---

MTK Flash/Exploit Client V2.1.4 (c) B.Kerler 2018-2026

positional arguments:
  command
    printgpt            Print GPT Table information
    gpt                 Save gpt table to given directory
    r                   Read flash to filename
    rl                  Read all partitions from flash to a directory
    rf                  Read whole flash to file
    rs                  Read sectors starting at start_sector to filename
    ro                  Read flash starting at offset to filename
    w                   Write partition from filename
    wf                  Write flash from filename
    wl                  Write partitions from directory path to flash
    wo                  Write flash starting at offset from filename
    e                   Erase partition
    es                  Erase partition with sector count
    ess                 Erase sector with sector count
    footer              Read crypto footer from flash
    fs                  Mount as FUSE filesystem
    reset               Send reset command
    meta                Enter meta mode
    meta2               Enter meta mode (wdt)
    dumpbrom            Try to dump the bootrom
    dumpsram            Try to dump the sram
    dumppreloader       Try to dump the preloader
    payload             Run a specific kamakiri / da payload
    crash               Try to crash the preloader
    brute               Bruteforce the kamakiri var1
    gettargetconfig     Get target config (sbc, daa, etc.)
    logs                Get target logs
    peek                Read memory in patched preloader mode
    stage               Run stage2 payload via boot rom mode (kamakiri)
    plstage             Run stage2 payload via preloader mode (send_da)
    da                  Run da xflash/legacy special commands
    devices             List supported devices
    script              Run multiple commands using text script
    multi               Run multiple commands using semicolon-separated list

options:
  -h, --help            show this help message and exit

Connection & Interface:
  --vid VID
  --pid PID
  --serialport [SERIALPORT]
                        Use serial port (can be DETECT)
  --noreconnect
  --stock               use stock da
  --uartloglevel UARTLOGLEVEL
                        Set uart log level (0=Trace, 2=Normal)
  --logchannel LOGCHANNEL
                        Set log channel ("UART","USB", "BOTH")
  --loglevel LOGLEVEL   Set log level (0=Trace, 2=Normal)
  --write_preloader_to_file
                        Dump preloader to file
  --generatekeys        Derive HW keys
  --iot                 Use special mode for iot MT6261/2301
  --socid               Read Soc ID

Authentication:
  --auth AUTH           Use auth file (auth_sv5.auth)
  --cert CERT           Use cert file

Debug & Sector:
  --debugmode           Enable verbose mode

Bootrom / Preloader Exploit:
  --loader LOADER       Use specific DA loader, disable autodetection
  --preloader PRELOADER
                        Set the preloader filename for dram config
  --ptype PTYPE         Payload type: amonet, kamakiri, kamakiri2, carbonara
  --var1 VAR1           Set kamakiri specific var1 value
  --uart_addr UART_ADDR
                        Set payload uart_addr value
  --da_addr DA_ADDR     Set a specific da payload addr
  --brom_addr BROM_ADDR
                        Set a specific brom payload addr
  --mode MODE           Set a crash mode (0=dasend1,1=dasend2,2=daread)
  --wdt WDT             Set a specific watchdog addr
  --skipwdt             Skip wdt init
  --crash               Enforce crash if device is in pl mode
  --appid APPID         Use app id (hexstring)

GPT & Partition:
  --sectorsize SECTORSIZE
                        Set default sector size
  --gpt-num-part-entries GPT_NUM_PART_ENTRIES
                        Set GPT entry count
  --gpt-part-entry-size GPT_PART_ENTRY_SIZE
                        Set GPT entry size
  --gpt-part-entry-start-lba GPT_PART_ENTRY_START_LBA
                        Set GPT entry start lba sector
  --parttype PARTTYPE   Partition type (user/boot1/rpmb/lu0 etc.)
  --skip SKIP           Skip partitions (comma separated names)