How To Guide [GUIDE][REALME 8i][NARZO 50] Unlock Bootloader Flash TWRP and Root [RMX3151][RMX3286]

[JajoriaXD]

pritish1998 thanks for your help, really appriciate this.

 

[mestree]

o meu esta dando esse erro
Arquivo "C:\Users\Ramon\Desktop\mtkclient-main\mtkclient\Library\mtk_daxflash.py", linha 215, em status
magic, datatype, length = unpack("<III", hdr)
struct.error: unpack requer um buffer de 12 bytes

 

[lanztotot]

hello good day .. how do i know if im running A20 A30 or A35 ? thankyou

 

[lanztotot]

hoping for some answers thanks

 

[LuziferLess]

hello good day .. how do i know if im running A20 A30 or A35 ? thankyou

settings -> about phone -> version

and u should see your realme ui version under "Version"

edit: it was under "Build number". sorry.

 

[lanztotot]

settings -> about phone -> version

and u should see your realme ui version under "Version"

thankyou very much

 

[juniorhero]

getting this weird error, what to do?

python mtk e metadata,userdata,md_udc

Port - Device detected
Preloader - CPU: MT6781(Helio G96)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - Var1: 0x73
Preloader - Disabling Watchdog...
Preloader - HW code: 0x1066
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 4E2DE3C872A56888E2E8034AD7F94764
PLTools - Loading payload from mt6781_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
USB CORE ERROR
[Errno 5] Input/Output Error
Kamakiri - Done sending payload...
usb_class - USBError(5, 'Input/Output Error')
PLTools - Error, payload answered instead:
Mtk
Mtk - [LIB]: ←[31mError on running kamakiri payload←[0m
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
usb_class - USBError(5, 'Input/Output Error')
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin
xflashext - Patching da1 ...
xflashext - Patching da2 ...
usb_class - USBError(5, 'Input/Output Error')
Preloader
Preloader - [LIB]: ←[31mError on DA_Send cmd←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on sending DA.←[0m

 

[juniorhero]

anyone have narzo 50 A.49 stock boot.img

 

[Kombre212]

Yes you have to pull your boot image first and patch it
Pulling boot image via mtkclient

python mtk r boot,vbmeta boot.img vbmeta.img

After pulling the boot image patch it with the magisk apk given in the post

After patching the patched boot image will be in your phones download folder, rename that to boot.patched and flash with mtkclient as mentioned in the post

Thanks. But does magisk need root access to patch boot image?

 

[pritish1998]

Thanks. But does magisk need root access to patch boot image?

No

 

[Quaon_k]

ight im here just to making 3x sure

• im currently at build A.41, theres only A.35 Patched image in the mega folder. However, i can just pull tf out of my device boot.img and patch it my self with magisk and use it for this steps, is it correct?
• vbmeta one is universal, it works with all version of build image, is it correct?
• i dont understand "dont leave the buttons" part, should i press them till the boot process complete or should i press them and never release them even after booting? what happen if i release them? how should i type the command if my both (sweaty) hand are holding the buttons?
• i came just for root process, is twrp necessary here? can i just skip the twrp part? do we have some nice custom roms for realme 8i?
• will you help me if i nuked my device and i dont know what to do?
• can i ask for estimated success rate for this?

sorry for too many questions

 

[Slaggy]

Hello, I have a Realme 8i.

I have a few questions which might help others too -

1. Do GSIs work?
2. Does RMX 3151 have dynamic partitions? I want to use phhusson's GSI which has OTA updates support.
3. Can I pass safetynet using Magisk on this phone? I've had problems on some phones even after using universal safetynet patch.

Thanks for doing this tutorial.

 

[yoesazel]

Hi Guys!

Since there is no deeptest.apk available for our device to unlock bootloader, we came up with another method to unlock bootloader unofficially!

In this guide I'll tell you how to unlock bootloader, root with magisk and flash TWRP on your Realme 8i/Narzo 50 (RMX3151/RMX3286)

/*
* This Guide is tested and working
* However I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about unlocking and flashing TWRP
* before flashing it! YOU are choosing to make these modifications.
*/

1. UNLOCKING BOOTLOADER:

Requirements

• PC or Laptop
• Internet connection
• Realme 8i/Narzo 50
• USB cable
• Working Brain
• Take a backup of your data since it'll be wiped
• Go to About phone > Version and tap build number 7 times
• Go to Settings > advanced settings > Developer options and turn on OEM unlocking and USB debugging

STEPS

• Install Python from windows store
• Install USBDk
• Download this and extract : https://github.com/bkerler/mtkclient/archive/refs/heads/main.zip
• Download vbmeta and patched boot image (Download for your respective version) in copy to the mtkclient-main folder
• Now open command prompt or powershell in that folder
• View attachment 5472417
• Now type pip3 install -r requirements.txt and hit enter
• Now type python mtk e metadata,userdata,md_udc hit enter - This command wipes data
• Then power off your phone and hold both volume buttons and connect usb cable (DON'T LEAVE THE BUTTONS, KEEP THEM HOLDING THROUGHOUT THE PROCESS) - This boots device into BROM mode
• Now type python mtk da seccfg unlock This will unlock the bootloader (If you face waiting for device issue then unplug the device and plug in the device again with holding volume buttons, also don't leave the buttons)
• View attachment 5472431
• After this unplug your phone and turn it on (It'll show your device dm verity corrupted and first boot might take 20-25 mins, don't panic)
• Now your bootloader is unlocked
• View attachment 5472457
• Due to realme's limitations you still can't access fastboot after unlocking via this method

