### Setup on macOS

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Install Homebrew dependencies and configure a Python virtual environment.

```shell
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
brew install macfuse openssl
```

```shell
git clone https://github.com/bkerler/mtkclient
cd mtkclient
```

```shell
python3.9 -m venv mtk_venv
source mtk_venv/bin/activate
pip3 install --pre --no-binary capstone capstone
pip3 install PySide6 libusb
pip3 install -r requirements.txt
```

--------------------------------

### Setup Requirements via pip or uv

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Install Python dependencies using pip or uv.

```shell
cd mtkclient && pip3 install -r requirements.txt
```

```shell
cd mtkclient && uv sync --frozen
```

--------------------------------

### Clone and install mtkclient dependencies

Source: https://github.com/bkerler/mtkclient/blob/main/README-WINDOWS.md

Downloads the repository and installs the required Python packages.

```shell
git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt
```

--------------------------------

### Setup via Virtual Environment

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Create and activate a virtual environment for mtkclient.

```shell
python3 -m venv ~/.venv
git clone https://github.com/bkerler/mtkclient
cd mtkclient
. ~/.venv/bin/activate
pip install -r requirements.txt
pip install .
```

--------------------------------

### Install Additional Linux Requirements

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Install platform tools and libraries for Linux environments.

```shell
sudo apt install google-android-platform-tools-installer
sudo apt install libfuse-dev
sudo apt install libxcb-cursor0
```

--------------------------------

### Install Linux Dependencies

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Install essential build tools and libraries required for mtkclient on Debian/Ubuntu systems.

```shell
sudo apt install git build-essential curl libssl-dev python3-pip -y
```

--------------------------------

### Install Dependencies on ArchLinux

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Install required packages using pacman or yay.

```shell
(sudo) pacman -S  python python-pip python-pipenv git libusb fuse2
```

```shell
yay -S python python-pip git libusb fuse2
```

--------------------------------

### Install Dependencies on Fedora

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Install required packages and configure udev rules on Fedora.

```shell
sudo dnf install python3 git libusb1 fuse-libs
sudo cp Setup/Linux/52-mtk.rules /etc/udev/rules.d/52-mtk.rules
sudo udevadm control --reload-rules && sudo udevadm trigger
```

--------------------------------

### Install and Configure pyenv

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Set up pyenv to manage Python versions on Linux.

```shell
curl https://pyenv.run | bash
```

```shell
export PYENV_ROOT="$HOME/.pyenv"
[[ -d $PYENV_ROOT/bin ]] && export PATH="$PYENV_ROOT/bin:$PATH"
eval "$(pyenv init -)"
```

```shell
sudo apt install libbz2-dev liblz4-dev liblzma-dev python3-tk tk-dev libssl-dev libsqlite3-dev libreadline-dev libffi-dev -y
sudo cp mtkclient/Setup/Linux/*.rules /etc/udev/rules.d/
sudo udevadm control -R && sudo udevadm trigger && cd ..
sudo usermod -aG dialout $USER && sudo usermod -aG plugdev $USER
```

```shell
pyenv install 3.13
pyenv global 3.13
```

--------------------------------

### List Supported Devices with Filter

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Lists supported devices, with an option to filter the output. This example shows how to list only Xiaomi devices.

```shell
python mtk.py devices --filter Xiaomi
```

--------------------------------

### Verify UsbDk installation

Source: https://github.com/bkerler/mtkclient/blob/main/README-WINDOWS.md

Checks if the device is correctly detected by the UsbDk controller.

```shell
UsbDkController -n
```

--------------------------------

### Write Memory from File (Stage2)

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

This command allows writing the contents of a file to the device's memory in stage2 mode. Provide the starting address and the filename.

```shell
python stage2.py memwrite [start addr] --filename filename.bin
```

--------------------------------

### Root Phone: Install Magisk via ADB

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Installs the Magisk APK on the target phone using ADB. Requires USB debugging to be enabled on the phone.

```shell
adb install app-release.apk
```

--------------------------------

### Write Hex Data to Memory (Stage2)

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Use this command to write hexadecimal data directly to the device's memory in stage2 mode. Specify the starting address and the data as a hex string.

```shell
python stage2.py memwrite [start addr] --data [data as hexstring]
```

--------------------------------

### Build Binaries with Make

Source: https://github.com/bkerler/mtkclient/blob/main/src/stage1/build.md

Use this command to build all project binaries. Binaries are placed in the ../../payloads directory.

```bash
make
```

--------------------------------

### Launch MTKClient GUI

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Use this command to launch the graphical user interface for MTKClient. This GUI supports dumping partitions and the full flash.

```shell
python mtk_gui.py
```

