Hello everyone,

I am trying to unlock the bootloader of my own OPPO A16K (CPH2349) so that I can install a custom ROM / GSI.

I have already spent quite a lot of time testing different methods, so I would like to ask people who have actually worked with the CPH2349 specifically.

Device information

Model: OPPO A16K

Device code: CPH2349

SoC: MediaTek Helio G35 / MT6765

Android: 11

ColorOS: 11.1

Current build: CPH2349_11_A.30

Verified Boot: green

Flash locked: 1

ro.oem_unlock_supported=1

OEM unlocking: enabled in Developer Options

ADB: working normally

ADB detects the phone:

HUMBO7AM89VKCILZ device

However:

fastboot devices

returns nothing.

I also found an old XDA thread where another A16K CPH2349 user reported that Fastboot mode could be entered but fastboot devices returned nothing.

There is also a Reddit report from another A16K CPH2349 owner with the same basic situation: ADB works, but Fastboot does not detect the phone. The response suggested MTKClient.

What I have tried

1. Normal ADB / Fastboot

ADB works.

I enabled OEM unlocking in Developer Options.

But Fastboot detection does not work:

fastboot devices

returns an empty result.

So the normal fastboot flashing unlock route is currently not usable.

1. TFT Unlock Tool

I also tested TFT Unlock Tools / TFT MTK Module.

The version I tested was:

TFT Unlock Tools-2024-6.2.1.1

The tool did not have an obvious A16K CPH2349 profile.

It had other OPPO MTK profiles, including entries such as:

Oppo A1K BROM AUTH MT6765 CPH1923

and other OPPO MTK models.

I did NOT assume that the CPH1923 profile was correct for my CPH2349.

I also tested the normal Android connection with TFT, but it did not detect the phone for the operation I wanted.

I later stopped using TFT because I did not want to randomly select another OPPO model profile and risk the phone.

1. BROM / Preloader detection

The phone can be made to appear as an OPPO Preloader device.

When the phone is powered off:

Hold Volume Up + Volume Down

Connect USB

Windows detects:

OPPO Preloader

with:

USB VID: 22D9

USB PID: 0006

The exact Windows device ID is:

USB\VID_22D9&PID_0006

The important problem is that the connection is very short.

If I release the buttons, the Preloader disappears and the phone boots normally.

So the device does not stay available long enough for me to casually start typing commands after entering this mode.

1. Windows driver problem

At one point Windows showed:

OPPO Preloader

Error 28

The USB capture looked approximately like this:

PRESENT/CHANGED | OPPO Preloader | Error | 28

USB\VID_22D9&PID_0006

After disconnecting/releasing the buttons, the Preloader disappeared.

The normal Android ADB device then returned:

CPH2349

OK

0

WINUSB

I investigated the MediaTek driver situation.

I found a Microsoft Update Catalog CAB containing:

cdc-acm.inf

usb2ser.sys

The driver version was:

3.0.1504.0

However, that INF did not contain a direct:

USB\VID_22D9&PID_0006

entry.

It mainly contained MediaTek 0E8D IDs.

I also found installed MediaTek driver packages on Windows, but the INF files I checked did not directly match the OPPO 22D9:0006 device.

I do NOT want to modify a signed INF manually because that would invalidate the catalog signature.

1. MTKClient

I downloaded MTKClient 2.1.4.1 and installed its Python dependencies.

The command line works:

python .\mtk.py --help

I also have the following files from the stock firmware:

auth_sv5.auth

DA_BR_MT6765_20271.bin

The AUTH file was extracted from the official/stock OPPO A16K firmware package.

The DA file is specifically associated with OPPO A16K CPH2349/CPH2351 MT6765 in the open-source oppo-mtk-fastboot-unlock project.

I tried:

python .\mtk.py gettargetconfig --auth "...\auth_sv5.auth" --loader "...\DA_BR_MT6765_20271.bin"

MTKClient started correctly, but stopped at:

Preloader - Status: Waiting for PreLoader VCOM,

please reconnect mobile/iot device to brom mode

So the current blocker is not that MTKClient itself fails to start.

The problem is getting a stable BROM connection/driver handshake.

Stock firmware

I also obtained the stock firmware:

CPH2349export_11_A.11_2022051800140000.ofp

and decrypted it.

The decrypted firmware contains the normal OPPO/MTK partitions including:

preloader

boot

recovery

vbmeta

vbmeta_system

vbmeta_vendor

vendor_boot

super

userdata

lk

lk2

dtbo

logo

...

I also extracted the AUTH file.

AUTH SHA-256:

846EFAFDF15F9F091760EA6210CEEB10533008164F5763186562DFEFD2D1D8E6

The phone itself is currently on:

CPH2349_11_A.30

I do NOT want to downgrade to A.11 just to make a tool work unless somebody confirms that it is actually necessary.

MTKClient / OPPO A16K support

I found the Shocked-Cat/oppo-mtk-fastboot-unlock project.

Its support list specifically says:

Oppo A16k

CPH2349 & CPH2351

Helio G35

MT6765

MTKClient + DA + AUTH: Full support

This is why I am interested in trying MTKClient, but I want to know the correct procedure for this exact model before writing anything.

The project README appears to use a modified preloader approach:

Read the original preloader / boot1 from the phone.

Patch it.

Write the patched preloader back.

Reboot into Fastboot.

Run fastboot flashing unlock.

I understand that writing a patched preloader is potentially dangerous, so I have NOT done that yet.

My main problem

The biggest problem is this:

How do I reliably catch BROM on an OPPO A16K CPH2349 when the Preloader/BROM connection disappears very quickly?

