How To Guide Unlock bootloader in 1sec and root (magisk) without custom recovery

[miaochenxi]

May not work for all devices, use at your own risk​

Preparation​

We are going to do it on Windows, if you use Mac or Linux, please read the corresponding tutorial here.
First of all you should install Magisk 24.1+ and patch boot.img through magisk app. Then copy the patched img file to your PC, it will be used soon.

Now follow the steps:

1. Install python(3.9 recommended) and git.
2. Clone the repository and install the dependencies:

git clone https://github.com/bkerler/mtkclient.git
cd mtkclient
pip install -r requirements.txt

3. Install UsbDk x64.
4. Turn off your phone and connect your phone to pc with usb cable.
5. Run command python mtk_gui in CMD or Powershell, make sure to locate to mtkclient directory before you run command.
6. Now hold volume down + power button till you see phone detected in the GUI or CMD/Powershell. Then you could release the buttons.

After the device info initialized you can see:

​

Now let's unlock bootloader:​

If you have unlocked just skip and go to magisk root tutorial at the last.

Go to Flash Tools , you can see Unlock bootloader , click it. Your phone would be unlocked in 1sec.
You will getting a dm-verity warn when booting, just press the power button to continue. This warn could disappear by clean flash a ROM.
It's RECOMMENDED to do a clean flash after unlock, using MiFlash (Do not lock again). Then install Magisk and root your phone.


Now let's root the phone:

1. Rename your patched boot image to xxxx.bin, for example: magisk_patched_boot.img -> magisk_patched_boot.bin
2. Go to Write Partitions
3. Find boot_a and boot_b, set both of their values to the path of magisk_patched_boot.bin
4. Click Write Partitions button at the top right.
5. Wait until the progress goes to 100%.
6. Close the window, disconnect the phone. Long press power button to reboot.

If you did everything correctly and it still boot loop, try to use mtkclient to read boot_a partition, then patch it and flash it.
Now your phone should boot successfully with magisk root.

 

[e8hffff]

The big question now is should people wait for MIUI 13? New update may include new drivers and kernel. The rooting and or breaking checksums may break the OTA updates?

 

[thaw26]

will it work on evergo?
in the picture it show dimensity 700 5g.
And can i unlock bootloader by fastboot?
Im in loop with fastboot.

 

[miaochenxi]

will it work on evergo?
in the picture it show dimensity 700 5g.
And can i unlock bootloader by fastboot?
Im in loop with fastboot.

works. You can use the tool to unlock bl

 

[Raghs99]

doesnt work for Mi Note 11T. Cant unlock bootloader.

 

[jcabad66]

Hello. I'm following all the steps in order to unlock my Poco M4 Pro 5G. Apparently it unlocks, but when I switch ON my phone it is still locked.
I attach two files with the screen before and after pushing "unlock".
Can Anybody Help me?

 

[miaochenxi]

Hello. I'm following all the steps in order to unlock my Poco M4 Pro 5G. Apparently it unlocks, but when I switch ON my phone it is still locked.
I attach two files with the screen before and after pushing "unlock".
Can Anybody Help me?

it's kind of weird, some users could unlock and for some users this method doesn't work.

 

[ToShye]

Good work, mate! Also work at Redmi Note 8 pro.
I'm finish almost in 5 min..

 

[Tolaseeq]

Hello. I'm following all the steps in order to unlock my Poco M4 Pro 5G. Apparently it unlocks, but when I switch ON my phone it is still locked.
I attach two files with the screen before and after pushing "unlock".
Can Anybody Help me?

Having the same issue here. The bootloader seems to be just locking back when booting into System. Tried everything, nothing helps. Tried to unlock bootloader with MiFlashUnlock, got "Failed to unlock (-1)" error. I just dont know what I can do now.

 

[Tony2k]

I done everything but my phone doesn't unlock so now I have the dm-verity warning and I can't do a clean flash with Miflash. Also Miflash Unlock doesn't work. What I can do now?

Preparation​

We are going to do it on Windows, if you use Mac or Linux, please read the corresponding tutorial here.
First of all you should install Magisk 24.1+ and patch boot.img through magisk app. Then copy the patched img file to your PC, it will be used soon.