--------------------------------

### Print Partition Table (GPT)

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Displays the partition table (GPT) of the device. Use `--preloader` for brom mode.

```shell
python mtk.py printgpt
```

--------------------------------

### Run Multiple Commands via Script File

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Executes a sequence of commands defined in a script file. Refer to the 'run.example' file for script structure.

```shell
python mtk.py script examples/run.example
```

--------------------------------

### Configure Linux Udev Rules

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Apply udev rules for device access.

```shell
sudo usermod -a -G plugdev $USER
sudo usermod -a -G dialout $USER
sudo cp Setup/Linux/*.rules /etc/udev/rules.d
sudo udevadm control -R
sudo udevadm trigger
```

--------------------------------

### Read All Partitions

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps all partitions from the device to a specified directory. Use `--preloader` for brom mode.

```shell
python mtk.py rl out
```

--------------------------------

### Debug Binaries with UART Output

Source: https://github.com/bkerler/mtkclient/blob/main/src/stage1/build.md

Execute this command to build binaries with debug enabled and UART output activated.

```bash
make debug
```

--------------------------------

### Clone mtkclient Repository

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Download the source code from GitHub recursively.

```shell
git clone https://github.com/bkerler/mtkclient --recursive
```

--------------------------------

### Boot to Meta Mode via Payload

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Enters meta mode on the device using a payload. This is useful for specific low-level operations or diagnostics.

```shell
python mtk.py payload --metamode FASTBOOT
```

--------------------------------

### Write All Partitions

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Writes all files from a directory to their corresponding flash partitions.

```shell
python mtk.py wl out
```

--------------------------------

### Run Stage2 in Preloader

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Executes the Stage2 process using the preloader.

```shell
python mtk.py plstage
```

--------------------------------

### Run Multiple Commands via String

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Executes multiple commands by providing them as a semicolon-separated string. This is an alternative to using a script file.

```shell
python mtk.py multi "cmd1;cmd2"
```

--------------------------------

### Root Phone: Dump Boot and VBMeta

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

First step in rooting a phone (tested with Android 9-12). Dumps the boot and vbmeta partitions, saving them as boot.img and vbmeta.img.

```shell
python mtk.py r boot,vbmeta boot.img,vbmeta.img
```

--------------------------------

### Read Boot Partition

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps the boot partition to a file. Use the `--preloader` option for bootrom mode.

```shell
python mtk.py r boot boot.bin
```

```shell
python mtk.py r boot boot.bin [--preloader=Loader/Preloader/your_device_preloader.bin]
```

--------------------------------

### Dump Preloader Partition

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps the preloader partition to a file named 'preloader.bin'. This command specifies the partition type as 'boot1'.

```shell
mtk.py r preloader preloader.bin --parttype boot1
```

--------------------------------

### Run Tests with Payload Emulation

Source: https://github.com/bkerler/mtkclient/blob/main/src/stage1/build.md

This script runs project tests by emulating payloads using emulate_payload.py.

```bash
./runtest.sh
```

--------------------------------

### Run Stage2 PLStage in Bootrom

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Executes the Stage2 PLStage process in bootrom mode. Requires the device to be in Brom or crashed to Brom.

```shell
python mtk.py plstage --preloader=preloader.bin
```

--------------------------------

### Dump Preloader

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps the preloader partition from the device. This command is useful for backup or analysis purposes.

```shell
python mtk.py dumppreloader
```

--------------------------------

### Use Stock MTK Functionality

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Executes stock MediaTek functionalities without relying on exploits. This is the safest mode for standard operations.

```shell
python mtk.py --stock
```

--------------------------------

### Run Custom Payload

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Executes a custom payload on the device. Allows specifying payload file and various optional parameters like variables, watchdog, and addresses.

```shell
python mtk.py payload --payload=payload.bin [--var1=var1] [--wdt=wdt] [--uartaddr=addr] [--da_addr=addr] [--brom_addr=addr]
```

--------------------------------

### Read Full Flash

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads the entire flash memory to a specified file. Use `--preloader` for brom mode. The `--iot` flag is for specific IoT devices.

```shell
python mtk.py rf flash.bin
```

```shell
python mtk.py rf flash.bin --iot
```

--------------------------------

### Write Flash by Offset and Length

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Writes a file to a specific offset and length on the flash. Use `--preloader` for brom mode.

```shell
python mtk.py wo 0x128000 0x200000 flash.bin
```

--------------------------------

### DA Commands: Generate RPMB Keys

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Generates and displays the RPMB1-3 keys.

```shell
python mtk.py da generatekeys
```

--------------------------------

### Mount Flash Filesystem

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Mounts the device's flash memory as a filesystem to a specified mount point.

```shell
python mtk.py fs /mnt/mtk
```

