How To Guide [EU model] Unlock bootloader of European model

Search This thread

KrzysztofJ

Member
Nov 7, 2012
20
3
Hi,
I am thinking about unlocking the bootloader and get root and I have 3 questions, I will be grateful if someone is able to answer them:
1. Is it possible to roll back the firmware from RMX3301_11.C.18 to RMX3301_11_A.21?
2. Can an unlocked bootloader be locked back?
1. Do we lose any functions forever by unlocking the bootloader? I know that the widevine drm security level will change, that when the phone starts up, there will be information that the bootloader is unlocked, netflix or google play maybe will not work but after re-locking the bootloader and etting back to the stock firmware, will everything return to the state it was before unlocking the bootloader?
 

Stano36

Senior Member
Aug 25, 2012
1,075
471
54
Slovakia
Samsung Galaxy Tab S7 / S7 Plus
Hi,
I am thinking about unlocking the bootloader and get root and I have 3 questions, I will be grateful if someone is able to answer them:
1. Is it possible to roll back the firmware from RMX3301_11.C.18 to RMX3301_11_A.21?
2. Can an unlocked bootloader be locked back?
1. Do we lose any functions forever by unlocking the bootloader? I know that the widevine drm security level will change, that when the phone starts up, there will be information that the bootloader is unlocked, netflix or google play maybe will not work but after re-locking the bootloader and etting back to the stock firmware, will everything return to the state it was before unlocking the bootloader?
1. There will be no rollback to version A.21 directly. Rollback is up to version A.14.
2. Yes
3. Yes

Edit:
Maybe you don't need Rollback, I have Deep Testing for RUI 4.0
 
  • Like
Reactions: KrzysztofJ

manu81cba

Member
Nov 15, 2021
42
0
I use this method last year to install India version... Now have last ota... I need Re lock bootloader...any know what is the guide to lock? No want brick my phone
 

miky03

Senior Member
Apr 19, 2015
93
9
As I know you have to rollback to Android 12 first then with adb command you can relock the bootloader again
 

manu81cba

Member
Nov 15, 2021
42
0
Debería poder bloquearlo con adb, sin bajar de categoría.
if use the Oficial method the app no working
Screenshot_2023-07-05-23-00-55-31_5461cd6783b6e8d9f5be0980ff5227f9.jpg
 

Rapper_skull

Senior Member
Apr 21, 2011
502
355
Naples
Xiaomi Mi Mix 2S
Realme GT 2 Pro
After pressing "start deep testing" reboots and for a second I have only this (picrel), then it boots to the system.
Unfortunately, Realme recently updated their servers. Now they return an unlock code containing the phone model. My hack changes the model from RMX3301EEA to RMX3301, so the code contains RMX3301. Then, when you reboot into fastboot, the codes are checked and they don't match, so the phone will reboot.

One solution would be to convert your device to the export ROM (India for example), and unlock the bootloader. At that point you can reinstall the European ROM, and you would still have an unlocked bootloader, but you won't be able to access fastboot anymore.
 
  • Like
Reactions: emlo16

Top Liked Posts

  • There are no posts matching your filters.
  • 10
    As you may know, at the time of writing it's not possible to unlock the bootloader of the European model. Fortunately there's a workaround. To know how it works, scroll to the end of the post.

    First of all, this is only for the European RMX3301, but you can try on any other global model that doesn't allow the unlocking of the bootloader. I'm not talking about temporary errors, but of the infamous This phone model does not support deep testing error message.

    Before starting I would like to thank polygraphene for their implementation of the Dirty Pipe vulnerability on Android. Without that, this would not have been possible.

    Requirements:

    • The phone with a decent charge. Do not attempt this procedure with the phone at 10% and then cry if something goes wrong
    • A compatible build, read below
    • A Windows or Linux PC with adb and fastboot drivers installed

    Check if your build is compatible:

    • Go to Settings -> About device -> Version and check Build number:
      • If your build is between RMX3301_11_A.14 and RMX3301_11_A.21, go to the procedure below
      • If your build is lower than RMX3301_11_A.14, or higher than RMX3301_11_A.21, install this OTA package to downgrade (or upgrade) to RMX3301_11_A.14

    Procedure:

    1. Make sure under Developer options you have OEM unlocking and USB debugging enabled
    2. Download and extract the attached gt2pro_eu_unlock_dirtypipe_v0.2.zip file
    3. Open a terminal in the folder of the extracted files
    4. Connect the phone to the PC and select the File transfer option
    5. Run the script:
      • On Windows, type run.bat and press enter
      • On Linux, type ./run.sh and press enter
    6. Now the phone is temporarily rooted and the phone model is changed to RMX3301. Do not reboot or you will lose this status.
    • At this point you can follow the procedure on the official forum to unlock the bootloader of the global model. If you already have the Deeptesting app installed, clear its data to make sure it will update.

    Changelog:

    v0.2:
    • Show more info about device for better debug
    • Show the model at the end to check if it worked

    For technical people: how does it work?

    The script abuses a vulnerability of the Linux kernel called Dirty Pipe (or CVE-2022-0847). For further details, you can visit the official website. This allows us to gain temporary root and overwrite the ro.product.name property, the only one checked by the Deeptesting app. The vulnerability is present in Android and it has been fixed, at least for the Pixel 6, in the May 2022 security update. On the GT 2 Pro, the vulnerability has been fixed with the Android 13 update, while the latest Android 12 build (RMX3301_11_A.21) is still vulnerable. I have tested the procedure personally up to build RMX3301_11_A.16. If you're on a newer build and it doesn't work, please report it in the comments.

    Will it work on device X?

    If the following conditions are met:
    • it is a Realme device;
    • the kernel version is 5.10.66;
    • there's a global model with a different ro.product.name that can be unlocked;
    then you can edit the startup-root file and replace RMX3301 (near the end) with the ro.product.name of the global model and try if it works. If it doesn't, it could be for a lot of reasons. Unfortunately, I can't help you without physically having the device in hand.

    If you have further questions about the procedure, please post them below.
    3
    I attached a new version of the script to the OP. This new versions shows more info do better debug problems, and waits 30 seconds before getting the model again to show if everything worked.
    2
    I wonder if we can use this temporary root to do some modifications on system.
    Theoretically you can do everything you can do on a rooted phone (Magisk, but without modules and Zygisk). In practice I never got Magisk to work properly, so I just limited myself to change the property. My goal was to unlock the bootloader, so I did it and installed Magisk.
    1
    When you try the procedure... delete al date of phone? whe finish---- type run.bat and press enter ---- erase all?
    My procedure will not delete any data, but after that you have to follow the official procedure to unlock the bootloader, and that will factory reset your phone.
    1
    What the future with SafetyNe... Finish customs rooms? I can unlock the boatloader but then change android with safe and problem with all app bank and no accept root... What you say?

    Other question... What app for back up use before unlock boatloader ?
    It's better if you ask these questions in a more relevant thread. For now there's no custom rom available for the GT2 Pro, and for SafetyNet you can use https://github.com/kdrag0n/safetynet-fix/