• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!
  • Fill out your device list and let everyone know which phones you have!    Edit Your Device Inventory

[GUIDE] UNBRICK/DOWNGRADE YOUR REALME 6/6I(INDIA)/6S USING SPFLASH TOOL FOR FREE!

Search This thread

daeSundae

Senior Member
Jan 13, 2021
66
21
Hello everyone! So after the new mediatek DAA and SLA protection bypasses you can find github repo of here , using the bypass we are able to use SPFlash Tool, here is a guide how you can do it! This guide is for RMX2001, RMX2002 and RMX2003 ONLY. DON'T DO ANY OF THESE IF YOU HAVE SOMETHING ELSE!

PLEASE SEE "TROUBLESHOOTING" AT THE END OF THE GUIDE FIRST IF YOU HAVE PROBLEMS IN THE PROCESS BEFORE ASKING!


ALWAYS USE DOWNLOAD ONLY MODE OF SP FLASH TOOL.
DON'T TOUCH ANYTHING RELATED TO FORMAT ON SP FLASH TOOL! (IT'S WRITTEN EVERYWHERE, YOU WILL LOSE YOUR IMEIS IF YOU USE FORMAT ALL + DOWNLOAD. YOU ARE SAFE IF YOU USE DOWNLOAD ONLY.)


VIDEO GUIDES



FOR LINUX METHOD CLICK HERE - Credits to @bx2_nero

Windows Method

Requirements:
Bypass Tools Pack - (SPFLASH TOOL, DRIVER AND BYPASS FILES)

Decrypted OFP (OPPO FIRMWARE PACKAGE) Files:

FULL FIRMWARE - INCLUDES THE "USERDATA" PARTITION, HENCE LARGER.
B.53 - Mega - Google Drive - Mirror3
B.37 - Mega - Google Drive - Google Drive 2
B.23 (First RUI Update for the device) - Mega - Google Drive - Mirror3
A.50[EU] - Mega - Google Drive
A.42[EU] - Google Drive - Mirror2


NOU (NO USERDATA) FIRMWARE - FOR PEOPLE WITH LIMITED DATA PLAN.
B.53 - Google Drive - Mirror 2
B.37 - Google Drive - Mirror 2
B.23 - Google Drive - Mirror 2
A.50[EU] - Mega - Google Drive
A.42[EU] - Google Drive - Mirror2

Please read an explanation of what is userdata partition and how different is this from other firmware here.
Note: All files with available links above are tested.

Python (Must add to PATH during installation, see screenshot if you don't understand)
libusb-win32 - Having Issues? Use this.

aaf0ca5590e6884c234b1.png

Make sure to choose the last option.
1)Open command prompt by running cmd,
enter
python -m pip install pyusb pyserial json5
1611352854113.png

After the installation, you can re-run the command. If it looks like the screenshot above you're ready to go to next step.

after the installation leave CMD.
2) Go to driver folder, find the .inf file right click and press install.
1611352830350.png

3)Download this file and install it, after installing plug your phone to PC by connecting your phone to PC while doing Vol+- . You might need this driver as well if it's not detected.

3a6d351fec8ab9961a5e3.png

Press next, connect your device to PC while holding Vol+- buttons (your device needs to be powered off) and you will see the mtkdriver down below. Install it.
310b8508659201f6729f7.png

Choose MediaTek USB Port and install it.
4)Turn off your phone and again connect to PC while holding Vol+- buttons then run the brom.bat under Bypass folder. If it says "Protection Disabled" in the end you're ready to go on. (If it's like the screenshot below go on.)
1611391901952.png

If you had a problem here, please check the end of the guide for it's fix.

5)Go into Flash Tool folder and open the SPFlash tool, after that choose scatter file and also if not set, set your download -agent. You don't need to select auth file as authorization is disabled. Once you do it, it should look like this. ALWAYS MAKE SURE DOWNLOAD ONLY MODE IS SELECTED! DON'T SELECT OTHER MODES!

