[GUIDE] Two ways to root oppo a5s (CPH1909)+ Unlock bootloader after security update ( without downgrading )

Did this guide help you ?

  • yes

    Votes: 9 52.9%
  • no

    Votes: 1 5.9%
  • I'm reading it

    Votes: 5 29.4%
  • I'm doing the steps !

    Votes: 5 29.4%

  • Total voters
    17
Search This thread
let me know if you manage it bro. Thank you. :)
First: download CM2 MTK Dongle Here
Second : reboot to BROM mode + connect pc
Third :
165296498130922.png

Select (Memory Tool)
Fourth:
165303526873751.png

Check this and right click
16529651129622.png

Click this and tadaaa
NOTE : Not tested by me
 
  • Wow
Reactions: jimenezshown

Anonymous V

Senior Member
Jan 16, 2021
920
240
16
Phillippines
As per the instruction in magisk, I patched the stock boot.img again this time with "Preserved vbmeta in boot image" then flashed "same issue". Next was checking the 3 options then flashed again but message still appearing during power cycle. I also read that fastboot in our device is factory disabled and inaccessible so doing that fastboot command is not the right method for our device.

View attachment 5926499
ohh sht dude i think this is the reason why you have the broken dm-verity message in the screen its because you disable it while patching the boot image which is wrong to be honest( it depends though) try patching your boot image again but this time dont check anything just leave it be ok and tell us if the message is gone
 

Anonymous V

Senior Member
Jan 16, 2021
920
240
16
Phillippines
As per the instruction in magisk, I patched the stock boot.img again this time with "Preserved vbmeta in boot image" then flashed "same issue". Next was checking the 3 options then flashed again but message still appearing during power cycle. I also read that fastboot in our device is factory disabled and inaccessible so doing that fastboot command is not the right method for our device.

View attachment 5926499
here bro its a vbmeta image if you still need it its for oppo a5s only
 

Attachments

  • vbmeta.zip
    206 bytes · Views: 8

Anonymous V

Senior Member
Jan 16, 2021
920
240
16
Phillippines

jimenezshown

Senior Member
Sep 14, 2020
80
13
ohh sht dude i think this is the reason why you have the broken dm-verity message in the screen its because you disable it while patching the boot image which is wrong to be honest( it depends though) try patching your boot image again but this time dont check anything just leave it be ok and tell us if the message is gone
actually the first time I root this device, I used the boot.img provided by @Zezo 089 and I thought it was normal to have that message after all the steps and then that's when I tried patching boot.img on my own but still issue persist though.
 

jimenezshown

Senior Member
Sep 14, 2020
80
13
ohh sht dude i think this is the reason why you have the broken dm-verity message in the screen its because you disable it while patching the boot image which is wrong to be honest( it depends though) try patching your boot image again but this time dont check anything just leave it be ok and tell us if the message is gone
Okay update bro, I tried patching the stock boot.img with magisk and all 3 options unchecked and then flash again but it didn't get rid of dm-verity error message bro.
 

Anonymous V

Senior Member
Jan 16, 2021
920
240
16
Phillippines
do you have other method how to access fastboot bro? based on my research, I think fastboot on this device is disabled so I cannot apply the fastboot command, did the "adb reboot fastboot" and combination key already but to no avail.
oppo phones right now has no fastboot actually btw why do you want to access the fastboot what are you going to do i need to know i might help you
 
why do you want to delete the bootloader partition? it will remove the bootloader unlocked state and it will corrupted the phone
Bruh
I found it
+ I didn't know it will remove the Bootloader partition, it will remove something has the dm-verity + vbmeta verification + got it from a website
 

Anonymous V

Senior Member
Jan 16, 2021
920
240
16
Phillippines
Bruh
I found it
+ I didn't know it will remove the Bootloader partition, it will remove something has the dm-verity + vbmeta verification + got it from a website
yes your right it will remove the message because you will remove or relocked the bootloader also doing that will corrupt the phone making it unable to boot because of an authorized boot image, bro @Zezo 089 not all in the website are true we need to research more before doing it we might screw up if we dont
 
  • Like
Reactions: ZG089

jimenezshown

Senior Member
Sep 14, 2020
80
13
Bruh
There is one thing is checked by Magisk by default 💀
And he unchecked it 💀💀
Actually bro, like I said before, I used your boot.img you provided here when I'm still on the process of rooting my phone, I didn't patch magisk since you provided the img already but after all the process, I got the "dt-verity error" and I thought it was a normal thing when rooted already.

he patched boot.img file ( to save your time instead of getting the original file from the frimware (rom) and patch it , i thought that providing a patched boot.img by magisk app may help !) : here

Well, if this doesn't limit the functionality of the phone then I could leave it be , right?
 
