Mediatek MetaMode Native Protocol 2026.07.17

Updated July 16, 2026 5 mins read
Audience Software ownersDevelopersNewcomers
Tech C# / .NETWindowsSource code
Contact Contact to buy

Mediatek MetaMode Native Protocol Source Code is a commercial, production-oriented C# reference implementation for building your own META-mode service tools — without wrapping legacy MetaCore.dll black boxes or depending on closed Modem META API shims.

We reversed the on-wire behavior from real devices and production workflows (BROM / Preloader → META USB, AP file ops, NVRAM primitives, partition tables, IMEI repair paths, factory-reset flows, EMMC diagnostics, and vendor-specific META operations). The result is clean managed protocol code you can embed in your product, rebrand, and extend.

This is not Modem META API. It is a native protocol stack: framing, command IDs, session lifecycle, USB/COM transport, and workflow orchestration implemented directly in C#.

Why tool vendors choose this stack

Most “META solutions” on the market are thin UI shells around opaque DLLs. That creates long-term risk: broken builds, licensing lock-in, unpredictable updates, and no control when a vendor changes behavior.

This source package is built for software owners who need:

  • Full control over protocol behavior and release cadence
  • Wire-compatible META operations tested against real MTK devices
  • A modular architecture (workflows + session manager + serializers) instead of monolithic P/Invoke
  • Evidence-driven reverse engineering (trace logs, partition ops, AU/OLD behavioral parity)
  • Commercial licensing with direct engineering support

Native protocol — what that means technically

MEDIATEK devices expose a META communication channel after booting through Preloader into META mode. At the wire level, the host exchanges structured AP primitives (connect, file receive/send, NVRAM backup/restore, partition parse, IMEI write, misc factory commands, and more).

Our implementation covers the full host-side pipeline:

  1. Boot orchestration — Preloader handshake, META USB entry, port detection
  2. Session management — handle lifecycle, connect/disconnect, timeout policy, progress callbacks
  3. AP framing — request/confirm IDs, token matching, byte-stuffing where required
  4. File operationsParseFile, ReceiveFile, SendFile on /dev/block/by-name, raw block devices, and sysfs nodes
  5. NVRAM workflows — backup/restore primitives, checksum helpers, MDDB/APDB resolution
  6. High-level workflows — factory reset (generic / OPPO-VIVO / VIVO-Y / RbFs), USERAREA dump/write, NV region dumps, EXT_CSD, Transsion FRP wipe, EMMC health, and more

Unlike wrapping MetaCore.dll, you receive the actual C# modules that implement these steps — so you can audit, patch, and ship updates on your own schedule.

Architecture overview

The codebase is organized for integration into desktop tools (WinForms/WPF) or headless services:

  • MetaApi / meta_api.cs — low-level META primitives
  • MetaSessionManager — connect, disconnect, API ensure/release
  • ApFtSerializer + MetaCommandIds — wire serialization and command map
  • FactoryResetPartitionOps — shared partition resolve + raw device I/O
  • Workflow modules — isolated, testable units per feature (e.g. UserSectionWorkflow, NvRegionsDumpWorkflow, TranssionFrpWipeWorkflow)
  • WireTrace — optional protocol trace logging for field diagnostics
  • UI shell — tabbed META console (Main / Partition MGR / Repair) wired to MetaModeCore

Each workflow follows the same pattern: open META session → execute ordered steps with structured logging → disconnect cleanly. This makes it straightforward to expose only the workflows your product needs.

Boot & session flow

Supported entry paths include normal BROM/Preloader and secure-boot aware flows where the device already exposes a META USB interface. The stack is designed for field tools that must work across a wide range of MTK generations.