1611929163628.png

Click choose DA Agent. (I uploaded an updated bypass tools pack, if you're using older download new one) Go into Bypass Tools Pack > Verified Boot Fix > Choose the "DA_6765_6785_6768_6873_6885_6853.bin" file.

If its giving error go into Options menu and disable option shown below. You will be able to choose a DA file.
1611928718706.png


73cff8e3aa78249f2d298.png

Make SURE "Download Only" is selected. Don't select ANYTHING ELSE! You will lose your IMEIs, Serial Numbers, Capability of Hardware Attestation etc. if you choose "Format data + Download" make SURE you selected "Download Only".
1f97e3897519622afb94d.png


After flashing it should look like this. Download has been complete. Enjoy!

Now, you can start downloading with the button and after that a checkmark will appear. You can reboot your phone and use it like before now! All your userdata will (inevitably) be cleared!

POSSIBLE ERROR: "Verified boot enabled."
1611478791612.png


There are 2 fixes to this.
1st Method (DIRECT FIX):
1611929163628.png

Click choose DA Agent. (I uploaded an updated bypass tools pack, if you're using older download new one) Go into Bypass Tools Pack > Verified Boot Fix > Choose the "DA_6765_6785_6768_6873_6885_6853.bin" file.

If its giving error go into Options menu and disable option shown below. You will be able to choose a DA file.
1611928718706.png


2nd Method (WORKAROUND):
If you're getting this error, and you are SURE you used "Download Only" mode, there's a way to get rid of this. First, load the scatter then untick/deselect partitions listed below.

opporeserve2,
cdt_engineering,
my_custom,
special_preload,
userdata,
super,

After running brom.bat and flashing all partitions except the ones listed above, your phone will be able to reboot to stock recovery. Now select " Power Off" option then go run brom.bat, bypass authorization and then flash partitions listed below from SPFlash Tool.

super,
dtbo,
userdata

Your device will be able to boot into system after this if you have followed steps correctly.

POSSIBLE ERROR: Issues while disabling protection;


1611392223180.png

Power off your device Restart the process from 2nd step.

POSSIBLE ERROR: Issues while flashing;
1611392834527.png


Power off your device, you will need to do the bypass again. Check your USB Cable, there might be a disconnection. If not, start from 3rd step and make sure you did everything right.

So, welcome to hell(!).

For people who want to downgrade:
If you want to downgrade to any version you would like, just use the B23 file as it is the oldest ofp file i could find for extracting process. If you were on EU version before (Any version starting with A) download ozip from here(for EU) , here(for Global) and manually flash from Realme UI recovery and format your data. Your device will be back at A.XY firmware with EU features (No heytap, no ads, no theme store, no bloatware) you had before.

For people on EU who want to unbrick:
So, you can use any version starting with B and it should work. It works in my case, i was on A.48, i flashed B53 and over that flashed B23. No probs at all. If you want to return to EU rom (starting with A) download ozip from here and manually flash from Realme UI recovery and format your data. Your device will be back at A.XY firmware with EU features (No heytap, no ads, no theme store, no bloatware) you had before.

Thanks --
https://github.com/bkerler/oppo_decrypt for decryptor.
https://github.com/MTK-bypass for creating the tool.
 

Attachments

  • 1611479854911.png
    1611479854911.png
    73.4 KB · Views: 3,422
Last edited:

daeSundae

Senior Member
Jan 13, 2021
66
21
Thank you for your efforts. Can you add the decrypted A34 file?
Hello! I wasn't able to find factory package (ofp) files for any version that makes sense for versions starting with A. (EU). There are A11 and A08 which according to update trackers, did never exist and the A.11 package is %50 larger than all the other files weirdly. I have contacted owner of some sites that do upload files like these and they asked for money. If it's a resonable price i will get it, decrypt it and upload here! If you were able to find any versions starting with A, feel free to message me on telegram (@ctivity) or email me!
 

