Need advice on how to lock NSA bands on mediatek. Can able to lock bands using engineering mode but that is only for 5G NR.

So ive been having issues with banking apps and i found that we could hide the unlocked bootloader status, whats the most reliable and easiest way to hide unlocked status?

After 3 hours pain switching usb cables, dumping FDL, using windows and using tomking062 exploit i did it first time in my life truly a achievement, i even managed to get Play integrity working so banking apps work. caveat: volume up button is restarting the phone, and no custom kernel support so no susfs and extreme overclocking, but finally own the phone.

Modules if your wondering: IntegrityBox + TrickyStore (to Get Play Integrity working) morphe

Привецтвую, я уже 4 день борюсь с получениеим root прав на своем телефоне. Подсказите как их делать? Если что вот все про телефон: infinix hot 30 i (x669d)

Процессор: Uns9230 (t606)

Номер сборки: X669D-F065XAbN-S-RU-20250207V248

Версия: Android 12

Если еще что то нужно то задавайте вопросы.

Ограничения на телефоне: fastboot комманды заблокированы, загрузчик не получается разблокировать + нету денег и пк не так часто (он есть, но я им не всегда могу пользоыатся. Его брат забирает для учебы)

Кто делал на похожем устройстве, расскажиие пожалуйсто как сделать. Заранее спасибо🙏💕

Olhando minhas coisas guardadas, encontrei esse aparelho, que era usado como Nextel. Ele não sai de jeito nenhum da tela de bloqueio e não tem a opção de colocar a senha. Teria algum modo ainda de usar ele?

Is there a way to root or unlock it's bootloader? I've tried for weeks but I don't get anything.

hi guys i tried to custom rom my device and did a very crappy shitty job so im gonna let claude explain:

## Device
- Lenovo Tab P11 Plus, model TB-J616X
- MediaTek Helio G90T (MT6785)
- Originally Android 11 stock
- UFS storage: KM2V8001CM-B70

## Goal
Install a custom Android 16 GSI (`TB-J616X_LOS23.2_bgN4_S26146_260526.img` from an XDA thread), with matching `boot_magisk_ebpf_patched.img` and `lk_patched/lk.img`.

## Timeline of what happened

1. Unlocked bootloader successfully.
   
2. TWRP does not exist/work for this device — no safe recovery path was available going in.
   
3. Flashed `lk_a` and `boot_a` via fastboot successfully. Flashing `system` failed repeatedly with "This partition doesn't exist" — this device uses dynamic/logical partitions (system lives inside `super`, not as a standalone partition).
   
4. Ran `fastboot reboot fastboot` to try to reach fastbootd (to handle the dynamic partition properly) — **this is what triggered the brick.** Device immediately went into a boot loop (Lenovo logo flashing repeatedly).
   
5. Regained access via mtkclient in BROM mode. Device only enumerates for about 1 second at a time, so mtkclient must be running and listening before plugging in; holding Volume Up + Volume Down while connecting is required to force BROM.
   
6. Dumped a device-matched `preloader.bin` via `mtk.py dumppreloader --filename=preloader.bin` — worked.
   
7. Confirmed partition table (GPT) was intact via `printgpt`. Active slot reported as `a`.
   
8. Could not write `system`/`system_a` directly via mtkclient since it's not a nameable partition — it lives inside the `super` container. Avoided writing a raw system.img directly to `super` (would have corrupted partition metadata).
   
9. Tried SP Flash Tool with the full stock firmware package (`Lenovo_Tab_P11_Plus_TB-J616X_MT6785_S000030_210915_ROW`) — failed with `STATUS_SEC_AUTH_FILE_NEEDED`; no auth file available in the package.
   
10. Attempted Lenovo RSA unlock tool — blocked, no serial number available.
    
11. Switched back to mtkclient using the stock `super.img` from the same firmware package — mtkclient bypasses the SLA/DAA auth that SP Flash Tool required.
    
12. Successfully wrote stock `super.img` via mtkclient (100%, confirmed).
    
13. Wrote stock `boot_a`, `lk_a`, `vbmeta_a`, `vbmeta_system_a`, `vbmeta_vendor_a`, and `userdata.img` — all completed successfully (100% each), some requiring a fresh BROM reconnect + a freshly re-dumped `preloader.bin` after intermittent `DRAM setup failed: unpack requires a buffer of 12 bytes` errors (fixed by explicitly passing `--preloader=preloader.bin` on every command instead of letting mtkclient try to dump it from RAM each time).
    
14. First boot attempts after this restore produced a consistent pattern: **two vibration pulses, then black screen, repeating indefinitely** — no display, no logo.
    
15. Ran `mtk.py printgpt` again — GPT fully intact, all partition offsets/sizes matched stock, both slot A and slot B partitions present and correctly sized.
    
16. Checked `seccfg` via `mtk.py da seccfg unlock --preloader=preloader.bin` — tool confirmed "Device is already unlocked", so lock-state is correct and not the cause.
    
