Mtk — Brom Mode Driver

Example .inf snippet for Zadig/libwdi:

libusb_init(&ctx); libusb_set_debug(ctx, 3);

libusb_claim_interface(dev, 0);

libusb_bulk_transfer(dev, 0x01, &cmd, 1, &transferred, BROM_TIMEOUT); libusb_bulk_transfer(dev, 0x81, response, sizeof(response), &transferred, BROM_TIMEOUT);

[DeviceList] %MTK_BROM% = DriverInstall, USB\VID_0E8D&PID_0003 %MTK_BROM% = DriverInstall, USB\VID_0E8D&PID_2000 [Strings] MTK_BROM = "MediaTek USB BootROM (Preloader)" No special driver needed – the kernel’s usbhid or cdc_acm may claim it. Use a libusb userspace driver after detaching kernel driver. 3. Userspace Driver (libusb) – Core Protocol Here’s a minimal C + libusb driver skeleton to detect and talk to BROM. mtk brom mode driver

// Example: read hardware code uint8_t cmd = BROM_CMD_GET_HWCODE; uint8_t response[32] = 0; int transferred;

int send_brom_command(libusb_device_handle *dev, uint8_t cmd, uint8_t *data, int len) int transferred; // BROM uses bulk OUT endpoint 0x01, bulk IN endpoint 0x81 return libusb_bulk_transfer(dev, 0x01, &cmd, 1, &transferred, BROM_TIMEOUT); Example

If you need a (not recommended), you’d write a KMDF USB driver that handles raw bulk transfers, but userspace libusb is the standard approach today.

int main() libusb_context *ctx = NULL; libusb_device_handle *dev = NULL; Userspace Driver (libusb) – Core Protocol Here’s a

// BROM command constants #define BROM_CMD_SEND_DA 0xD7 #define BROM_CMD_GET_HWCODE 0xA0