daeSundae

Senior Member
Jan 13, 2021
66
21
Hi, I have a website that publishes A24 version only. https://www.getdroidtips.com/realme-6-software-update/. It gives an error when I do unbrick with a different version, when my phone was brick the version was A34.
Hello again. According to the site you have just sent, A.11 is the first update to EU version. I was thinking it was a mistakenly uploaded file, since userdata partitions are for some reason 9gb with this one instead of 3. If you Downgrade to A11 using SPFLASH tool and this guide and after that install any version included here using recovery, it will work. Unfortunately, these files you sent in the link are ozip files and update packages while ofp files are firmware packages and they include everything. There are only 2 ofps -decrypted and not decrypted- available for now starting with A(EU), A08 (first ever firmware for EU) and A11(first update to EU version).
 

cmfan

Member
Dec 13, 2011
29
8
If you Downgrade to A11 using SPFLASH tool and this guide and after that install any version included here using recovery, it will work.
First of all, thank you daeSundae for posting this info here!

Have you actually tried to flash the decrypted A.11 version? I did according to your guide. Everything went fine including the green checkmark after successful flash.

Then I held the phone's power button until it vibrated once, like a normal boot up. However the phone remained black and seems nearly completely dead now. It doesn't react to any key combinations (including Vol+-) and Windows reports a malfunctioning unrecognizable device.
Linux shows a device that identifies as "18d1:d001 Google Inc. Nexus 4 (fastboot)".
Fastboot does not recognize the device, adb however does, showing the correct S/N and state unauthorized, thus it doesn't accept any commands.
So the USB controller seems to be still alive, but nothing more.

To be clear: I don't blame you in any way, I'm just trying to provide information to step forward! So, what was your experience on A.11?
 

daeSundae

Senior Member
Jan 13, 2021
66
21
First of all, thank you daeSundae for posting this info here!

Have you actually tried to flash the decrypted A.11 version? I did according to your guide. Everything went fine including the green checkmark after successful flash.

Then I held the phone's power button until it vibrated once, like a normal boot up. However the phone remained black and seems nearly completely dead now. It doesn't react to any key combinations (including Vol+-) and Windows reports a malfunctioning unrecognizable device.
Linux shows a device that identifies as "18d1:d001 Google Inc. Nexus 4 (fastboot)".
Fastboot does not recognize the device, adb however does, showing the correct S/N and state unauthorized, thus it doesn't accept any commands.
So the USB controller seems to be still alive, but nothing more.

To be clear: I don't blame you in any way, I'm just trying to provide information to step forward! So, what was your experience on A.11?
Hello! I'm sorry for the inconvenience I have tried flashing A11 file and it caused several problems just like in your case, however if you didn't select "Format All+ Download" mode you should be able to recover your phone. So, I had the exact same issue today and due to that I will be removing the A11 file from the links. Also, never forget to select Download Mode only! Several people bricked today and their IMEIs, Serial Numbers are all gone! Never select anything else than Download Mode!

So the solution is to download B53 decrypted files, load the scatter and untick listed partitions

opporeserve
,cdt-engineering,
mycustom,
special-preload,
userdata,
super

and then start the flashing in download mode. Now, you might be wondering "How am I going to go into the download mode again?" It's very simple. All you have to do is to keep pressing on Power and Vol- for some time and then, connecting to the pc with both volume buttons pressed while brom.bat is running. If you get an error, just reinstall device filters and that should fix the problem, then you can start downloading. After downloading these partitions to the phone, you will be able to see a boot animation and as well as a realme logo. Reboot to recovery, power of your device and then go into download mode again and flash userdata, dtbo and super partitions this time around. It should boot into system. However, the version will be B.53 but you can use the latest ozip (A.48), flash it from recovery and then format your data. It will bring you back to EU version.
 
Last edited:

daeSundae

Senior Member
Jan 13, 2021
66
21
First of all, thank you daeSundae for posting this info here!

