MTBoss: Direct BootROM SPI NOR flasher/dumper for MediaTek MT6261 feature phones

About

MTBoss is a command-line tool written in Go for reading, writing, erasing, and identifying SPI NOR flash memory on MediaTek MT6261 series feature phone SoCs (such as the Maxcom MM817 and DZ09 smartwatch platform).

Standard MediaTek flashing workflows rely on loading two-stage Download Agent (DA) binary blobs into SRAM (0x70007000) and DRAM (0x10020000). On legacy feature phones, standard DA binaries frequently fail or crash due to uninitialized DRAM or memory map mismatches.

MTBoss implements direct BootROM Serial Flash Interface (SFI) hardware flashing:

• Bypasses Download Agent (DA) binaries completely.
• Manipulates the hardware Serial Flash Interface controller (0xA0140000) directly using native BootROM memory access commands (0xA2, 0xD2, 0xD1, 0xD4).
• Enables SFI MAC Mode (SFI_MAC_SEL) to send raw SPI NOR commands directly to the physical NOR flash chip.
• Manages 64-byte payload chunking to strictly fit within the 160-byte hardware SFI_GPRAM buffer limit.
• Uses BootROM memory-mapped reads (0xD1 at memory map mode 2) for byte-for-byte MD5 verification.

Installation

Prerequisites

• Go 1.26 or higher installed.
• Serial port access permissions on Linux (user added to dialout or uucp group).

Via go install

Install the executable directly into your $GOPATH/bin directory:

go install code.luxferre.top/luxferre/mtboss@latest

From source

Clone the repository and build the binary manually:

git clone https://code.luxferre.top/luxferre/mtboss.git
cd mtboss
go build -o mtboss main.go

Usage

Command line options

mtboss [flags]

Available flags:

Flag	Type	Default	Description
-mode	string	flash	Mode of operation: flash, read, erase, or identify
-port	string	auto	Serial port device path (e.g. /dev/ttyUSB0, auto)
-file	string	""	Input or output binary file path
-start / -offset	string	0x00000000	Flash start address in hex, decimal, or units (e.g. 0, 0x4000, 4K)
-size / -length	string	0x400000	Operation size in hex, decimal, or units (default 4MiB / 0x400000)
-verify	bool	true	Verify flash writes via readback
-timeout	int	600	Timeout in seconds waiting for BootROM sync

Examples

Identify connected device and flash chip JEDEC ID:

mtboss -mode identify -port /dev/ttyUSB0

Read full 4MiB flash dump to a file:

mtboss -mode read -file dump_4mb.bin

Read a specific region (64KB starting at offset 0x10000):

mtboss -mode read -file sysparams.bin -start 0x10000 -size 64KB

Flash firmware binary starting at address 0x20000:

mtboss -mode flash -file firmware.bin -start 0x20000

Erase a specific flash range (16KB at address 0):

mtboss -mode erase -start 0 -size 16KB

FAQ

Why does the phone fail to connect or time out?

Ensure the phone is completely powered off before starting MTBoss. Press and hold the BOOT key (or Power button depending on model) while plugging in the USB cable. Some models (e.g. Maxcom MM817) automatically enter the BootROM mode if connected without a battery. On Linux systems, verify your user account has serial port permissions (sudo usermod -aG dialout $USER).

How does direct SFI flashing work without a Download Agent (DA)?

MediaTek MT6261 BootROM provides low-level register access commands (0xA2, 0xD2, 0xD1, 0xD4). mtboss uses these commands to disable system watchdogs, configure memory mapping, switch the SFI controller to hardware MAC mode, and write raw SPI command payloads into the hardware GPRAM buffer.

Are write protection bits handled automatically?

Yes. Before erasing or programming, mtboss reads the SPI NOR flash status register (0x05). If block protection bits (BP0-BP3) are enabled, it issues volatile write enable (0x50) and status register write (0x01) commands to clear protection before executing flash operations.

How does write verification work?

When -verify=true is enabled, mtboss sets boot engine memory map mode 2 (0xA0510000 = 2), mapping physical flash memory starting at address 0x00000000. It performs 32-bit block reads via BootROM command 0xD1 and compares the MD5 hash of the readback data against the reference file.

Credits

Created by Luxferre in 2026, released into the public domain with no warranties.

Based on MediaTek MT6261 BootROM protocol and Serial Flash Interface (SFI) hardware register research.

Built using the go.bug.st/serial library for cross-platform serial hardware control.