[GUIDE] Two ways to root oppo a5s (CPH1909)+ Unlock bootloader after security update ( without downgrading )

Did this guide help you ?

  • yes

    Votes: 8 50.0%
  • no

    Votes: 1 6.3%
  • I'm reading it

    Votes: 5 31.3%
  • I'm doing the steps !

    Votes: 5 31.3%

  • Total voters
    16
Search This thread

jimenezshown

Senior Member
Sep 14, 2020
80
13
@Anonymous V @Zezo 089 Hi guys, I managed to flash the lk file and this removed the "your device is unlocked and cannot be trusted , rebooting in 5 seconds" , but not the second message "dm-verity error, Your android system / device is corrupted...", should the lk file remove both message or or just only the first message?
 

Anonymous V

Senior Member
Jan 16, 2021
919
240
16
Phillippines
@Anonymous V @Zezo 089 Hi guys, I managed to flash the lk file and this removed the "your device is unlocked and cannot be trusted , rebooting in 5 seconds" , but not the second message "dm-verity error, Your android system / device is corrupted...", should the lk file remove both message or or just only the first message?
can you still boot your phone? or atleast operate it? and also does your phone has a fastboot? try to test it if there is
 

jimenezshown

Senior Member
Sep 14, 2020
80
13

jimenezshown

Senior Member
Sep 14, 2020
80
13
so you can use your phone like normal and no bootloop or other shinanegans happens your phone right? but only the message appear when the phone is booting right? well see if there is a solution for that because that never happens to me
that's right, though it's not affecting my phone's performance and I don't mind if this will take time to get fixed, I'm only wondering if it's possible. Thank you bro. 😁
 

Anonymous V

Senior Member
Jan 16, 2021
919
240
16
Phillippines
I read that this could be solved by flashing with vbmeta.img but I'm scared to do it and I don't know where to get the vbmeta 😁
yes it can be fixed in that way ,were thinking the same way and i think you can get a vbmeta image in your stock firmware just extract it and you will able to see vbmeta image in there because every phone has a unique vbmeta
 

jimenezshown

Senior Member
Sep 14, 2020
80
13
yes it can be fixed in that way ,were thinking the same way and i think you can get a vbmeta image in your stock firmware just extract it and you will able to see vbmeta image in there because every phone has a unique vbmeta
The problem is I don't seem to find any vbmeta image in a stock firmware and even in my fully back up firmware though. Anyway, not really a big deal for me, kinda bothersome a bit but as long as phone is working as intended then it's fine. 😁
 
so you can use your phone like normal and no bootloop or other shinanegans happens your phone right? but only the message appear when the phone is booting right? well see if there is a solution for that because that never happens to me
Maybe i have a solution for this , but i'll get the link after minutes
 

jimenezshown

Senior Member
Sep 14, 2020
80
13
@Anonymous V dude , yep he is right , the frimware does not have vibmeta file at all 💀
As per the instruction in magisk, I patched the stock boot.img again this time with "Preserved vbmeta in boot image" then flashed "same issue". Next was checking the 3 options then flashed again but message still appearing during power cycle. I also read that fastboot in our device is factory disabled and inaccessible so doing that fastboot command is not the right method for our device.

IMG_20230606_081240.jpg
 
Dude What the heck you did 🤯
As per the instruction in magisk, I patched the stock boot.img again this time with "Preserved vbmeta in boot image" then flashed "same issue". Next was checking the 3 options then flashed again but message still appearing during power cycle. I also read that fastboot in our device is factory disabled and inaccessible so doing that fastboot command is not the right method for our device.

View attachment 5926499
THIS DOES NOTHING
+ IT IS DANGEROUS TO DO THIS
 
As per the instruction in magisk, I patched the stock boot.img again this time with "Preserved vbmeta in boot image" then flashed "same issue". Next was checking the 3 options then flashed again but message still appearing during power cycle. I also read that fastboot in our device is factory disabled and inaccessible so doing that fastboot command is not the right method for our device.