Have you actually tried to flash the decrypted A.11 version? I did according to your guide. Everything went fine including the green checkmark after successful flash.

Then I held the phone's power button until it vibrated once, like a normal boot up. However the phone remained black and seems nearly completely dead now. It doesn't react to any key combinations (including Vol+-) and Windows reports a malfunctioning unrecognizable device.
Linux shows a device that identifies as "18d1:d001 Google Inc. Nexus 4 (fastboot)".
Fastboot does not recognize the device, adb however does, showing the correct S/N and state unauthorized, thus it doesn't accept any commands.
So the USB controller seems to be still alive, but nothing more.

To be clear: I don't blame you in any way, I'm just trying to provide information to step forward! So, what was your experience on A.11?

So, i just read your reply again.



"Then I held the phone's power button until it vibrated once, like a normal boot up. However the phone remained black and seems nearly completely dead now. It doesn't react to any key combinations (including Vol+-) and Windows reports a malfunctioning unrecognizable device."

i dont think it's an issue caused by the device. Can you install oppo drivers from this link and let me know what happens afterwards? Or if you're fast enough you might prefer going into device manager by right clicking on Windows button and uninstall it's driver? I will also request you to start from step 2 to ensure installing drivers. I had the same black screen but my Windows was able to detect the Download Mode when i connected while both volume buttons pressed.
 
Last edited:

cmfan

Member
Dec 13, 2011
29
8
I had the same black screen but my Windows was able to detect the Download Mode when i connected while both volume buttons pressed.

Well, good to hear, that your phone survived the faulty firmware. Although I select Download only of course I can't reach download mode any more. It is completely dead, Holding whatever combinations for even a minute doesn't have any effect. Normally you can force a reboot by holding Power and Vol+ for 10-15 seconds. If you keep holding it'll reboot, if you release both keys immediately after the screen went black it stays powered off. That's how I could escape the previous bootloop.

I've tried removing all devices and drivers and reinstalling them as per your guide, alas to no avail. My second, still intact phone (stock, unrooted), identifies in download mode as "USB serial device" on Windows and as "Mediatek Inc. MT6227 Phone" on Linux. The bricked always identifies as "Google Inc. Nexus 4 (fastboot)" throughout (buttons pressed or not).

It's a shame I didn't have the idea of unbricking with a B region firmware and flashing the A region later through recovery, because then I wouldn't have tried the untested A.11, but taken the verified route instead.
 

daeSundae

Senior Member
Jan 13, 2021
66
21
Well, good to hear, that your phone survived the faulty firmware. Although I select Download only of course I can't reach download mode any more. It is completely dead, Holding whatever combinations for even a minute doesn't have any effect. Normally you can force a reboot by holding Power and Vol+ for 10-15 seconds. If you keep holding it'll reboot, if you release both keys immediately after the screen went black it stays powered off. That's how I could escape the previous bootloop.

I've tried removing all devices and drivers and reinstalling them as per your guide, alas to no avail. My second, still intact phone (stock, unrooted), identifies in download mode as "USB serial device" on Windows and as "Mediatek Inc. MT6227 Phone" on Linux. The bricked always identifies as "Google Inc. Nexus 4 (fastboot)" throughout (buttons pressed or not).

It's a shame I didn't have the idea of unbricking with a B region firmware and flashing the A region later through recovery, because then I wouldn't have tried the untested A.11, but taken the verified route instead.
Well, as far as my knowledge goes BROM is burnt onto SoC and cannot fall into an inaccessible state. You should still be able to do access download mode even if that firmware was corrupt. Do you know if your phone has any charge or not? Can you try different volume and key combinations? A broken firmware shouldn't make the BROM Download mode inaccessible.
 
