MTreader is a simple and small (under 100 SLOC) Python-based utility that aims to serve a single goal: read chunks of flash memory from MediaTek MT6261-based feature phones. No other features are supported or even planned here.
You can also adjust the readback block size as well with the `-bs` parameter. Changing it is not recommended if the default of 1024 bytes works for you.
As for different MT6261 versions support, the tool had been successfully tested on various MT6261D and MT6261M handsets (provided they can also be supported by FlashTool). MT6261D still remains the primary target though.
### Why was this created then? Isn't FlashTool good enough?
No, it isn't. FlashTool is proprietary and single-platform. Having no viable open source alternative that can be run on any normal OS was enough to kickstart the research to create this tool.
Moreover, to in order to just create a flash dump with FlashTool, you'll need to:
1. Obtain some scatter file (even though it's totally unnecessary for the readback functionality) and load it into FlashTool.
MTreader was created to only do one thing and try doing it well, and in no way is going to compete with any proprietary flashing or dumping solutions. However, it can even handle some phones in bricked state that FlashTool refuses to see or requires some non-standard DA to operate on them.
Turn the phone off, insert the cable while holding the bootkey and see what device appears in `/dev` filesystem. On Linux, it most likely would be something like `/dev/ttyUSB0`. On Mac, it would look like `/dev/tty.usbmodem14100`.
### What is a bootkey?
It's a key that you hold to open the BROM serial port. It depends on the vendor. On most phones, it's Call key. On some phones, it can be arrow down key, # or something else.
Yes, MTreader used a DA in the past, but now it's completely blob-free (and this allowed to move it to the [public domain](./UNLICENSE)) and works via BROM itself. The trick is in using the correct mapping register setting: when we set the 32-bit value at the `0xa0510000` to 3, all the ROM contents (in 32-bit little-endian chunks) are mapped onto `0x10000000` base address by the MT6261 chipset itself.
There were several main sources of information: [mtk-open-tools](https://github.com/mtek-hack-hack/mtk-open-tools), [platform-quectel](https://github.com/Wiz-IO/platform-quectel/blob/master/builder/frameworks/MT6261.py), [Fernly](https://github.com/xobs/fernly) and - most importantly - my own research of FlashTool (running on a VM) USB traffic dumps necessary to combine the above sources, streamline them and make them work on real phone targets, not developer boards.
No. Not in this utility. Flashing MediaTek SoCs via USB is much more complicated than dumping. The process is generally quite fragile, relies on more proprietary, internal and undocumented logic, and in total requires much more research and rigorous testing on different devices with potential risk of bricking them to an unflashable state. When such research is complete, another utility will be published.