  • Like
Reactions: ZG089
Actually bro, like I said before, I used your boot.img you provided here when I'm still on the process of rooting my phone, I didn't patch magisk since you provided the img already but after all the process, I got the "dt-verity error" and I thought it was a normal thing when rooted already.



Well, if this doesn't limit the functionality of the phone then I could leave it be , right?
Yep
But I don't know what does this affect , though 🤔
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Ok
    U can go ahead
    Remember: before flashing using SP flash tool, please use mct mtk bypass to avoid any flashing errors in SP flash tool 🙂
    ok bro
    1
    when booting my device only show
    orange state
    your device is unlocked not trusted
    etc
    This is normal when the bootloader is unlocked, and is by design. See Android Boot Flow
    1
    It seems that u r lucky than me bro 😀
    I wish for you more luck ♥️
    tnks bro
    1
    Congratulations
    And sorry for not uploading that one that has the fix
    I lost my phone and i still cannot find it, and i had connection problems.
    I am using now an old one
    Sorry again for not uploading twrp fix
    No problem bro
    1
    What ?
    Mtp does not working in my twrp
    Can U send me that one u got ?
  • 3
    Hello !
    I've discovered 2 new ways to root oppo a5s ( CPH1909) after the new security update which removed the mtk-easy-su root (last edit : 25/9/2023)


    (EDIT : THE 2ND WAY IS RECOMMENDED AS U CAN INSTALL THE LATEST MAGISK (26.3) THERE ! but the 1st way will be updated so u can get rooted by magisk 26.3 through boot.img)

    NOTE : guide on how to unbrick / solve & prevent bootloop is here : https://forum.xda-developers.com/t/...nt-fix-bootloop-for-oppo-a5s-cph1909.4623727/

    Let's start with the first way !


    YOU WILL REQUIRE :-

    1- THE LATEST FLASHABLE OFFICIAL ROM (OPTIONAL) + UPDATE OPPO A5S TO THE LATEST VERSION (Madantory) + BOOT.IMG FILE OF THE LATEST UPDATE (if u want to patch the file by yourself, btw i uploaded a patched one )

    2- A PC / Laptop runs Windows 10 or older (for win11 users you can use this guide but do not open MTK CLIENT TOOL (Gui Version) it won't work , instead, see the edit in the STAGE 3 (the few lines between STAGE 3 and STAGE 4)

    3- MTK Client Tool (link will be sent here in comments) <uploaded by me>

    4 -
    mediatek driver auto installer <link is provided>

    5 - SP flash tool <link is provided>

    6 - a usb cable (of course there is no download link for this 😀)

    7 - Scatter File (WILL BE UPLOADED HERE IN COMMENTS)

    8 - Magisk Manager for your phone. (v.26.1) <from Github> (NOTE: ONLY DOWNLOAD & INSTALL 26.1, NOT 26.2, IT CAUSES BOOTLOOP! , But you can still use 26.2 if you will use the second method)

    9 - UNLOCK BOOTLOADER USING MTK CLIENT TOOL (No data wipe needed + STEPS WILL BE PROVIDED HERE TOO)

    10 - (IMPORTANT) MCT MTK BYPASS REV4/REV3 + <link is provided>

    11 - The preloader file : Here


    NOTE BEFORE STARTING : If links have problems or it is inaccessible , please tell me to send new links in comments .
    also ,
    MAKE SURE YOUR DEVICE IS UPDATED TO THE LATEST VERSION (A.46) BECAUSE IF YOU FLASHED THE BOOT.IMG (you will know what does this file do here later ) WHICH IT IS FOR THE LATEST UPDATE AND YOUR DEVICE IS OLDER THAN IT , YOUR DEVICE MAY BRICK , AND I AM NOT RESPONSIBLE FOR ANY DAMAGES FOR YOUR DEVICE

    but , if anything happens , tell me , I will help you .