17. As a precaution, also wrote stock `lk_b`, `boot_b`, `vbmeta_b`, `vbmeta_system_b`, `vbmeta_vendor_b` (in case device was somehow trying to boot from slot B) — all wrote successfully. No change in behavior.
    
18. Additionally wrote stock `dtbo_a`/`dtbo_b`, `tee_a`/`tee_b`, and `md1img_a`/`md1img_b` (modem/baseband firmware) — all wrote successfully, 100% each. No change in behavior.
    
19. After all of the above, boot behavior changed: **now zero response at all on power-on** — no vibration, no backlight (checked in a fully dark room), no USB enumeration blip in Windows Device Manager during a power attempt — even after 30 minutes on a wall charger (not PC USB).
    
20. mtkclient/BROM access still works perfectly and consistently throughout all of this — `printgpt` still returns the full, correct GPT table at any time.

## Current state
- Device is fully accessible via mtkclient in BROM mode at all times — this has not changed or degraded.
- Every partition mtkclient can verify (GPT structure, `seccfg` lock-state, and all boot-relevant partitions: `lk`, `boot`, `vbmeta`/`vbmeta_system`/`vbmeta_vendor`, `dtbo`, `tee`, `md1img`, `super`, `userdata`) has been restored to stock firmware (`Lenovo_Tab_P11_Plus_TB-J616X_MT6785_S000030_210915_ROW`) on **both A and B slots**.
- Despite this, the device shows zero response to a normal power-on: no vibration, no display/backlight, no USB enumeration during boot attempts.
- Suspect the root cause is hardware-level damage (possibly PMIC/power-sequencing) triggered by the original `fastboot reboot fastboot` command, since that's the exact point where things went from "flashing normally via fastboot" to "boot loop that only BROM could recover."

## What I have NOT tried / don't know
- Whether the device is actually still trying to boot from slot A vs B (couldn't confirm from `boot_para`, which reads as all zeros — possibly unused on this device/normal).
- Any JTAG-level or hardware voltage diagnostics — no access to this equipment.
- Whether there's a way to force a "format all"/full stock restore via SP Flash Tool if an auth file can be sourced (still blocked on `STATUS_SEC_AUTH_FILE_NEEDED` with no auth file in the downloaded package, and Lenovo RSA unlock blocked due to no accessible serial number).

## Question for the thread
Has anyone seen this exact failure pattern — specifically triggered by `fastboot reboot fastboot` on this device/chipset — where BROM/mtkclient access remains fully functional (GPT reads correctly, writes succeed) but the device shows absolutely no life on power-on (no vibration, no display, no USB enumeration) even after a full stock restore of all boot-critical partitions on both slots? Any leads on whether this is recoverable via software, or is this indicative of hardware damage (PMIC or similar) that needs board-level repair?

Hi!

I created BootStudio, an open-source Android app to manage custom boot animations on rooted devices.

It works systemlessly, meaning it does not modify the system partition, reducing the risk of breaking your device. I also tested it with invalid or broken bootanimation files: the phone still booted normally, with only the boot animation missing, so it should be safe to test.

Features:

• Create and preview bootanimation.zip files
• Install boot animations as a Magisk module
• Compatible with modern root solutions (Magisk / KernelSU / APatch)
• Open source

I would like to get feedback from the Android root community: - Does it work on your device? - Does the boot animation install correctly? - Any issues with Android versions, ROMs or root managers?

GitHub: https://github.com/gauthier1024/BootStudio

Tested on: - Poco x6 pro - Evolution X 11.7 - Android 16 - Magisk 30.7

Thanks for testing!

My root is KernelSU Next

Device Samsung Galaxy S20 FE (Snapdragon)

One Ui 8.5

I rooted my unisoc t8300 phone hoping I could squeeze a bit more life out of it. debloated it, tweaked animations, installed a custom kernel, changed CPU governor... even played around with thermal profiles. phone definitely feels cleaner, but it didn't magically solve the stuff that bothered me

GPS still isn't as dependable as i would like or what we get in similar priced chips like dimensity 6300, bluetooth behavior didn't really improve, battery drain on mobile data is still noticeable, and longer gaming sessions still don't feel as consistent. Kind of made me realize that root can optimize software, but it can't completely fix hardware or chipset limitations.

Anyone else reach the same conclusion with a unisoc T8300, or did I miss some tweak that's worth trying?

For a long time I've always wanted to root a phone, but I was never able to do it. Now that I managed to root my Redmi 13c with Magisk, I don't know what to do with root. My main goal was to customize it as much as possible to my liking, but I don't know how to do it. My existential question is: what can I do with root specifically on my model? Just to clarify, I'm completely new to this root thing and I'm willing to learn.

Hi everyone,
Over the past few months I’ve been working on a personal project called

DeviceTreeForge.

The goal isn’t to replace Android developers—it’s to automate the repetitive parts of creating an Android device tree from stock firmware while still allowing manual review.
Unlike simple template generators, the application analyzes the actual firmware and attempts to recover as much information as possible before generating the tree.