Last edited:

daeSundae

Senior Member
Jan 13, 2021
66
21
Well, good to hear, that your phone survived the faulty firmware. Although I select Download only of course I can't reach download mode any more. It is completely dead, Holding whatever combinations for even a minute doesn't have any effect. Normally you can force a reboot by holding Power and Vol+ for 10-15 seconds. If you keep holding it'll reboot, if you release both keys immediately after the screen went black it stays powered off. That's how I could escape the previous bootloop.

I've tried removing all devices and drivers and reinstalling them as per your guide, alas to no avail. My second, still intact phone (stock, unrooted), identifies in download mode as "USB serial device" on Windows and as "Mediatek Inc. MT6227 Phone" on Linux. The bricked always identifies as "Google Inc. Nexus 4 (fastboot)" throughout (buttons pressed or not).

It's a shame I didn't have the idea of unbricking with a B region firmware and flashing the A region later through recovery, because then I wouldn't have tried the untested A.11, but taken the verified route instead.
Oh wait. Is it identifying as fastboot? Then you should be able to (even if you don't have USB debugging authorization) use minimal ADB and fastboot tools to
use "fastboot reboot" command. Please keep pressing vol - button if you can while rebooting if it works. That should, if possible reboot you into recovery.

Also as you said, keeping pressing on power and vol+ buttons don't work in this state. In fact, in this state nothing visually works, there is no screen output and I'm actually pretty sure it's the same for begonia (RN8 PRO). You will need to ~ if it's detecting it as a fastboot device need to use minimal ADB and fastboot tools to get rid of that state. I didn't have the same issue as you though. While I was in same state, I kept on pressing on Vol - and Power buttons for around 30-40 seconds (obviously without a response from the device) and after that pressed both volume buttons and connected device to PC. Can you also try when your device powers off? Because clearly currently your device isn't powered off and cannot be powered off until the battery dies or you can somehow manage to escape from current situation.
 
Last edited:

cmfan

Member
Dec 13, 2011
29
8
Thank you daeSundae for helping me, I really appreciate that. So, what do we have:
Well, as far as my knowledge goes BROM is burnt onto SoC and cannot fall into an inaccessible state. You should still be able to do access download mode even if that firmware was corrupt.
Sounds reasonable and I hope it's true. :)
Do you know if your phone has any charge or not? Can you try different volume and key combinations?
The phone was fully charged when it bricked, so yes, the battery will last several days I fear, esp. without driving the display.

Three buttons make 7 possible combinations. I've tried them all, pressing, holding and holding while connecting USB. No reaction at all, unfortunately.
Oh wait. Is it identifying as fastboot? Then you should be able to (even if you don't have USB debugging authorization) use minimal ADB and fastboot tools to use "fastboot reboot" command.
This is kind of weird. The phone identifies as USB ID 18d1:d001 on Linux which is said fastboot device. fastboot does not see it, only adb does. But maybe it justs sees the device, lists it, but cannot communicate otherwise with it. I guess if the device was just silent (or dead) adb would assume unauthorized, in lack of any other behavior.

Window btw does not accept the device at all and lists an "Unknown USB Device (Invalid Configuration Descriptor)".
Can you also try when your device powers off? Because clearly currently your device isn't powered off and cannot be powered off until the battery dies or you can somehow manage to escape from current situation.
Sound also reasonable, however waiting for the battery to drain may last a very long time. I am out of ideas on how to force a power off otherwise (apart from sacrificing hardware integrity and disconnecting the battery of course)

Man, do I miss the old days when a ZergRush was all you needed to root and problems like this were solved by pulling the removable battery... :cool:
 

daeSundae

Senior Member
Jan 13, 2021
66
21
Thank you daeSundae for helping me, I really appreciate that. So, what do we have:

Sounds reasonable and I hope it's true. :)

The phone was fully charged when it bricked, so yes, the battery will last several days I fear, esp. without driving the display.

Three buttons make 7 possible combinations. I've tried them all, pressing, holding and holding while connecting USB. No reaction at all, unfortunately.