2. ROOTING YOUR DEVICE:

• Install This Magisk apk
• Now in pc type python mtk w boot,vbmeta boot.patched,vbmeta.img.empty hit enter
• Then power off your phone and connect usb while holding both volume buttons (and don't leave them)
• View attachment 5472465
• Now disconnect and reboot phone
• Now open magisk
• View attachment 5472467View attachment 5472469

3. FLASHING TWRP RECOVERY:

• Download TWRP - From here
• Download and install Flashify app
• Open Flashify and grant root permission
• Select Recovery image and install the twrp you have downloaded
• View attachment 5472483
• After flashing is done click reboot now or you can reboot to recovery via magisk app
• View attachment 5472489

"Congrats Now we have working TWRP in our Realme 8i/Narzo 50"

Credits:

1. Me (@pritish1998) for TWRP, Unlock and Flashing guide
2. B Kerler fot MTKClient
3. Rohit for testing

Stock boot Images (to revert root)

If you face any issues contact me here

Can this method work for narzo 50i? Thanks

 

[gezus_one]

Hi, first i have read whole thread entirely and also unofficial TWRP website and the DM-Verity Opt-encrypt indian website too.
i own a RMX3286 Aka Narzo 50, with firmware version A.50 Export, i have fully followed instructions here, apart from the boot.img that i dumped myself and patched with magisk 23 prior to flashing.
Phone is running ok, unlocked BL, rooted, and TWRP installed !
So a Big thanks to you all for your work !
I'm not new to rooting, unlocking BL, and custom firmwares, already did on most phones i owned past 10 years.

So far so good, i still have some questions unanswered :

Is .bin backup made with Flashify same as .img backup from mtk client ? Can rename from one to the other ? safe to flash .bin through mtk client ?

Is magisk 24.2 working or we need to stick to the magisk 23 of this thread ?

I can't make backups with TWRP 3.6.1_11-0-spaced version, always throw error with 'tar' at the end of backup process, already tried all possible TWRP options i think... Any solution ? Flash unofficial TWRP 3.6.0 and flash no-verity-opt-encrypt at same time through current TWRP is going to work ?

 

[gezus_one]

I can't make backups with TWRP 3.6.1_11-0-spaced version, always throw error with 'tar' at the end of backup process, already tried all possible TWRP options i think... Any solution ?

Solution :
Narzo 50 is using kind of ram on disk to add more available memory, in my case 6gb of Real RAM + 2gb of on disk memory.
So go to Developper options > Memory and disable the added memory, keep only real RAM.
Reboot phone fully once, allow system to start.
Reboot in recovery, in TWRP start the backup... No more errors.

Didn't found this solution anywhere on the web, as everyone is pointing out to delete some folders or disable Cloned apps if you use it.

 

[soycow]

Hey, thanks for this guide. I followed it but i've problems with the bootload unlock. In Brom-mode I entered the unlock command but I always receive the below error. What am I missing? Thanks in advance.

PS H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main> python mtk da seccfg unlock
MTK Flash/Exploit Client V1.54 (c) B.Kerler 2018-2021

Traceback (most recent call last):
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtk", line 695, in <module>
    mtk = Main(args).run()
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtkclient\Library\mtk_main.py", line 509, in run
    mtk = da_handler.configure_da(mtk, preloader)
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtkclient\Library\mtk_da_cmd.py", line 79, in configure_da
    info = mtk.daloader.reinit()
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtkclient\Library\mtk_daloader.py", line 100, in reinit
    self.da.reinit()
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 1016, in reinit
    self.sram, self.dram = self.get_ram_info()
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 500, in get_ram_info
    resp = self.send_devctrl(self.Cmd.GET_RAM_INFO)
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 262, in send_devctrl
    status[0] = self.status()
  File "H:\Installation\Realme8i Unlock\mtk2\mtkclient-main\mtkclient-main\mtkclient\Library\mtk_daxflash.py", line 213, in status
    magic, datatype, length = unpack("<III", hdr)
struct.error: unpack requires a buffer of 12 bytes

yea ive got the same issue anyone know any possible solutions

 

[soycow]

When I execute the cmd "python mtk da seccfg unlock" it will show this error, I did wipe using the mtk cmd twice but still not working. Running on A36 btw.View attachment 5517115

I'm having issues on camera, it crashes when I'm trying to open it. Is there any fix for this?

im having the same issue where it showed you that error when you executed "python mtk da seccfg unlock" what did you do to fix it?

 

[gezus_one]

yea ive got the same issue anyone know any possible solutions

Did you strictly followed the guide, like install python 3.9, not use older versions of python ?

 

[nikhil5000]

I have pulled my boot and vbmeta.
And patched with magisk everything is successful but my mobile is stuck at bootloop. I have done everything right.
I m not Able to root. Kindly please help me.. how to root realme 8i a44 stock rom installed currently

 

[X Λ N Ξ]

Brother my phone is bricked and i tried your method , but its showing the following error while running brom.bat file , u can see the error in the attached file , please help me bro , you are the only hope waiting for your reply .