--------------------------------

### Write Boot Partition

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Writes a file to the boot partition. This command is used in DA mode.

```shell
python mtk.py w boot boot.bin
```

--------------------------------

### Run Stage2 in Bootrom

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Executes the Stage2 process directly in bootrom mode.

```shell
python mtk.py stage
```

--------------------------------

### Root Phone: Push Patched Boot Image to Device

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Uploads the Magisk-patched boot image from your computer to the device's /sdcard/Download directory using ADB.

```shell
adb push boot.img /sdcard/Download
```

--------------------------------

### Dump Preloader

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps the preloader from the device. The device must be in bootrom mode and the preloader intact. Supports specifying partition types and output filename.

```shell
python mtk.py dumppreloader [--ptype=["amonet","kamakiri","kamakiri2","hashimoto"]] [--filename=preloader.bin]
```

--------------------------------

### Read Preloader Partition

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps the preloader partition to a file via bootrom. Requires specifying the partition type and preloader path.

```shell
python mtk.py r preloader preloader.bin --parttype=boot1 [--preloader=Loader/Preloader/your_device_preloader.bin]
```

--------------------------------

### Change UART to USB Logging

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Configures the device to send logs over USB instead of UART. This is helpful for debugging during the DA (Download Agent) process.

```shell
python mtk.py printgpt --logchannel="USB"
```

--------------------------------

### DA Commands: Security Configuration

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Locks or unlocks the bootloader using the security configuration command.

```shell
python mtk.py da seccfg [lock or unlock]
```

--------------------------------

### Extract Security Keys

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Extract security keys from the device. Use the appropriate mode ('sej' or 'dxcc'). For 'dxcc' mode, 'plstage' must be used instead of 'stage'.

```shell
python stage2.py keys --mode [sej, dxcc]
```

--------------------------------

### Stage2: Read Preloader

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads the preloader partition while in Stage2 mode.

```shell
stage2.py preloader
```

--------------------------------

### Read Flash by Offset and Length

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads a specific portion of the flash memory by offset and length to a file. Use `--preloader` for brom mode.

```shell
python mtk.py ro 0x128000 0x200000 flash.bin
```

--------------------------------

### Dump Serial Number / Special Partition

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps a special partition, such as the serial number partition, to 'preloader.bin'. This command specifies the partition type as 'boot2'.

```shell
mtk.py r preloader preloader.bin --parttype boot2
```

--------------------------------

### Write Full Flash

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Writes a file as the complete flash image. Currently only supported in DA mode.

```shell
python mtk.py wf flash.bin
```

--------------------------------

### Crash DA to Enter Brom

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Crashes the Download Agent (DA) to force the device into bootrom mode. Optional parameters for VID, PID, and interface can be provided.

```shell
python mtk.py crash [--vid=vid] [--pid=pid] [--interface=interface]
```

--------------------------------

### Dump Brom

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Dumps the bootrom from the device. Supports various partition types and can be used in bootrom or crashed DA mode. Includes a brute force option for unknown bootroms.

```shell
python mtk.py dumpbrom --ptype=["amonet","kamakiri","hashimoto"] [--filename=brom.bin]
```

```shell
python mtk.py brute
```

--------------------------------

### DA Commands: Write RPMB

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Writes to the RPMB partition. Currently broken and xflash only.

```shell
python mtk.py da rpmb w filename
```

--------------------------------

### Read Memory with Patched Preloader

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads memory from the device using a patched preloader. Requires the device to be in Brom or crashed to Brom mode.

```shell
python mtk.py peek [addr] [length] --preloader=patched_preloader.bin
```

--------------------------------

### DA Commands: Read RPMB

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads the RPMB partition. Currently only supported for xflash.

```shell
python mtk.py da rpmb r [will read to rpmb.bin]
```

--------------------------------

### Root Phone: Pull Patched Boot Image from Device

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Downloads the Magisk-patched boot image from the device's /sdcard/Download directory to your computer using ADB, and renames it.

```shell
adb pull /sdcard/Download/[displayed magisk patched boot filename here]
mv [displayed magisk patched boot filename here] boot.patched
```

--------------------------------

### Exploit Brom Mode with Preloader

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Initiates an exploit in brom mode using a specified preloader file. This is often a prerequisite for other operations.

```shell
python mtk.py --preloader [preloader]
```

--------------------------------

### Exploit Preloader Mode

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Utilizes an exploit in preloader mode, requiring a specified loader file. This can be MTK_AllInOne.bin, DA_BR.bin, or DALoader.

```shell
python mtk.py --loader [MTK_AllInOne.bin or DA_BR.bin or DALoader]
```

--------------------------------

### Unlock Bootloader: Unlock Seccfg

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Unlocks the seccfg (security configuration) partition, which is a key step in the bootloader unlocking process.

```shell
python mtk.py da seccfg unlock
```