This is kind of weird. The phone identifies as USB ID 18d1:d001 on Linux which is said fastboot device. fastboot does not see it, only adb does. But maybe it justs sees the device, lists it, but cannot communicate otherwise with it. I guess if the device was just silent (or dead) adb would assume unauthorized, in lack of any other behavior.

Window btw does not accept the device at all and lists an "Unknown USB Device (Invalid Configuration Descriptor)".

Sound also reasonable, however waiting for the battery to drain may last a very long time. I am out of ideas on how to force a power off otherwise (apart from sacrificing hardware integrity and disconnecting the battery of course)

Man, do I miss the old days when a ZergRush was all you needed to root and problems like this were solved by pulling the removable battery... :cool:
Can you try ADB reboot command on Linux? As it is identifying as a fastboot device?
 

daeSundae

Senior Member
Jan 13, 2021
66
21
The phone was fully charged when it bricked, so yes, the battery will last several days I fear, esp. without driving the display.

This is kind of weird. The phone identifies as USB ID 18d1:d001 on Linux which is said fastboot device. fastboot does not see it, only adb does. But maybe it justs sees the device, lists it, but cannot communicate otherwise with it. I guess if the device was just silent (or dead) adb would assume unauthorized, in lack of any other behavior.

Window btw does not accept the device at all and lists an "Unknown USB Device (Invalid Configuration Descriptor)".
If it's detecting a fastboot device, the device isn't dead. What I'm guessing is that your device is working, and on fastboot mode but since there's no display output in this state it will only show a black screen. Can you do ADB devices command? Im guessing adb reboot requires authorization though, but it's worth trying. What I will be requesting from you is to try pressing (and keep pressing on) different key combinations while device is in that state for like a minute or so, for example keep pressing on Vol- and power for a minute then switch to Power and Vol+ for a minute and then keep pressing on both volume buttons and connect device. Can you also see the results after plugging your device into charge and letting it stay for around a minute? I know these might make no sense technically, but in my opinion randomness is your best friend to get rid of situations like this..
 

daeSundae

Senior Member
Jan 13, 2021
66
21
Thank you daeSundae for helping me, I really appreciate that. So, what do we have:

Sounds reasonable and I hope it's true. :)

The phone was fully charged when it bricked, so yes, the battery will last several days I fear, esp. without driving the display.

Three buttons make 7 possible combinations. I've tried them all, pressing, holding and holding while connecting USB. No reaction at all, unfortunately.

This is kind of weird. The phone identifies as USB ID 18d1:d001 on Linux which is said fastboot device. fastboot does not see it, only adb does. But maybe it justs sees the device, lists it, but cannot communicate otherwise with it. I guess if the device was just silent (or dead) adb would assume unauthorized, in lack of any other behavior.

Window btw does not accept the device at all and lists an "Unknown USB Device (Invalid Configuration Descriptor)".

Sound also reasonable, however waiting for the battery to drain may last a very long time. I am out of ideas on how to force a power off otherwise (apart from sacrificing hardware integrity and disconnecting the battery of course)

Man, do I miss the old days when a ZergRush was all you needed to root and problems like this were solved by pulling the removable battery... :cool:
Hello. again. So, i have asked few people about your situation. Conclusion is, if none of these work you will need to wait until battery wears off and device turns itself off, i'm afraid. I will ask you to not use your phone for like a day and not to keep it connected to a computer for a long time. After making sure it powered off (which, i'm guessing there is actually no way to do that) make sure to prepare the brom.bat file plug in your device with VOL+ - combo and go on. Before doing this make sure to Device Manager > Action > Add Legacy Hardware > Next > Install the hardware that I manually select from a list (Advanced) > Show All Devices > Have Disk > Choose the cdc-acm.inf > Choose Mediatek USB Port and install it to not waste time. I hope your problems will be fixed. I have confirmed that BROM mode shouldn't fall into an inaccessible state because there's no efuse.ini blown. It must be there, but you're probably stuck in a mode that doesn't allow doing anything for some reason.
 