Session lifecycle: Host PC → Preloader → META Mode → ConnectUsb → GetVerInfo → File/Partition ops → NVRAM/IMEI → Workflows → Disconnect

Feature surface (META console)

Main session

  • Boot Device (Preloader → META)
  • Read META Info (device / build / software identifiers)
  • EMMC Health Check (JESD84 life-time / pre-EOL sysfs decode)
  • Factory Reset — META (generic)
  • Factory Reset — OPPO F5 + VIVO
  • Factory Reset — VIVO Y-series
  • Factory Reset — RbFs (ext4 rebuild path)
  • Dump USER_SECTION (raw USERAREA)
  • Download USER_SECTION (write back USERAREA image)
  • WIPE FRP — Transsion (INFINIX / TECNO / ITEL META path)

Partition MGR

  • Read Partition Tables (PGPT / partition grid)
  • Per-partition Read / Write / Erase from table UI
  • Dump PGPT
  • Dump USERAREA
  • Dump MDDB / APDB
  • Dump EXT_CSD (/proc/bootdevice/ext_csd)
  • Dump NV Regions (sensitive partitions: nvram, nvdata, protect*, proinfo, seccfg, …)
  • Read / Write / Wipe NVRAM (META NVRAM primitives)

Repair

  • Read IMEI (META)
  • Repair IMEI — SIM1 / SIM2
  • Backup / Write Critical (Xiaomi CPID path)
  • NCK / NSCK / SPCK / CCK / SIM-lock information read paths

Protocol highlights (developer-facing)

Area Implementation notes
USB META connect Baud/flow-control profile, boot-stop handling, version query
Partition resolve Multi-base lookup: /dev/block/by-name, /dev/block/platform/bootdevice/by-name
USERAREA I/O Raw mmcblk0 / sdc — not mistaken for userdata by-name partition
NVRAM backup Dedicated wire primitive + .map / .dat artifact handling
NV region dump Ordered sensitive-region list with skip-on-missing behavior (AU parity)
Factory reset variants Vendor-specific misc/para/nvdata sequences isolated per workflow class
Diagnostics EMMC sysfs cluster + EXT_CSD binary dump as separate operations
Tracing Optional meta_wire_trace.log for support and regression

Supported CPUs & platforms

Engineered for MTK platforms up to current generations used in servicing workflows. Because you own the source, you can extend chip-specific branches (new partition layouts, vendor quirks, additional sysfs nodes) without waiting for a DLL vendor.

Primary host target: Windows (.NET Framework). The protocol layer is separable from the WinForms UI if you need to host it in WPF, a service, or a custom shell.

What you receive (commercial delivery)

  • Full C# source tree — protocol, workflows, UI shell, NV helpers
  • Buildable Visual Studio solution — ready to compile and rebrand
  • Reverse-engineering notes — internal docs for critical workflows (factory reset, USERAREA, FRP, NV dumps, etc.)
  • Integration guidance — how to expose only the modules your product needs
  • Commercial license — for redistribution inside your paid tool (terms on request)
  • Direct support channel — engineering contact for onboarding and update policy

Optional delivery formats on request: C# / VB.NET porting assistance, stripped SDK-style library build, or white-label UI.

Who this is for

  • Software owners building GSM servicing / flash / repair desktop tools
  • Development teams that need META protocol ownership instead of DLL dependency
  • Newcomers with C# experience who want a serious reference implementation to learn MTK META internals

Licensing & purchase

This is a paid commercial source-code product. We do not distribute it as freeware or a public binary-only tool.

Contact us for:

  • License scope (single product / multi-product / OEM)
  • Update & support plan
  • Custom workflow development on top of the stack

Telegram: @GsmCoder

Comparison at a glance

Typical MetaCore wrapper This native protocol source
Protocol visibility Opaque DLL Full C# source
Update control Vendor-dependent You ship patches
Workflow extension Limited / fragile Modular workflow classes
Field diagnostics Often none Wire trace + structured logs
Commercial use Restricted / unclear Explicit commercial license

Last updated: July 2026 — active development; see Changelog in the post sidebar for recent workflow additions.