    BIG ULTRA NOTE BEFORE STARTING : If you will share these guide/method or even your results in rooting this device in your website, your youtube video, or anything else , please DO NOT FORGET TO MENTION THE SOURCE !!!

    Also , before doing these steps , keep an eye on the new edits in the last / beginning of this thread.


    Let's start :)

    STAGE 1: PATCHING BOOT.IMG
    (skip this stage if you have preloader.bin file already and downloaded the boot.img that I patched), but download the ROM if you face a brick or any problem in your phone system


    1 - Download the latest frimware here

    2 - Choose the latest version (a.46)

    3 - After downloading and extracting the file , you will find many folders > Enter the folder (frimware) , find and copy the boot.img file to your phone

    4- patch it by magisk manager

    5 - copy the patched boot.img ( usually located in Downloads folder in your phone)to your pc
    ( note : you will need it later :))

    6 - replace the patched boot.img with the original one in the folder you have extracted the rom in ( but before it, please backup the original one in an external folder , and also change the patched boot.img to ( "boot.img")

    Note : I uploaded the boot.img file if you want to save time instead of downloading the whole rom !

    STAGE 2 : Installing MEDIATEK usb Drivers

    7- Open Mediatek driver auto installer

    8 - While the program is opening , a window appears which asks yo if you allow the installer to make changes ... blabla , just click allow (ok) and let the program do the trick, after it finishes, reboot your pc / laptop

    STAGE 3 : UNLOCKING BOOTLOADER

    (NOTE BEFORE STARTING : THERE IS NO DATA WILL BE LOST , AND DO NOT ENABLE THE OEM UNLOCK IN DEVELOPER OPTIONS , THE MTK CLIENT TOOL WILL GIVE AN ERROR DURING UNLOCKING , JUST KEEP IT DISABLED !!!!)



    8 - After the program installed the drivers , go to MTK CLIENT TOOL , choose the device name ("OPPO A5S") , choose "UNLOCK BOOTLOADER"

    *Edit : install usbDK drivers , choose your arch (64 or 86=32) < to know it simply go to settings, system and a screen will show up with your pc info. ignore the X i made 😅
    MTK CLIENT TOOOL.jpg

    9 - turn your phone off , and then press these keys (" VOLUME UP + VOLUME DOWN <<in the same time>> ") and plug your phone in using the usb cable , once you hear a sound from your pc ( the usb connection sound) , you can stop pressing , because the phone is in BROM mode ( the mode which u can flash a file/rom )

    10 - click "Start" button in MTK CLIENT TOOL in your pc , when you see messages appear on the right in the Mtk Client Tool , DON'T UNPLUG YOUR PHONE !!!!

    When the progress bar achieves 100% in the program and u see bootloader unlock = OK, unplug your phone and press power button , if you found a warning message while booting , so , unfortunately....

    YOU SUCCESSFULLY UNLOCKED YOUR BOOTLOADER !!!!! XD
    So , do not panic if it appears !
    The message will say (" your device is unlocked and cannot be trusted , rebooting in 5 seconds")

    <Note : It can be solved, check in replies for lk.img file and flash it as u were flashing a boot image>

    btw there is a guide for this : HERE


    and then another message appears (" dm-verity error,
    Your android system / device is corrupted, please select whether you want to boot in E10 mode or RESTART mode
    ")
    It will give you two choices , you SHOULD choose the RESTART mode by pressing VOLUME DOWN , and tadaaaa your phone is booting normally and the data DIDN'T LOST AT ALL!