  • Like
Reactions: Crazy_xcx

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    It is firmware for the device you mentioned, RMX2040, hence, yes.
    OMG, thank you very much. without your help and tutorial I can't bring my phone back from the dead. God bless Mabuhay
  • 14
    Hello everyone! So after the new mediatek DAA and SLA protection bypasses you can find github repo of here , using the bypass we are able to use SPFlash Tool, here is a guide how you can do it! This guide is for RMX2001, RMX2002 and RMX2003 ONLY. DON'T DO ANY OF THESE IF YOU HAVE SOMETHING ELSE!

    PLEASE SEE "TROUBLESHOOTING" AT THE END OF THE GUIDE FIRST IF YOU HAVE PROBLEMS IN THE PROCESS BEFORE ASKING!


    ALWAYS USE DOWNLOAD ONLY MODE OF SP FLASH TOOL.
    DON'T TOUCH ANYTHING RELATED TO FORMAT ON SP FLASH TOOL! (IT'S WRITTEN EVERYWHERE, YOU WILL LOSE YOUR IMEIS IF YOU USE FORMAT ALL + DOWNLOAD. YOU ARE SAFE IF YOU USE DOWNLOAD ONLY.)


    VIDEO GUIDES



    FOR LINUX METHOD CLICK HERE - Credits to @bx2_nero

    Windows Method

    Requirements:
    Bypass Tools Pack - (SPFLASH TOOL, DRIVER AND BYPASS FILES)

    Decrypted OFP (OPPO FIRMWARE PACKAGE) Files:

    FULL FIRMWARE - INCLUDES THE "USERDATA" PARTITION, HENCE LARGER.
    B.53 - Mega - Google Drive - Mirror3
    B.37 - Mega - Google Drive - Google Drive 2
    B.23 (First RUI Update for the device) - Mega - Google Drive - Mirror3
    A.50[EU] - Mega - Google Drive
    A.42[EU] - Google Drive - Mirror2


    NOU (NO USERDATA) FIRMWARE - FOR PEOPLE WITH LIMITED DATA PLAN.
    B.53 - Google Drive - Mirror 2
    B.37 - Google Drive - Mirror 2
    B.23 - Google Drive - Mirror 2
    A.50[EU] - Mega - Google Drive
    A.42[EU] - Google Drive - Mirror2

    Please read an explanation of what is userdata partition and how different is this from other firmware here.
    Note: All files with available links above are tested.

    Python (Must add to PATH during installation, see screenshot if you don't understand)
    libusb-win32 - Having Issues? Use this.

    aaf0ca5590e6884c234b1.png

    Make sure to choose the last option.
    1)Open command prompt by running cmd,
    enter
    python -m pip install pyusb pyserial json5
    1611352854113.png

    After the installation, you can re-run the command. If it looks like the screenshot above you're ready to go to next step.

    after the installation leave CMD.
    2) Go to driver folder, find the .inf file right click and press install.
    1611352830350.png

    3)Download this file and install it, after installing plug your phone to PC by connecting your phone to PC while doing Vol+- . You might need this driver as well if it's not detected.

    3a6d351fec8ab9961a5e3.png

    Press next, connect your device to PC while holding Vol+- buttons (your device needs to be powered off) and you will see the mtkdriver down below. Install it.
    310b8508659201f6729f7.png

    Choose MediaTek USB Port and install it.
    4)Turn off your phone and again connect to PC while holding Vol+- buttons then run the brom.bat under Bypass folder. If it says "Protection Disabled" in the end you're ready to go on. (If it's like the screenshot below go on.)
    1611391901952.png

    If you had a problem here, please check the end of the guide for it's fix.

    5)Go into Flash Tool folder and open the SPFlash tool, after that choose scatter file and also if not set, set your download -agent. You don't need to select auth file as authorization is disabled. Once you do it, it should look like this. ALWAYS MAKE SURE DOWNLOAD ONLY MODE IS SELECTED! DON'T SELECT OTHER MODES!