Now follow the steps:

1. Install python(3.9 recommended) and git.
2. Clone the repository and install the dependencies:

git clone https://github.com/bkerler/mtkclient.git
cd mtkclient
pip install -r requirements.txt

3. Install UsbDk x64.
4. Turn off your phone and connect your phone to pc with usb cable.
5. Run command python mtk_gui in CMD or Powershell, make sure to locate to mtkclient directory before you run command.
6. Now hold volume down + power button till you see phone detected in the GUI or CMD/Powershell. Then you could release the buttons.

After the device info initialized you can see:

View attachment 5522315

​

Now let's unlock bootloader:​

If you have unlocked just skip and go to magisk root tutorial at the last.

Go to Flash Tools , you can see Unlock bootloader , click it. Your phone would be unlocked in 1sec.
You will getting a dm-verity warn when booting, just press the power button to continue. This warn could disappear by clean flash a ROM.
It's RECOMMENDED to do a clean flash after unlock, using MiFlash (Do not lock again). Then install Magisk and root your phone.


Now let's root the phone:

1. Rename your patched boot image to xxxx.bin, for example: magisk_patched_boot.img -> magisk_patched_boot.bin
2. Go to Write Partitions
3. Find boot_a and boot_b, set both of their values to the path of magisk_patched_boot.bin
4. Click Write Partitions button at the top right.
5. Wait until the progress goes to 100%.
6. Close the window, disconnect the phone. Long press power button to reboot.

If you did everything correctly and it still boot loop, try to use mtkclient to read boot_a partition, then patch it and flash it.
Now your phone should boot successfully with magisk root.

I done everything but my phone doesn't unlock so now I have the dm-verity warning and I can't do a clean flash with Miflash. Also Miflash Unlock doesn't work. What I can do now?

 

[Tre91]

Seeing all the comments. I regret buying MTK chipset and should've stayed snapdragon which has more support. My heart goes out to all those bricked and unable to root

 

[madagascar.zebra]

Great! It works.
Redmi Note 11 5G Chinese rom MIUI12.5.4 stable version.
magisk alpha 24301, the boot.img , install magisk , patch the boot.img
Using the tools 残芯专用TWRPRecovery刷入工具Win版V2.1.exe in the link . to flash.
The system can be rw.

 

[Tolaseeq]

Great! It works.
Redmi Note 11 5G Chinese rom MIUI12.5.4 stable version.
magisk alpha 24301, the boot.img , install magisk , patch the boot.img
Using the tools 残芯专用TWRPRecovery刷入工具Win版V2.1.exe in the link . to flash.
The system can be rw.

View attachment 5561677View attachment 5561679View attachment 5561681View attachment 5561683

That seems interesting. Man, can you please make a full tutorial how to root the phone with this "残芯专用TWRPRecovery刷入工具Win版V2.1.exe"? I just don't know Chinese. Also, your link seems to be broken, I cannot open it.

 

[kousuke5555]

hi
I bought the POCO M4 Pro 5G and tried this tool.
I also couldn't unlock the bootloader with this tool.
After that, the dm-verity warning came to be displayed.

However, I was able to unlock it with the official miflash unlock tool after 168 hours.
I think the person who got the error with the official tool is due to another factor.

 

[Grindher]

Thanks, your method worked perfectly

 

[e8hffff]

I've got the problem were I can't unlock. Tried all methods from MIUI official to mtkclient. Says unlocks but MIUI says still locked. Also any moded boot_a or boot_b partition converted with Magisk and written back, results in System Destroyed message on boot. Then I have to wrote back official boot.img to get phone working again. Tried on 12.5.3 and on 12.5.7 MIUI. Poco needs to get their act together and offer an automated unlock and root option in development section.

 

[e8hffff]

Finally rooted my phone. The problem I had is the bootloader wasn't properly unlocked. mtkclient simply wasn't able to unlock. I used the MIUI Unlock and didn't have to wait due to past registration and failed wait period. To know if your phone is properly unlocked you'll see a padlock with the open bar at the top of the boot screen. Not sure if a mtkclient unlock will also show the unlocked padlock icon.

 

[Usama-CW]

Thanks for your guide, i just want to confirm that, is safteynet passing on rooted miui v12.5.7? (Global : Poco M4 Pro 5G : Evergreen : 21091116AG)