How To Guide [EU model] Unlock bootloader of European model

Search This thread

xn0live

Senior Member
Dec 22, 2012
1,555
381
The scope of this procedure is to temporarily change one system property (ro.product.name) to allow the unlocking of the bootloader via official means. If it is the case for the Find X5 Lite too, and you're running kernel version 5.10.66, you can modify the script and try.
that mean? what i must do
 

xn0live

Senior Member
Dec 22, 2012
1,555
381
The scope of this procedure is to temporarily change one system property (ro.product.name) to allow the unlocking of the bootloader via official means. If it is the case for the Find X5 Lite too, and you're running kernel version 5.10.66, you can modify the script and try.
that is the infotmation:

Buil Number
CPH2371_11A.12

Basisband Version
M_V3_P10,M_V3_P10

Kernel Version
4.14.186+

Hardware Verdion
CPH2371_11
 
Hello, rooting noob here, interested in buying the gt 2 pro soon. Does this still work to this day? Once the bootloader is unlocked, is it permanent meaning you can also root the phone for as much as you want. About the kernel sources, do you think realme will publish them leaving space for custom roms?
Edit: Discussing with a friend I have found this, so those should be the kernel sources right? https://github.com/realme-kernel-opensource/realme_GT2pro-AndroidS-kernel-source
 
Last edited:

Rapper_skull

Senior Member
Apr 21, 2011
390
209
Naples
Xiaomi Mi Mix 2S
Realme GT 2 Pro
Hello, rooting noob here, interested in buying the gt 2 pro soon. Does this still work to this day? Once the bootloader is unlocked, is it permanent meaning you can also root the phone for as much as you want. About the kernel sources, do you think realme will publish them leaving space for custom roms?
Edit: Discussing with a friend I have found this, so those should be the kernel sources right? https://github.com/realme-kernel-opensource/realme_GT2pro-AndroidS-kernel-source
Yes, that's the kernel source. As for the method, it sure works on the device side. I don't know if Realme changed something server side, but I don't think so.
 
  • Like
Reactions: Pf_Plays06

GIutton

Senior Member
Dec 26, 2021
64
11
OnePlus 8T
Samsung Galaxy S21 FE
I ran the .bat and it says it worked but how do I give adb shell root access it does not recognize su? Or better yet Is there a way to make the magisk app recognize the phone is temporarily rooted so I can do a direct install from the app? I am trying to find a way to magisk root the phone since the bootloader is already unlocked but it will not boot.
 

Rapper_skull

Senior Member
Apr 21, 2011
390
209
Naples
Xiaomi Mi Mix 2S
Realme GT 2 Pro
I ran the .bat and it says it worked but how do I give adb shell root access it does not recognize su? Or better yet Is there a way to make the magisk app recognize the phone is temporarily rooted so I can do a direct install from the app? I am trying to find a way to magisk root the phone since the bootloader is already unlocked but it will not boot.
That's not the scope of this guide. Just flash the patched boot.img with fastboot. If it doesn't boot, probably it's because you didn't run
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
vbmeta.img can be found alongside boot.img in the firmware files.
 

GIutton

Senior Member
Dec 26, 2021
64
11
OnePlus 8T
Samsung Galaxy S21 FE
That's not the scope of this guide. Just flash the patched boot.img with fastboot. If it doesn't boot, probably it's because you didn't run
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
vbmeta.img can be found alongside boot.img in the firmware files.
Sry I know it is not what this is meant for I am just trying to find a workaround to root it since the phone will not go into fastboot mode so I cannot run any fastboot commands. Was trying to find a way to root the phone without using fastboot.
 

mindtrappergr

Member
Mar 13, 2012
41
12
Any chance this could also work for the Realme 9 Pro+ if I somehow could downgrade to a version with a suitable kernel/security patch?
 

Georgik143

New member
Apr 4, 2019
3
0
Maybe it could work. It depends on the kernel version. If it's 5.10.66, you can try.
Hi. I have Gt neo 3, rmx3561, global (mea), kernel 5.10.66, firmware version is A.09
The Chinese version is rmx3560.
What exactly should I change in script to work it.
Thank you.
For now in cmd it shows at end "it worked" and after 30 secs ro.product.name still rmx3561...
 