View attachment 5926499
Also yep oppo a5s has no fastboot
 
As per the instruction in magisk, I patched the stock boot.img again this time with "Preserved vbmeta in boot image" then flashed "same issue". Next was checking the 3 options then flashed again but message still appearing during power cycle. I also read that fastboot in our device is factory disabled and inaccessible so doing that fastboot command is not the right method for our device.

View attachment 5926499
+ I know a way using a program but maybe it needs Activation
 

jimenezshown

Senior Member
Sep 14, 2020
80
13
I also wondering if "DT-verity error" is the reason why my CPU governor app won't save and apply the setting after reboot, is "DT-verity error" likely the culprit for this bro?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    oh yeah sorry about that my language was set to french for some reason, it says you can't run the program bcz [filename] is missing, please try reinstalling the program

    but i extracted the file as is from the zip file and installed all the drivers
    Look at this video:
    1
    @Anonymous V @TheSamBeaver
    Check the thread again, please
    1
    New edit is coming
    About magisk 26.2
    To sum it up before editing: it sucks
    1
    Ok
    U can go ahead
    Remember: before flashing using SP flash tool, please use mct mtk bypass to avoid any flashing errors in SP flash tool 🙂
    ok bro
    1
    when booting my device only show
    orange state
    your device is unlocked not trusted
    etc
    This is normal when the bootloader is unlocked, and is by design. See Android Boot Flow
  • 3
    Hello !
    I've discovered 2 new ways to root oppo a5s ( CPH1909) after the new security update which removed the mtk-easy-su root (last edit : 15/9/2023)


    (EDIT : THE 2ND WAY IS RECOMMENDED AS U CAN INSTALL THE LATEST MAGISK (26.3) THERE ! but the 1st way will be updated so u can get rooted by magisk 26.3 through boot.img)

    NOTE : guide on how to unbrick / solve & prevent bootloop is here : https://forum.xda-developers.com/t/...nt-fix-bootloop-for-oppo-a5s-cph1909.4623727/

    Let's start with the first way !


    YOU WILL REQUIRE :-

    1- THE LATEST FLASHABLE OFFICIAL ROM (OPTIONAL) + UPDATE OPPO A5S TO THE LATEST VERSION (Madantory) + BOOT.IMG FILE OF THE LATEST UPDATE (if u want to patch the file by yourself, btw i uploaded a patched one )

    2- A PC / Laptop runs Windows 10 or older (for win11 users you can use this guide but do not open MTK CLIENT TOOL (Gui Version) it won't work , instead, see the edit in the STAGE 3 (the few lines between STAGE 3 and STAGE 4)

    3- MTK Client Tool (link will be sent here in comments) <uploaded by me>

    4 -
    mediatek driver auto installer <link is provided>

    5 - SP flash tool <link is provided>

    6 - a usb cable (of course there is no download link for this 😀)

    7 - Scatter File (WILL BE UPLOADED HERE IN COMMENTS)

    8 - Magisk Manager for your phone. (v.26.1) <from Github> (NOTE: ONLY DOWNLOAD & INSTALL 26.1, NOT 26.2, IT CAUSES BOOTLOOP! , But you can still use 26.2 if you will use the second method)

    9 - UNLOCK BOOTLOADER USING MTK CLIENT TOOL (No data wipe needed + STEPS WILL BE PROVIDED HERE TOO)

    10 - (IMPORTANT) MCT MTK BYPASS REV4/REV3 + <link is provided>

    11 - The preloader file : Here


    NOTE BEFORE STARTING : If links have problems or it is inaccessible , please tell me to send new links in comments .
    also ,
    MAKE SURE YOUR DEVICE IS UPDATED TO THE LATEST VERSION (A.46) BECAUSE IF YOU FLASHED THE BOOT.IMG (you will know what does this file do here later ) WHICH IT IS FOR THE LATEST UPDATE AND YOUR DEVICE IS OLDER THAN IT , YOUR DEVICE MAY BRICK , AND I AM NOT RESPONSIBLE FOR ANY DAMAGES FOR YOUR DEVICE

    but , if anything happens , tell me , I will help you .

    BIG ULTRA NOTE BEFORE STARTING : If you will share these guide/method or even your results in rooting this device in your website, your youtube video, or anything else , please DO NOT FORGET TO MENTION THE SOURCE !!!

