TMTKby TFAST Digital Agency

TMTK v2.0 · Tecno · Infinix · iTel

MediaTek META and Unisoc SPD work, without the guesswork.

A Windows desktop tool for Tecno, Infinix and iTel bootloader and partition work. Two independent engines — MediaTek META mode and Unisoc SPD — across 53 model tokens. It reads, identifies and verifies, and it refuses when anything is ambiguous.

Open the interactive demo View on GitHub
14 verified operations 53 model tokens Windows · .NET 10 · Avalonia Unisoc transport in development Documentation only — no source here

Two engines, kept deliberately separate

They share a UI, an event log and a backup system — nothing else. You pick the engine that matches the phone in your hand, and an SPD change can never silently alter a META write path.

MTK · META mode

MediaTek bootloader and partition work

META mode runs instead of the normal boot path, so the bootloader's own lock check never executes. That is why a locked, non-rooted device can still have its bootloader partition read and analysed.

  • META channel over LAN or COM, with a live throughput meter
  • GPT partition listing, read and write, verified byte-exact
  • LK bootloader offline analysis — architecture, identity, lock-store discovery
  • Branch-aware method selection, chosen by what the image actually contains
  • SHA-256 backup manifest written before the first byte
SPD · Unisoc

Offline file work today, transport in development

The Unisoc lane is in active development, and the tool says which half you are in rather than showing a green tick it has not earned.

  • PAC archive inspect, plan and extract for BP_R1 / BP_R2, byte-exact
  • FDL kit identification by name and size, with a SHA-256 per file
  • Vendor and mode classification — spd-diag vs spd-download
  • Storage type treated as identity: eMMC and UFS are different targets
  • BROM → FDL1 → FDL2 transport: still being built

Supported model matrix

53 tokens across four engine lists. A token never implies an engine on its own — the tool shows every list that claims it. Red-bordered tokens are claimed by more than one engine.

MTK — LK file patch 18

CM5CM6X6880 X6886KL5KM5 KM6KM7CK6 CK7CL6CLA5 KL7X6728BKM4 A100X6725X6725B

MTK — ready bootloader 18

CM5CM6X6880X6886KL5 KM5KM6KM7CK6CK7 CL6CLA5KL7X6728BKM4 A100X6725X6725B

SPD — AUTO BL / vbmeta 12

X6725BX6526D_V2506X6725 X6525A6610LA666LBG6 BG6MKM4KL4 KN3_AUGKN3_FEB

SPD — FDL / EDL unlock 12

KM6KM7CM5 CM6CLA5X6886 X6885KL5X6880 X6853X6850X6851

SPD — partition manager / PAC 11

SC9863ASC9863A_64TIGER_T615TIGER_T616 M-KOPA S34SC9863A-ITEL-VISION3SC9863A-ZTE-BLADE-A31 UMS9230UMS9230-UFSUMS9620-DRAMTYPE1 UMS9620-DRAMTYPE2
11 tokens are claimed by more than one engine: CM5, CM6, KM4, KM6, KM7, KL5, CLA5, X6880, X6886, X6725, X6725B. The tool shows every claimant and makes you choose. It never picks for you — a wrong pick is what kills a phone. Likewise, UMS9230 (eMMC) is not UMS9230-UFS, and UMS9620 splits by DRAM type, because the partition layout differs.

No green ticks without proof

Every capability carries a status, and a method is only usable when it is both adopted and Verified or Tested. These rules are enforced by automated tests, not by good intentions — an optimistic status shows up immediately as a false verdict in the suite.

StatusMeaning
VerifiedMeasured on real hardware
TestedImplemented and covered by automated tests, no hardware
ReconstructedRecovered from a third-party binary, never executed
ClaimedAsserted by a vendor README or changelog only
PlaceholderInterface exists, protocol does not
HypothesisProposed, unmeasured, unimplemented
ExcludedRecorded for completeness, excluded by policy

Safety model

  • Backup first. lk, lk_a, lk_b and seccfg are hashed into a manifest before the first byte.
  • Two presses, always. No destructive action fires on a single click, and the confirmation is invalidated when the target changes.
  • Partial reads are never patchable. A truncated image is refused, not repaired.
  • Read back and compare. After a write the slot is read again and compared byte-for-byte.
  • Policy-blocked work stays blocked. BootROM exec_addr stubs and the CVE-2022-38694 class are Excluded and refuse to run even when every prerequisite is supplied.

