exploit/heapbait.py`)
- Heapbait exploit → XML DA: uses (evidence: `mtkclient/Library/Exploit/heapbait.py`)
- Payload emulator → MTK controller: emulates payloads
- DA operations → DA loader: uploads agent (evidence: `mtkclient/Library/DA/mtk_da_handler.py`)
- DA loader → Legacy DA: dispatches (evidence: `mtkclient/Library/DA/mtk_daloader.py`)
- DA loader → XFlash DA: dispatches (evidence: `mtkclient/Library/DA/mtk_daloader.py`)
- DA loader → XML DA: dispatches (evidence: `mtkclient/Library/DA/mtk_daloader.py`)
- XML DA → V6 extension: uses extension (evidence: `mtkclient/Library/DA/xmlflash/xml_lib.py`)
- XML DA → SLA authentication: checks auth (evidence: `mtkclient/Library/DA/xmlflash/xml_lib.py`)
- DA operations → DA filesystem: uses (evidence: `mtkclient/Library/DA/mtk_da_handler.py`)
- DA operations → Partition parsing: reads table
- DA operations → Device flash: reads and writes (evidence: `mtkclient/Library/DA/mtk_da_handler.py`)
- Storage mapping → Device flash: maps storage (evidence: `mtkclient/Library/DA/storage.py`)
- Flash controls → Partition parsing: shows partitions (evidence: `mtk_gui.py`)