    Also , before doing these steps , keep an eye on the new edits in the last / beginning of this thread.


    Let's start :)

    STAGE 1: PATCHING BOOT.IMG
    (skip this stage if you have preloader.bin file already and downloaded the boot.img that I patched), but download the ROM if you face a brick or any problem in your phone system


    1 - Download the latest frimware here

    2 - Choose the latest version (a.46)

    3 - After downloading and extracting the file , you will find many folders > Enter the folder (frimware) , find and copy the boot.img file to your phone

    4- patch it by magisk manager

    5 - copy the patched boot.img ( usually located in Downloads folder in your phone)to your pc
    ( note : you will need it later :))

    6 - replace the patched boot.img with the original one in the folder you have extracted the rom in ( but before it, please backup the original one in an external folder , and also change the patched boot.img to ( "boot.img")

    Note : I uploaded the boot.img file if you want to save time instead of downloading the whole rom !

    STAGE 2 : Installing MEDIATEK usb Drivers

    7- Open Mediatek driver auto installer

    8 - While the program is opening , a window appears which asks yo if you allow the installer to make changes ... blabla , just click allow (ok) and let the program do the trick, after it finishes, reboot your pc / laptop

    STAGE 3 : UNLOCKING BOOTLOADER

    (NOTE BEFORE STARTING : THERE IS NO DATA WILL BE LOST , AND DO NOT ENABLE THE OEM UNLOCK IN DEVELOPER OPTIONS , THE MTK CLIENT TOOL WILL GIVE AN ERROR DURING UNLOCKING , JUST KEEP IT DISABLED !!!!)



    8 - After the program installed the drivers , go to MTK CLIENT TOOL , choose the device name ("OPPO A5S") , choose "UNLOCK BOOTLOADER"

    *Edit : install usbDK drivers , choose your arch (64 or 86=32) < to know it simply go to settings, system and a screen will show up with your pc info. ignore the X i made 😅
    MTK CLIENT TOOOL.jpg

    9 - turn your phone off , and then press these keys (" VOLUME UP + VOLUME DOWN <<in the same time>> ") and plug your phone in using the usb cable , once you hear a sound from your pc ( the usb connection sound) , you can stop pressing , because the phone is in BROM mode ( the mode which u can flash a file/rom )

    10 - click "Start" button in MTK CLIENT TOOL in your pc , when you see messages appear on the right in the Mtk Client Tool , DON'T UNPLUG YOUR PHONE !!!!

    When the progress bar achieves 100% in the program and u see bootloader unlock = OK, unplug your phone and press power button , if you found a warning message while booting , so , unfortunately....

    YOU SUCCESSFULLY UNLOCKED YOUR BOOTLOADER !!!!! XD
    So , do not panic if it appears !
    The message will say (" your device is unlocked and cannot be trusted , rebooting in 5 seconds")

    <Note : It can be solved, check in replies for lk.img file and flash it as u were flashing a boot image>

    btw there is a guide for this : HERE


    and then another message appears (" dm-verity error,
    Your android system / device is corrupted, please select whether you want to boot in E10 mode or RESTART mode
    ")
    It will give you two choices , you SHOULD choose the RESTART mode by pressing VOLUME DOWN , and tadaaaa your phone is booting normally and the data DIDN'T LOST AT ALL!

    BIG ULTRA NOTE : IF THE WARNING MESSAGE DIDN'T APPEAR , SO YOUR BOOTLOADER ISN'T UNLOCKED Successfully , I ADVICE YOU TO DO THE STAGE 3 STEPS AGAIN AND KEEP AN EYE ON THE MESSAGES APPEARANCE ON THE RIGHT OF THE MTK CLIENT TOOOOL ( IF IT SHOWS THE DEVICE MODEL , THE PROCESSOR , etc ) after connection , let it do the magic (as the dm-verity message appears usually after unlocking bootloader)

    ***NEW EDIT : it seems that mtk client tool doesn't work with win 11 and some users of win10 for some reason...
    So I brought another method to unlock the bootloader using the terminal version