Last edited:

Rapper_skull

Senior Member
Apr 21, 2011
390
209
Naples
Xiaomi Mi Mix 2S
Realme GT 2 Pro
Hi. I have Gt neo 3, rmx3561, global (mea), kernel 5.10.66, firmware version is A.09
The Chinese version is rmx3560.
What exactly should I change in script to work it.
Thank you.
For now in cmd it shows at end "it worked" and after 30 secs ro.product.name still rmx3561...
You can try and edit startup-root and replace RMX3301 with RMX3560 near the end. Let me know if it works.
 

Georgik143

New member
Apr 4, 2019
3
0

Attachments

  • IMG20220918201451.jpg
    IMG20220918201451.jpg
    3.8 MB · Views: 14

Top Liked Posts

  • There are no posts matching your filters.
  • 8
    As you may know, at the time of writing it's not possible to unlock the bootloader of the European model. Fortunately there's a workaround. To know how it works, scroll to the end of the post.

    First of all, this is only for the European RMX3301, but you can try on any other global model that doesn't allow the unlocking of the bootloader. I'm not talking about temporary errors, but of the infamous This phone model does not support deep testing error message.

    Before starting I would like to thank polygraphene for their implementation of the Dirty Pipe vulnerability on Android. Without that, this would not have been possible.

    Requirements:

    • The phone with a decent charge. Do not attempt this procedure with the phone at 10% and then cry if something goes wrong
    • A compatible build, read below
    • A Windows or Linux PC with adb and fastboot drivers installed

    Check if your build is compatible:

    • Go to Settings -> About device -> Version and check Build number:
      • If your build is between RMX3301_11_A.14 and RMX3301_11_A.19, go to the procedure below
      • If your build is lower than RMX3301_11_A.14, or higher than RMX3301_11_A.19, install this OTA package to downgrade (or upgrade) to RMX3301_11_A.14

    Procedure:

    1. Make sure under Developer options you have OEM unlocking and USB debugging enabled
    2. Download and extract the attached gt2pro_eu_unlock_dirtypipe_v0.2.zip file
    3. Open a terminal in the folder of the extracted files
    4. Connect the phone to the PC and select the File transfer option
    5. Run the script:
      • On Windows, type run.bat and press enter
      • On Linux, type ./run.sh and press enter
    6. Now the phone is temporarily rooted and the phone model is changed to RMX3301. Do not reboot or you will lose this status.
    • At this point you can follow the procedure on the official forum to unlock the bootloader of the global model. If you already have the Deeptesting app installed, clear its data to make sure it will update.

    Changelog:

    v0.2:
    • Show more info about device for better debug
    • Show the model at the end to check if it worked

    For technical people: how does it work?

    The script abuses a vulnerability of the Linux kernel called Dirty Pipe (or CVE-2022-0847). For further details, you can visit the official website. This allows us to gain temporary root and overwrite the ro.product.name property, the only one checked by the Deeptesting app. The vulnerability is present in Android and it has been fixed, at least for the Pixel 6, in the may 2022 security update. At the time of writing, the latest build for the GT2 Pro is RMX3301_11_A.19, and it's still vulnerable. I have tested the procedure personally up to build RMX3301_11_A.16. If you're on a newer build and it doesn't work, please report it in the comments.

    If you have further questions about the procedure, please post them below.
    3
    I attached a new version of the script to the OP. This new versions shows more info do better debug problems, and waits 30 seconds before getting the model again to show if everything worked.
    2
    I wonder if we can use this temporary root to do some modifications on system.
    Theoretically you can do everything you can do on a rooted phone (Magisk, but without modules and Zygisk). In practice I never got Magisk to work properly, so I just limited myself to change the property. My goal was to unlock the bootloader, so I did it and installed Magisk.
    1
    When you try the procedure... delete al date of phone? whe finish---- type run.bat and press enter ---- erase all?
    My procedure will not delete any data, but after that you have to follow the official procedure to unlock the bootloader, and that will factory reset your phone.
    1
    What the future with SafetyNe... Finish customs rooms? I can unlock the boatloader but then change android with safe and problem with all app bank and no accept root... What you say?

    Other question... What app for back up use before unlock boatloader ?
    It's better if you ask these questions in a more relevant thread. For now there's no custom rom available for the GT2 Pro, and for SafetyNet you can use https://github.com/kdrag0n/safetynet-fix/