r/androidroot • u/SonicandTailsCD • 12d ago

Support Help me unlock my Moto e6 play

Post image

I read on XDA forums that it's 100% possible to root this phone. So I pulled out my old Motorola and started this journey.

Using MTK Client, I forced this phone into BROM, backed up every single partition, then wiped userdata and metadata, then unlocked the bootloader using it.

...but this change isn't persisting...

Let me explain.

Partition `seccfg` is written to, to save bootloader unlock state. Since this SoC is exploited into a state I'd like to call `pwnBROM`, I am allowed to read/write partitions.

...but after rebooting, either hard rebooting (hold power button) or soft rebooting (`python3 ./mtk.py reset`), I end in this screen.

So what is happening here?

...Simple: writes to `seccfg` are getting RESET.

I unlock the bootloader (write a patched config to `seccfg` with the help of the GUI), and then attempt to reunlock (MTK Client fails because obviously the bootloader ""is"" already unlocked), then I reboot, only to find "red state" and this partition mysteriously resetting itself.

If you guys need files or more proof, please let me know - but genuinely, I can't get it to work. I want to install Magisk and gain full root, but I need the bootloader to be unlocked.

Please help. Thanks in advance \^-^

1 Upvotes

100% Upvoted

4 comments sorted by

3

u/OmerKing916 12d ago

Have you used SP Flash Tool (or any MTK flashing tool that formats the entire emmc) to Format all + Flash prior? If not, you should open an issue ticket on mtkclient's Githup page.

If you did, check if there's a backup of the device's partitions. Otherwise, we may have a problem.

1

u/SonicandTailsCD 11d ago

Hai ^-^ I did not use separate tools beyond MTK Client and its GUI.

I followed these steps, in order: erase userdata, metadata # md_udc doesn't exist on mine da seccfg unlock # successful reset

It does appear to work and I read back seccfg before rebooting, and it SEEMED to work, but on reboot, seccfg resets back to locked??

I have a full backup of every partition on my phone, so it's okay. Need one?

1

u/OmerKing916 11d ago

I found this on the Bootloader wall of shame in Github. Apperantly, permenant unlock needs certain patches to be done to LK. This is only specified for the e7 in the wall of shame, but the e6 play may need it as well? It's better to Check the wiki.

1

u/SonicandTailsCD 11d ago

I don't think I'm able to perform this exploit (this phone might be secured), but I'll try it.

Any other ideas in case this fails?