    1- open the folder mtkclient-main ( if it is not available, go to download mtk client for terminal from GitHub)

    2- open the cmd in the same directory of the mtk client-main folder (hint : type in the bar that shows the folder directories (cmd) and tadaaaaaaa

    2- type in the cmd pip3 install -r requirements.txt

    3- type again in the cmdpython setup.py install or python setup.py

    4- install usbDK from Here

    5- after mtk client has been installed, type this python mtk da seccfg unlock

    6- it will say waiting for device .. power off your phone and press vol up + vol down + release when connected, then let it do the magic✨
    When finishes, unplug it and continue these steps 👍
    (tell me if there is an error)

    STAGE 4 (IMPOOOOORTANNNNT):
    How to Bypass the next error message


    Screenshot 2023-04-07 045033.png

    1- open MCT MTK BYPASS (dowload link is in replies) , choose the chipset (MT6765 )

    2 - REBOOT your phone into brom mode ( vol up + vol down)

    3 - connect your device and click start , and done !
    Note : KEEEEEEEEEEEEEP YOUR DEVICE CONNECTED AND DO NOT DISCONNECT IT FROM YOUR PC

    Stage 5 ( the last stage) : Flashing

    1- open SP FLASH TOOL

    2 - locate the scatter file that I'll provide it in comments here !

    NOTE ABOUT THE SCATTER FILE : the scatter file which comes with the frimware is CORRUPTED , I've tried to fix it and it worked !
    because when I worked with this corrupted scatter file , it gave me an error while flashing !! , just editing it on my way has solved it anyway

    3 - you will see a list of many files , just untick EVERY THING EXCEPT FOR THE BOOT.IMG (Make sure it is the patched one) (+please locate the preloader.bin file but untick it)

    4 - BOOT your phone into brom mode (turn it off , press volume up + volume down , connect it with your pc)

    5- once you hear the usb connection sound from your pc , click on "DOWNLOAD" button , and wait until a correct sign (√) appears in a window

    6 - REBOOOOT
    7 - let's Celebrate! 🎉

    (*new edit : if sp flash tool shows you an error your device storage reached the end of life, bruuuuuuuh, just uncheck (checking the device status) from settings and retry flashing!



    Second way to Root oppo a5s :-

    I've just known that there is an unofficial twrp for this phone. We will use this to flash magisk.zip file to get root access if you don't want / flash a patched boot.img

    All we need are :

    • Some main requirements from the 1st way (SP flash tool + MCT MTK BYPASS REV4 + installation of Drivers + unlocked bootloader of your phone + preloader.bin) ((methods of unlocking bootloader is in the 1st way, go unlock your bootloader then flash twrp in the 2nd way here)

    • And new requirements :-

    -Twrp recovery 3.6.x(uploaded by Unofficial twrp website) : Here

    -Magisk 26.3.zip file *

    (NOTE : after downloading, copy this zip file into your SD card)

    STAGE 1 : FLASHING TWRP

    1-
    Open Sp Flash Tool and MCT MTK BYPASS REV4

    2-
    in SP flash tool, locate recovery.img file that you downloaded + preloader.bin (NOTE: UNTICK preloader.bin)

    3- in MCT MTK BYPASS REV4, select the chipset (MT6765)

    4- boot your phone into BROM mode (vol.up + vol.down + release when connected)

    5- in MCT MTK BYPASS REV4, Click "bypass"

    6- after it succeeds, Go to SP flash tool and click download

    7- after it shows a correct sign (), disconnect your phone and boot into recovery (vol.down + power button)

    8- TWRP splash screen shows up !

    STAGE 2 : FLASH MAGISK 26.3 * !

    1- click "install" button

    2- locate the zip file place

    3- disable zip verification (if needed)

    4- after it succeeds, boot your phone normally and you have got root access!!

    NOTE : ISSUES THAT YOU MAY FACE IN TWRP

    1- there is no MTP
    2- it doesn't detect your internal storage
    3- it may not mount some partitions like /data and /odm
    4- you tell me




    --thanks to the user @Anonymous V for being online when i applied these steps , he was answering every question i ask.