    BIG ULTRA NOTE : IF THE WARNING MESSAGE DIDN'T APPEAR , SO YOUR BOOTLOADER ISN'T UNLOCKED Successfully , I ADVICE YOU TO DO THE STAGE 3 STEPS AGAIN AND KEEP AN EYE ON THE MESSAGES APPEARANCE ON THE RIGHT OF THE MTK CLIENT TOOOOL ( IF IT SHOWS THE DEVICE MODEL , THE PROCESSOR , etc ) after connection , let it do the magic (as the dm-verity message appears usually after unlocking bootloader)

    ***NEW EDIT : it seems that mtk client tool doesn't work with win 11 and some users of win10 for some reason...
    So I brought another method to unlock the bootloader using the terminal version

    1- open the folder mtkclient-main ( if it is not available, go to download mtk client for terminal from GitHub)

    2- open the cmd in the same directory of the mtk client-main folder (hint : type in the bar that shows the folder directories (cmd) and tadaaaaaaa

    2- type in the cmd pip3 install -r requirements.txt

    3- type again in the cmdpython setup.py install or python setup.py

    4- install usbDK from Here

    5- after mtk client has been installed, type this python mtk da seccfg unlock

    6- it will say waiting for device .. power off your phone and press vol up + vol down + release when connected, then let it do the magic✨
    When finishes, unplug it and continue these steps 👍
    (tell me if there is an error)

    STAGE 4 (IMPOOOOORTANNNNT):
    How to Bypass the next error message


    Screenshot 2023-04-07 045033.png

    1- open MCT MTK BYPASS (dowload link is in replies) , choose the chipset (MT6765 )

    2 - REBOOT your phone into brom mode ( vol up + vol down)

    3 - connect your device and click start , and done !
    Note : KEEEEEEEEEEEEEP YOUR DEVICE CONNECTED AND DO NOT DISCONNECT IT FROM YOUR PC

    Stage 5 ( the last stage) : Flashing

    1- open SP FLASH TOOL

    2 - locate the scatter file that I'll provide it in comments here !

    NOTE ABOUT THE SCATTER FILE : the scatter file which comes with the frimware is CORRUPTED , I've tried to fix it and it worked !
    because when I worked with this corrupted scatter file , it gave me an error while flashing !! , just editing it on my way has solved it anyway

    3 - you will see a list of many files , just untick EVERY THING EXCEPT FOR THE BOOT.IMG (Make sure it is the patched one) (+please locate the preloader.bin file but untick it)

    4 - BOOT your phone into brom mode (turn it off , press volume up + volume down , connect it with your pc)

    5- once you hear the usb connection sound from your pc , click on "DOWNLOAD" button , and wait until a correct sign (√) appears in a window

    6 - REBOOOOT
    7 - let's Celebrate! 🎉

    (*new edit : if sp flash tool shows you an error your device storage reached the end of life, bruuuuuuuh, just uncheck (checking the device status) from settings and retry flashing!



    Second way to Root oppo a5s :-

    I've just known that there is an unofficial twrp for this phone. We will use this to flash magisk.zip file to get root access if you don't want / flash a patched boot.img

    All we need are :

    • Some main requirements from the 1st way (SP flash tool + MCT MTK BYPASS REV4 + installation of Drivers + unlocked bootloader of your phone + preloader.bin) ((methods of unlocking bootloader is in the 1st way, go unlock your bootloader then flash twrp in the 2nd way here)

    • And new requirements :-

    -Twrp recovery 3.6.x(uploaded by Unofficial twrp website) : Here

    -Magisk 26.3.zip file ** ( sorry for giving a fake link, i changed it into github , just get the apk file from the link I give u just now and change it into .zip)

    (NOTE : after downloading, copy this zip file into your SD card)

    STAGE 1 : FLASHING TWRP

    1-
    Open Sp Flash Tool and MCT MTK BYPASS REV4

    2-
    in SP flash tool, locate recovery.img file that you downloaded + preloader.bin (NOTE: UNTICK preloader.bin)

    3- in MCT MTK BYPASS REV4, select the chipset (MT6765)

    4- boot your phone into BROM mode (vol.up + vol.down + release when connected)

    5- in MCT MTK BYPASS REV4, Click "bypass"

    6- after it succeeds, Go to SP flash tool and click download

    7- after it shows a correct sign (), disconnect your phone and boot into recovery (vol.down + power button)

    8- TWRP splash screen shows up !

    STAGE 2 : FLASH MAGISK 26.3 * !

    1- click "install" button

    2- locate the zip file place

    3- disable zip verification (if needed)

    4- after it succeeds, boot your phone normally and you have got root access!!

    NOTE : ISSUES THAT YOU MAY FACE IN TWRP

    1- there is no MTP
    2- it doesn't detect your internal storage
    3- it may not mount some partitions like /data and /odm
    4- you tell me




    --thanks to the user @Anonymous V for being online when i applied these steps , he was answering every question i ask.