    1611929163628.png

    Click choose DA Agent. (I uploaded an updated bypass tools pack, if you're using older download new one) Go into Bypass Tools Pack > Verified Boot Fix > Choose the "DA_6765_6785_6768_6873_6885_6853.bin" file.

    If its giving error go into Options menu and disable option shown below. You will be able to choose a DA file.
    1611928718706.png


    73cff8e3aa78249f2d298.png

    Make SURE "Download Only" is selected. Don't select ANYTHING ELSE! You will lose your IMEIs, Serial Numbers, Capability of Hardware Attestation etc. if you choose "Format data + Download" make SURE you selected "Download Only".
    1f97e3897519622afb94d.png


    After flashing it should look like this. Download has been complete. Enjoy!

    Now, you can start downloading with the button and after that a checkmark will appear. You can reboot your phone and use it like before now! All your userdata will (inevitably) be cleared!

    POSSIBLE ERROR: "Verified boot enabled."
    1611478791612.png


    There are 2 fixes to this.
    1st Method (DIRECT FIX):
    1611929163628.png

    Click choose DA Agent. (I uploaded an updated bypass tools pack, if you're using older download new one) Go into Bypass Tools Pack > Verified Boot Fix > Choose the "DA_6765_6785_6768_6873_6885_6853.bin" file.

    If its giving error go into Options menu and disable option shown below. You will be able to choose a DA file.
    1611928718706.png


    2nd Method (WORKAROUND):
    If you're getting this error, and you are SURE you used "Download Only" mode, there's a way to get rid of this. First, load the scatter then untick/deselect partitions listed below.

    opporeserve2,
    cdt_engineering,
    my_custom,
    special_preload,
    userdata,
    super,

    After running brom.bat and flashing all partitions except the ones listed above, your phone will be able to reboot to stock recovery. Now select " Power Off" option then go run brom.bat, bypass authorization and then flash partitions listed below from SPFlash Tool.

    super,
    dtbo,
    userdata

    Your device will be able to boot into system after this if you have followed steps correctly.

    POSSIBLE ERROR: Issues while disabling protection;


    1611392223180.png

    Power off your device Restart the process from 2nd step.

    POSSIBLE ERROR: Issues while flashing;
    1611392834527.png


    Power off your device, you will need to do the bypass again. Check your USB Cable, there might be a disconnection. If not, start from 3rd step and make sure you did everything right.

    So, welcome to hell(!).

    For people who want to downgrade:
    If you want to downgrade to any version you would like, just use the B23 file as it is the oldest ofp file i could find for extracting process. If you were on EU version before (Any version starting with A) download ozip from here(for EU) , here(for Global) and manually flash from Realme UI recovery and format your data. Your device will be back at A.XY firmware with EU features (No heytap, no ads, no theme store, no bloatware) you had before.

    For people on EU who want to unbrick:
    So, you can use any version starting with B and it should work. It works in my case, i was on A.48, i flashed B53 and over that flashed B23. No probs at all. If you want to return to EU rom (starting with A) download ozip from here and manually flash from Realme UI recovery and format your data. Your device will be back at A.XY firmware with EU features (No heytap, no ads, no theme store, no bloatware) you had before.

    Thanks --
    https://github.com/bkerler/oppo_decrypt for decryptor.
    https://github.com/MTK-bypass for creating the tool.
    2
    bro can we use this method to revert back from latest b59 firmware in realme 6
    Yes obviously !
    1
    Hello again. Yes, I noticed there was an ozip file and deleted it.
    1
    No, I'm not Dinolek. I just talked to him and he accepted my instructions. Let the screenshots lie, I don't mind.
    1
    It is firmware for the device you mentioned, RMX2040, hence, yes.
    OMG, thank you very much. without your help and tutorial I can't bring my phone back from the dead. God bless Mabuhay