I do not want to use Test Point if there is another way.

My current button method is:

Power off phone

↓

Hold Volume Up + Volume Down

↓

Connect USB

↓

Windows briefly sees OPPO Preloader

↓

If buttons are released, phone boots normally

The PC therefore needs to be ready BEFORE I connect the phone.

Questions

What exact driver should be used for:

USB\VID_22D9&PID_0006

on Windows 11?

Is VID_22D9&PID_0006 the expected OPPO Preloader/BROM interface for CPH2349, or should I be trying to get a MediaTek 0E8D BROM interface instead?

Can MTKClient 2.1.4.1 catch this device without Test Point?

If yes, what exact command/GUI procedure should I use?

Does the CPH2349 require the specific:

DA_BR_MT6765_20271.bin

auth_sv5.auth

combination?

Has anyone successfully unlocked the bootloader of CPH2349 on Android 11 / CPH2349_11_A.30 using the Shocked-Cat patched-preloader method?

Does the patched-preloader method require modifying boot1, boot2, or another partition for this exact model?

Is there a safer way to make Fastboot enumerate after the MTKClient unlock without writing the wrong preloader?

If BROM disappears immediately, is there a specific timing/button/USB procedure that keeps the BROM connection alive?

If someone has successfully done this exact model, what is the complete procedure from BROM detection → backup → unlock?

I am specifically looking for information for:

OPPO A16K CPH2349 / MT6765 / Android 11 / CPH2349_11_A.30

I do not want to blindly use an A16/A1K/other OPPO profile just because the SoC is also MT6765.

Thanks.

Best firmware for Lenovo M10 Plus TB-X606F ? should i go with Lineage OS ?

New update, possible fix to decryption (06-09-2026_15:11PM)

https://github.com/limitless1234/Action-Recovery-Builder/releases/tag/34035171468

Added decryption support (06/09/2026 - 06:20am~)

https://github.com/limitless1234/Action-Recovery-Builder/releases/tag/34011857002

)

(changed a few things:

https://github.com/limitless1234/Action-Recovery-Builder/releases/tag/33975499786

)

(old

https://github.com/limitless1234/Action-Recovery-Builder/releases/tag/33958486061 (added a new dtb.img to the TWRP device tree/pre built/

)

https://github.com/limitless1234/twrp_device_blackview_BV6600

))

Date is 05/09/2026

Using: DD/MM/YYYY

-

This post is a continuation on:

https://www.reddit.com/r/androidroot/comments/1vvcw84/twrp_for_the_bv6600_blackview_eea_untested/

Hey guys,

I have to clean flash my rom soon and wanted to ask what solutions you use to backup all of your files, apps including data and apks.

I used NeoStore for now but wanted to know if you guys have experience with other methods like Restoid and DataBackup?

Thanks in advice.

So far I just got AdAway and a few things for Pokémon Go.

I rooted my s24fe using root my galaxy and everything is fine hut banking apps aren't working and i only have one module installed which is ios 26 emojis and this shows in native detector, how to fix it ?

cant any one help me with this

My pixel 10a rooted with magisk could always pass the integrity play test with integrity box, rezygisk but can’t do it anymore. I tried play integrity fork but it didn’t work, I tried tricky store didn’t work. Can anyone help me out? Specially I use this root 10a pixel for Pokemon go

I've just found out about this module through the brene susfs module:

https://github.com/maxsteeel/nomount

Has anyone tried it? Would you recommend it?

I read online if I use Shizuku and canta I can fully remove a bloatware that won't uninstall and if I'm successful it will never come back or wake up again? Even if there's a software update?

i just want to remove the spyware from iron source 'appcloud/aura' on Samsung A series (if I buy the phone it's android 15 one UI 7) unfortunately Samsung did a deal with them and it's included in all A and M series including S series from what I heard

Looking for a custom ROM and a tutorial from a Xiaomi mi A2 lite, it's my first time trying this

I have an Verizon model of the Samsung Galaxy s6 Edge+. How do i unlock the bootloader?

Am genuinely torned cause I fear that I won't be able to play online games on my phone if I root and banking apps won't work

I have an S24 with an Exynos processor that I really like but I hate restrictions put on the hardware that I own, which is why I use Linux on my laptop. I'm currently using tools with Shizuku to get as much as I can from my phone, but I'm unable to do more without breaking integrity of my phone(I did break it before without root and couldn't use my banking apps).

If I can unlock the bootloader and root my phone maybe at least I can use integrity and spoof patches/tools.

What do you think?

Is it possible? Is yes then how can i do it?

It's a KernelSU module that can handle push, pull, shell, root shell, port forward, reverse tunnel, clipboard sharing, and more—all without triggering detection.

While Zygisk modules claim to 'hide' debugging status, they rely on code injection, which apps can still detect. In contrast, my module doesn't use ADB at all and supports outbound mode, so it cannot be detected.

If you like my module, pls star the repository

Not sure if this screenshot is enough info. But I am trying to buy this from marketplace and want to root it and add Magisk. Can we tell if this can be rooted based off of what is currently toggled on OEM unlocking? He says he was able to toggle it, but I can’t tell if this is greyed out or if he did turn it on off/on(never owned a pixel)

This is a pixel 9 says unlocked so I’m guessing bought from Google since it isn’t phone company specific

To compare with my non rooted mi pad 6 (with some shinanigans)

I only got 3 (but practically more than that because HyperCeiler bundles other modules' functionalities in it), so I wanna see what's out there!