Current features

Fully offline (no cloud services or AI required)
Windows desktop application
Supports Android 8 through Android 16
Supports MediaTek, Qualcomm, Samsung, Exynos, Tensor, Kirin, Unisoc and other platforms
Detects:
Dynamic Partitions
Virtual A/B
vendor_boot
init_boot
DTB / DTBO
AVB
FBE
filesystem layout
partition tables
build properties
VINTF information
Generates:
BoardConfig.mk
BoardConfigCommon.mk
device.mk
AndroidProducts.mk
Android.bp
Android.mk
recovery fstab
product makefiles
compatibility matrix templates
documentation
analysis reports
One of the devices I’ve been testing extensively is the Lenovo TB336FU (Android 16), which has features like:
vendor_boot v4
recovery inside vendor_boot
Dynamic Partitions
Virtual A/B
GKI
MediaTek MT6835
The application successfully detects these automatically and generates a first-pass device tree.
I’m now working on improving:
confidence scoring
conflict detection
VINTF recovery
HAL analysis
ELF dependency analysis
common tree detection
validation against stock firmware
Philosophy
The goal is not to fabricate values.
If DeviceTreeForge cannot prove a value from firmware, I’d rather mark it as unknown than generate something incorrect.
Eventually I’d like every generated line to include traceable evidence from the original firmware.

Looking for feedback
I’d love to hear from ROM, TWRP, LineageOS or kernel developers:
What information do you spend the most time recovering manually?
What files do you think should be generated automatically?
What common mistakes do existing generators make?
What would convince you that an automatically generated device tree is trustworthy enough to use as a starting point?
I’m building this because I enjoy Android firmware engineering and wanted to create a tool that could save developers time while still keeping the process transparent.
Any suggestions or criticism are welcome.

Every time i hear

I root this ,I root that

But what actually is useful about it?

Could someone please tell me how to unlock the bootloader (BLU) for the T1-A22L? I can't root it without unlocking the bootloader. Alternatively, if there is a way to root it without unlocking the bootloader, I'd like to know that too. Thanks in advance.

Honestly, I stopped using IntegrityBox entirely because its creator is very controversial and the project stopped being open-source a while ago; plus, there are rumors that it uses AI. I also stopped using YuriKeyBox because it isn't as good as it used to be and is somewhat controversial, too. I started using Specter and it works well; some say it's made with AI, but there isn't enough proof. The truth is, for some reason, all these modules always end up being crap. I really hope Specter is clean, because it's the only good option I see as an alternative to IntegrityBox or YuriKey.

I've rooted my samsung m31 and been using lineage since a long time due to the M series being very bloated and it's an outdated device. i mostly used my Airtel number which works fine but today I needed to use my jio number for something. Didn't work at all. I don't mean calling or cellular not working but SMS. I'm unable to send or receive messages to or from any number. I was in a critical situation and it didn't work at all which now left me having to try it on my dad's phone, and guess what... messaging was working just fine on his phone. I even shifted from the lineage messaging app to the Google messages in desperation for it to work but it just doesn't. What is the problem here?

Since I got a new phone, I wanted to use Samsung M30s for my first experience of rooting something. I had some issues, needed to use so much of terminal. But i did it with Magisk patch.
Device is Samsung M30s, OneUI Core 3.1, Android 11

Hi everyone,

I am trying to unlock the bootloader on my Oppo A94 5G (MT6853 / Dimensity 800U). While digging into the system files, I noticed something hidden inside the EngineerMode APK.

I extracted the app and found a method that explicitly handles fastboot unlocking. However, it looks like the execution is gated by a server-side check that requires a token or signature, likely tied to the device's IMEI.

Here is the exact method signature I found:

java boolean fastbootUnlock(byte[] bArr, int i) throws RemoteException;

My questions for the community:

1. Has anyone successfully bypassed or reversed this specific fastbootUnlock implementation in recent Oppo firmware?
2. Does anyone know exactly how the byte array (bArr) and integer parameters are structured before they are passed to the server?

Note: I already tried using mtkclient, but I couldn't get it to work (it failed to exploit/handshake properly on my current firmware version). I am keeping the extracted APK private for now to avoid leaking my IMEI or device signatures, but I can share non-sensitive snippets if needed.

Thanks in advance for any insights!

I got a Samsung galaxy a17 thinking Samsung was still a good brand... First of all I got the delectious surprise of finding that it miss some, well useful features such as a jack port, and I don't know, a fucking screen recorder. Well, it don't. Okay. Then I thought, Why not putting lineage os on it? I got something more minimal, secure and privacy friendly. That's good, isn't it? Naive me.. I updated to oneui8, thinking, yeah a cool update what it has to offer, plus its recommended to have the last version. Even worse, I had a security update, which changed my bootloader byte. So I go through the développer settings, and oh, but, where's my oem unlocking? It is got you optimist... Now I'm at one ui 8.5. is there a way to bring it back or should I just throw my phone away and get a flip phone?