    -- if you want anything , or need some help , type in comments here , I and Anonymous V will be available (note that I won't be online for every day ...)



    ** Please support me to continue my work here. I love you : Buy me a coffee

    (First time typing a thread😅)


    IMPORTANT NOTE : Please put the boot.img + preloader.bin + the scatter file in a folder/ recovery.img + preloade.bin + scatter file, then locate the scatter file using SP Flash Tool, Untick the preloader.bin to avoid bricking the device

    ALSO , PLEASE DO NOT PUT THE BOOT.IMG AND THE SCATTER FILE
    / RECOVERY.IMG AND FLASH THE BOOT.IMG/RECOVERY WHILE PRELOADER.BIN IS NOT AVAILABLE IN THE SAME FOLDER/NOT LOCATED , AN ERROR WILL APPEAR (
    ERROR_INVALID_PRELOADER)
    REPEAT : DO NOT FLASH PRELOADER.BIN , ONLY PUT IT IN THE SAME FOLDER WITH THE PATCHED BOOT.IMG/ TWRP RECOVERY.IMG AND SCATTER FILE, LOCATE THE PRELOADER FILE , UNTICK IT AND FLASH ONLY BOOT.IMG/RECOVERY.IMG AS YOU LIKE



    Thanks for @jimenezshown for providing this info !






    NEW edit :

    Guys, if u read this, i want to announce that *25K people saw this thread!🎉🎉
    and because of this, wait for a new custom rom for this device after some months (I will be back to school 💀)
    **I need a team to work on this, if u want to join, just tell me Here in this thread and i will ask u some questions)


    check this thread, there i will send the link of the ROM thread !

    (EDIT) Also, if you want to be mentioned after the ROM is built successfully, send a post there !

    but actually, i am too sad ):

    because I said if u will share this to your YouTube video, blog, or website,
    YOU SHOULD MENTION THE SOURCE
    i spotted someone on youtube called jpservicell got the full way to root this device from my thread, and he did not even mention the source in the video,a comment, or a description:mad:


    ****** ANNOUNCEMENT: Guys, I won't be active as I was on XDA after September 1st, so please if you have a question/problem, tell me before this day comes !
    =============================================
    Thank you,
    ╭━━━━┳━━━┳━━━┳━━━┳━━━╮
    ╰━━╮━┃╭━╮┃╭━╮┃╭━╮┃╭━╮┃
    ╱╱╭╯╭┫┃╱╰┫┃┃┃┃╰━╯┃╰━╯┃
    ╱╭╯╭╯┃┃╭━┫┃┃┃┃╭━╮┣━━╮┃
    ╭╯━╰━┫╰┻━┃╰━╯┃╰━╯┣━━╯┃
    ╰━━━━┻━━━┻━━━┻━━━┻━━━╯
    2
    If it is aarch64 then it is same as ARM64
    ohh so i can flash this arm644 image
    2
    hello, How yall doin?

    I confirmed after a readback that the bypass verified boot is enabled method in this guide works and I was able to write in the protected area. Now it still shows Download not completed when I try to boot and in a stale state. After carefully examining the readback after flashing, I found that only the following partitions are empty:

    boot_para
    odm
    otp
    flashinfo
    sgpt

    If you have the phone with you can you confirm after a readback that these partitions are supposed to be empty. And if not empty then I ask of you to please share the images. I think after this i will be able to finally unbrick my phone.

    Thanks to both @ZG089 and @Anonymous V for supporting me through this.
    2
    i think i learned my lesson which is " if its a no its a no "
    Hey
    I made a funny problem
    I was contacting @ARUsmani on whatsapp
    I told him" I am ZG089 from XDA"
    He told me " what a nice name , you said u are from XDA 🙂"
    2
    Dio you still need it bro? Sorry for late response, been busy for this past weeks.
    its ok now bro here try this flash it normally then boor it up REMEMBER WHEN THE SCREEN IS BLACK AFTER BOOTING RECOVERY PRESS THE POWER BUTTON AT LEAST 3 TIMES TO OPEN THE RECOVERY