    -- if you want anything , or need some help , type in comments here , I and Anonymous V will be available (note that I won't be online for every day ...)



    ** Please support me to continue my work here. I love you : Buy me a coffee

    (First time typing a thread😅)


    IMPORTANT NOTE : Please put the boot.img + preloader.bin + the scatter file in a folder/ recovery.img + preloade.bin + scatter file, then locate the scatter file using SP Flash Tool, Untick the preloader.bin to avoid bricking the device

    ALSO , PLEASE DO NOT PUT THE BOOT.IMG AND THE SCATTER FILE
    / RECOVERY.IMG AND FLASH THE BOOT.IMG/RECOVERY WHILE PRELOADER.BIN IS NOT AVAILABLE IN THE SAME FOLDER/NOT LOCATED , AN ERROR WILL APPEAR (
    ERROR_INVALID_PRELOADER)
    REPEAT : DO NOT FLASH PRELOADER.BIN , ONLY PUT IT IN THE SAME FOLDER WITH THE PATCHED BOOT.IMG/ TWRP RECOVERY.IMG AND SCATTER FILE, LOCATE THE PRELOADER FILE , UNTICK IT AND FLASH ONLY BOOT.IMG/RECOVERY.IMG AS YOU LIKE



    Thanks for @jimenezshown for providing this info !






    NEW edit :

    Guys, if u read this, i want to announce that *26K people saw this thread!🎉🎉
    and because of this, wait for a new custom rom for this device after some months (I will be back to school 💀)
    **I need a team to work on this, if u want to join, just tell me Here in this thread and i will ask u some simple questions, this is not an test but i want to see if u are experienced or semi- experienced , both are acceptable)


    check this thread, there i will send the link of the ROM thread !

    (EDIT) Also, if you want to be mentioned after the ROM is built successfully, send a post there !

    but actually, i am too sad ):

    because I said if u will share this to your YouTube video, blog, or website,
    YOU SHOULD MENTION THE SOURCE
    i spotted someone on youtube called jpservicell got the full way to root this device from my thread, and he did not even mention the source in the video,a comment, or a description:mad:


    ****** ANNOUNCEMENT: Guys, I won't be active as I was on XDA after September 1st, so please if you have a question/problem, tell me before this day comes !
    =============================================
    Thank you,
    ╭━━━━┳━━━┳━━━┳━━━┳━━━╮
    ╰━━╮━┃╭━╮┃╭━╮┃╭━╮┃╭━╮┃
    ╱╱╭╯╭┫┃╱╰┫┃┃┃┃╰━╯┃╰━╯┃
    ╱╭╯╭╯┃┃╭━┫┃┃┃┃╭━╮┣━━╮┃
    ╭╯━╰━┫╰┻━┃╰━╯┃╰━╯┣━━╯┃
    ╰━━━━┻━━━┻━━━┻━━━┻━━━╯
    2
    If it is aarch64 then it is same as ARM64
    ohh so i can flash this arm644 image
    2
    hello, How yall doin?

    I confirmed after a readback that the bypass verified boot is enabled method in this guide works and I was able to write in the protected area. Now it still shows Download not completed when I try to boot and in a stale state. After carefully examining the readback after flashing, I found that only the following partitions are empty:

    boot_para
    odm
    otp
    flashinfo
    sgpt

    If you have the phone with you can you confirm after a readback that these partitions are supposed to be empty. And if not empty then I ask of you to please share the images. I think after this i will be able to finally unbrick my phone.

    Thanks to both @ZG089 and @Anonymous V for supporting me through this.
    2
    i think i learned my lesson which is " if its a no its a no "
    Hey
    I made a funny problem
    I was contacting @ARUsmani on whatsapp
    I told him" I am ZG089 from XDA"
    He told me " what a nice name , you said u are from XDA 🙂"
    2
    Dio you still need it bro? Sorry for late response, been busy for this past weeks.
    its ok now bro here try this flash it normally then boor it up REMEMBER WHEN THE SCREEN IS BLACK AFTER BOOTING RECOVERY PRESS THE POWER BUTTON AT LEAST 3 TIMES TO OPEN THE RECOVERY