--------------------------------

### Stage2: Read Memory to File

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads a specified range of memory and saves it to a file in Stage2 mode.

```shell
stage2.py memread [start addr] [length] --filename filename.bin
```

--------------------------------

### Unlock Bootloader: Relock Seccfg

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Relocks the seccfg (security configuration) partition. Use this command if you need to re-lock the bootloader.

```shell
python mtk.py da seccfg lock
```

--------------------------------

### Root Phone: Flash Patched Boot and Disable Verity

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Flashes the Magisk-patched boot image and disables verity and verification on the vbmeta partition. This is a critical step for applying the root.

```shell
python mtk.py da vbmeta 3
python mtk.py w boot boot.patched
```

--------------------------------

### Kamakiri Kernel Patching

Source: https://github.com/bkerler/mtkclient/blob/main/README-INSTALL.md

Commands to patch and recompile the Linux kernel for legacy device support.

```shell
sudo apt-get install build-essential libncurses-dev bison flex libssl-dev libelf-dev libdw-dev
git clone https://git.kernel.org/pub/scm/devel/pahole/pahole.git
cd pahole && mkdir build && cd build && cmake .. && make && sudo make install
sudo mv /usr/local/libdwarves* /usr/local/lib/ && sudo ldconfig
```

```shell
wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-`uname -r`.tar.xz
tar xvf linux-`uname -r`.tar.xz
cd linux-`uname -r`
patch -p1 < ../../mtkclient/Setup/kernelpatches/disable-usb-checks-5.10.patch
cp -v /boot/config-$(uname -r) .config
make menuconfig
make
sudo make modules_install
sudo make install
```

```shell
sudo update-initramfs -c -k `uname -r`
sudo update-grub
```

```shell
sudo reboot
```

--------------------------------

### Stage2: Read RPMB

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads the RPMB partition while in Stage2 mode.

```shell
stage2.py rpmb
```

--------------------------------

### Bypass SLA, DAA, and SBC

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Bypasses security features using a generic patcher payload. If using SP Flash Tool afterwards, select 'UART' in settings.

```shell
python mtk.py payload
```

--------------------------------

### Stage2: Reboot Device

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reboots the device from Stage2 mode.

```shell
stage2.py reboot
```

--------------------------------

### Exploit Preloader Mode with Stock Loader (Xiaomi 13C)

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Uses a stock loader for preloader mode exploit, specifically for devices like the Xiaomi 13C that may require an unpatched loader.

```shell
python mtk.py --loader [MTK_AllInOne.bin or DA_BR.bin or DALoader] --stock
```

--------------------------------

### Unlock Bootloader: Erase Metadata and Userdata

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Erases the metadata, userdata, and md_udc partitions. This is the first step in the bootloader unlock flow for stock MTK devices.

```shell
python mtk.py e metadata,userdata,md_udc
```

--------------------------------

### Root Phone: Reboot Device

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reboots the device. This is a standard step after performing operations like dumping partitions during the rooting process.

```shell
python mtk.py reset
```

--------------------------------

### Stage2: Read Memory as Hex

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads a specified range of memory as hex data in Stage2 mode.

```shell
stage2.py memread [start addr] [length]
```

--------------------------------

### DA Commands: Peek Memory

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads a specified length of memory from a given address in hex. Can optionally save to a file.

```shell
python mtk.py da peek [addr in hex] [length in hex] [optional: -filename filename.bin for reading to file]
```

--------------------------------

### DA Commands: Poke Memory

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Writes data to a specified memory address. Data can be a hex string or read from a file.

```shell
python mtk.py da poke [addr in hex] [data as hexstring or -filename for reading from file]
```

--------------------------------

### Erase Boot Partition

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Erases the boot partition on the device.

```shell
python mtk.py e boot
```

--------------------------------

### Unlock Bootloader: Wipe Partitions

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Wipes specific partitions including userdata, metadata, md_udc, and cache. This is part of the unlock flow for stock MTK devices with Android 9+.

```shell
python mtk.py e userdata,metadata,md_udc,cache
```

--------------------------------

### Read E-fuses

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Reads the e-fuses from the device. This operation is typically used for retrieving hardware-specific information.

```shell
python mtk.py da efuse
```

--------------------------------

### Erase Boot Sectors

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Erases a specified number of sectors for the boot partition.

```shell
python mtk.py es boot [sector count]
```

--------------------------------

### Unlock Bootloader: Disable Verity and Verification

Source: https://github.com/bkerler/mtkclient/blob/main/README-USAGE.md

Disables verity and verification on the vbmeta partition. This is part of the process for unlocking the bootloader on stock MTK devices with Android 9+.

```shell
python mtk.py da vbmeta 3
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.