Where the SPD lane stands

  • PAC container handling Inspect, plan and extract, byte-exact
  • FDL kit identification FDL1/FDL2 pair by name and size, SHA-256 per file
  • Vendor and mode classification Spreadtrum VID 0x1782, diag vs download
  • Transport vocabulary 18 key names recovered, zero values
  • BROM → FDL1 → FDL2 transport In development — no Unisoc read or write path yet

Inside the tool

Real captures from a clean start with no phone connected. Nothing staged, nothing retouched.

TMTK MTK workspace showing the META connection panel, model picker, backup settings and shared event log
MTK workspace — META connect, model picker, backup before write
TMTK bootloader panel with find slots, check phone, read and analyse, and scan methods actions
Bootloader (LK) — find slots, read and analyse offline
TMTK supported model matrix listing all 18 MediaTek tokens with a shared engine warning
Model matrix — every engine that claims a token
TMTK Unisoc transport schema listing 18 recovered keys, each marked value not recovered
Transport schema — 18 key names recovered, zero values

Try it before you ask for access

The demo is an interactive mock-up — the interface, the states and the feel of the tool, with nothing behind it. No WebSerial or WebUSB, no protocol bytes, no keys, no network requests. Its only four requests are its own four files.

What you can click

Connect, read the partition table, run the bootloader analysis, and resolve any model token to see every engine that claims it.

What it will show you

The refusals. The demo ends the bootloader flow in a refusal because the real build does — a 32-bit image cannot take an AArch64 patch.

What it will not do

Touch a device, send a command, or imply a capability that is still a Placeholder.

Launch the demo shell

Frequently asked

The same answers technicians ask for first.

Is the TMTK source code published here?

No. This repository is documentation only. It contains no source files, no binaries, no loaders, no PAC files and no key material. It exists so technicians can see what the tool does and which devices are covered before they ask for access.

Does the phone need to be rooted for META mode work?

No. META mode runs instead of the normal boot path, so the bootloader's own lock check never executes. That is what makes a locked, non-rooted MediaTek device readable over the META channel.

Which devices does TMTK v2.0 support?

53 model tokens across four engine lists: 18 MediaTek LK patch tokens, the same 18 for ready bootloader, 12 Unisoc AUTO BL tokens, 12 Unisoc FDL unlock tokens and 11 Unisoc SoC or partition tokens.

Tecno models include Camon 40, Camon 40 Pro, Camon 30s, Spark 30 C, Spark 40 Pro, Spark 40 Pro Plus, Pop 8, Pop 9, Pop 10 and Pop 20. Infinix models include Hot 60 Pro, Hot 60 Pro Plus and X6880. itel models include A70, A90 and Vision 3.

Does the Unisoc SPD side work?

The SPD engine is in active development. The offline half works today: PAC archive inspect, plan and extract for BP_R1 and BP_R2 containers, vendor and mode classification, storage-type splitting and using the 18 recovered transport key names as a checklist.

The BROM → FDL1 → FDL2 transport is still being built, so there is no Unisoc read or write path yet.

Why does reading a 2 MB bootloader partition take 26 minutes?

It is the physical cost of the META channel. One shell command costs about 280 ms and a reply frame carries about 500 bytes, which works out to roughly 1.25 KB/s. A 2 MB bootloader slot therefore takes about 26 minutes to read and a similar time to write.

TMTK states the estimate before a long operation and saves the image so it can be re-analysed offline without paying that cost twice.

Why will TMTK not pick the right engine automatically?

Because 11 tokens are claimed by more than one engine: CM5, CM6, KM4, KM6, KM7, KL5, CLA5, X6880, X6886, X6725 and X6725B. The tool shows every claimant and requires the operator to choose.

Automatically picking one would be a coin flip, and the wrong pick is what kills a phone.

Access, model requests and support

Missing your device in the matrix? A model request needs the token, the SoC and the security patch — that is exactly the data needed to key a new recipe.

WhatsApp+256 751 399 620 Websitetfastdigital.com Telegramt.me/tfasthub