MTK Auth Bypass — Bypass MediaTek DA Auth (mtkclient)
Bypass MediaTek DA authentication with mtkclient — enter BROM mode, run the exploit, then read, write, or unlock your MTK device's bootloader.
Pre-Flight Checklist
Complete ALL items before proceeding. Skipping any step increases the risk of bricking your device.
Guide Steps
Open a terminal / Command Prompt as Administrator. Navigate to the mtkclient directory:
cd mtkclient\npip install -r requirements.txtOn Windows, also run Zadig: plug in your device in BROM mode, select the MT65xx Preloader USB device, and replace its driver with WinUSB. On Linux: sudo cp mtkclient/Setup/Linux/*.rules /etc/udev/rules.d/ && sudo udevadm control --reload
Power off your device completely. Do not connect USB yet. On most MTK devices:
• Hold Volume Down (some devices: Volume Up) and plug in the USB cable while holding the button.
• The device screen should remain black (no display in BROM mode — this is normal).
• On Windows, Device Manager will briefly show a new USB device. On Linux: dmesg | tail will show a new USB entry.
If the device boots instead, try a different button combination or short the BROM test point.
With the device in BROM mode and USB connected, run:
python mtk.py payloadmtkclient will send the auth bypass payload to the device. You'll see output like:
Waiting for device...\nConnected to: MT6765\nBypass auth... OK\nDA mode enteredIf you see "Waiting for device" indefinitely, the BROM mode was not entered correctly. Retry step 2.
Once auth bypass succeeds, you can use mtkclient commands:
Read full flash:python mtk.py rf flash.bin
Write firmware:python mtk.py w boot boot.img
Unlock bootloader:python mtk.py da seccfg unlock
Read partition list:python mtk.py printgpt
Refer to the mtkclient README for the full command reference.
If your goal was to flash stock firmware after bypassing auth, use SP Flash Tool or mtkclient in write mode with your scatter file:python mtk.py w --scatter MT6xxx_Android_scatter.txt firmware_directory/
Wait for all partitions to complete. Do not disconnect mid-flash.
After your operations complete, run:
python mtk.py resetOr manually hold Power + Volume Up to reboot. The device will restart normally. If you unlocked the bootloader, Android may show a warning on boot — this is expected and can be accepted.
Congratulations! Flash Successful!
You've successfully completed all steps. Your device should now be running the new firmware. If it's booting normally — you're done! Check the troubleshooting section below if you encounter any issues.
Troubleshooting & FAQ
Common errors and their solutions. Read this before asking for help.
The BROM exploit (Exploit CVE-like vulnerability in bootrom) works on most MediaTek SoCs up to approximately 2022. Newer chips (MT6895, MT6983, Dimensity 9000+) use patched BootROMs. Check the mtkclient GitHub issues/compatibility list for your specific chipset.
On Windows, ensure you replaced the driver with WinUSB via Zadig for the correct USB device (it may have a different VID/PID than the normal VCOM driver). On Linux, check dmesg for the USB VID:PID and add a matching udev rule. Also try a direct USB 2.0 port — hubs and USB 3.0 can cause detection issues.
MediaTek does not have a Knox-style permanent warranty counter. However, unlocking the bootloader via seccfg will show a warning on boot. Some banking and payment apps may refuse to run on a device with an unlocked bootloader (detected via Play Integrity API).
Bypassing device security on a device you own is legal in most jurisdictions (covered under right-to-repair principles). Applying it to devices you don't own or using it to circumvent DRM on content is illegal. Always act responsibly and lawfully.
Changelog
A record of every update to this guide.
Initial publish
Prioritize our guides in your Google search results.
No comments yet. Be the first to share your experience with this guide!