Warning
This guide still works, but isn't supported by me, i left this device.
- This method will wipe your phone and temporarily downgrade your phone to RUI2
- Read this tutorial step by step to don't miss anything.
- This method doesn't use Deep Test
Use this tutorial only with RUI3
- MTK Client archive
- SP Flash tool
- Decrypted OFP Partitions
- A.24 RUI2 Firmware
- libusb-win32 Drivers
- USBDk
- Python from Microsoft Store
- A functioning brain and a emotional support after the unlock
- Download libusb-win32 and install it
- Run libusb-win32
- Take actions at libusb-win32 window, selecting install a device filter
- Before pressing next, Connect your phone to your computer, make sure its powered off, as it is: Hold down Vol+, Vol-, and power button
- Remember to not release the BROM buttons, it can be a quite hard, but with your second hand you can operate the mouse. Click next
- You should see there a
MediaTek USB Port
device, Select it and Click Install - After installing, Leave your phone shut down. We will get into the same state in downgrading to RUI2
-
Extract and enter to the folder of MTK Client archive
-
Open the console in the MTK Client's folder, a tip how to do it faster below
-
Run the payload by simply using command
python mtk payload
, It should look like this:If there is any error with python, you dont have the libaries. get them using command
python -m pip install -r requirements.txt
-
Make sure your phone is powered off, Make sure your phone is connected to your computer, as it is: Hold down Vol+, Vol-, and power button - (Don't leave the buttons until the bypass is done)
-
MTK Client should output something like this:
-
Leave the phone alone in the BROM, Run the SP Flash tool [flash_tool.exe]
-
Click on
Options > Option...
-
Make sure the right COM Port is selected, UART enabled and baud rate is set to 921600.
-
Get Haadi's A.24 RUI2 Firmware and unpack it
-
Load scatter from Haadi's Firmware
- Before doing anything, remember to WIPE down your phone for safety. Hold down Vol-, and power button, In recovery select wipe data, and then don't select the option to retrieve contacts, etc. It will cause errors, select the clean wipe. Act as you had RUI2 from the beggining LOL
-
Open the console in the MTK Client's folder
- Run the payload again by using command
python mtk payload
- Do what before: Make sure your phone is powered off, Make sure your phone is connected to your computer, as it is: Hold down Vol+, Vol-, and power button - (Don't leave the buttons until the bypass is done)
- Check if output of MTK Client was same as before, if it is then payload was sent successfully
- Run the payload again by using command
-
Leave the phone alone in the BROM, Run the SP Flash tool again [flash_tool.exe]
-
Click on
Options > Option...
-
Make sure the right COM Port is selected, UART enabled and baud rate is set to 921600.
-
Things are now getting a bit different. Download and extract Decrypted OFP Partitions
-
Select the scatter from Decrypted OFP Partitions
-
These things should be only selected. If aren't, you have selected the wrong OFP/Firmware/Scatter
-
Check if mode is
Download Only
, if so: clickDownload
button. Remember to also put your phone in a stable location.
-
Install USBDk
-
Open the console third time in the MTK Client's folder
-
Reboot your device, turn it off and Hold down Vol+, Vol-, and power button - (Don't leave the buttons until the bypass is done)
-
Type
python mtk e metadata,userdata,md_udc
- This command wipes your data. It should look like this: -
Unlock the bootloader using command
python mtk da seccfg unlock
, the output should look like thisAfter this, unlock your phone. First boot will take up to 5-20 minutes. Don't panic.
Bootloader is unlocked, When you will boot your device, press one time power button to skip dm-verity, there also will be a 5-second orange-state indicator
- Green state means the device is locked, it shouldnt show that it's locked on-boot
- Yellow state means that an alternate keystore was used to verify the boot image
- Orange state indicates that the device is unlocked.
- Red state means that a device in the locked or verified state had a boot image that did not verify.
-
You can boot into RUI2, in order to setup it for updating into C.18, Currently there will be three updates.
[A.24] > C.07 > C.14 > C.18
TIP: Remove your sim card, and don't connect temporarily to any networks to avoid longer OOBE times
Congrats, you now have a unlocked phone with the latest version of RUI3!
Do this ONLY AFTER UPDATING to your desired RUI3 version (ex. RUI3)
- Read your lk file, using command
python mtk r lk lk.bin
, Go to BROM mode, after read it will be located in the same folder as your mtkclient.
Note: if
lk
isn't working, try readinglk2
. same with writing.
- Open Roger's website for lk.img/lk.bin patching
- Choose your lk file, Upload it using another button
- It wil automatically download it, put the lk-patcher.bin file into mtkclient folder, flash it using command
python mtk w lk lk-patched.bin
- To check if fastboot is avalible, use command
adb reboot bootloader
in Android Platform Tools - There should be a small string with
ok
on the ending of it, if there is something like this then you have successfully unlocked fastboot
To return into android, use fastboot reboot
in Android Platform Tools
Zako Chan - Information about walkthrough with downgrade
Tony stark - Provided RUI2 unlock guide.
MtkClient - Basically, without that tool we wouldnt be able to do the unlock.
Haadi - RUI2/A.24 Firmware files
HowWof - A few of suggestions, thanksTelegram: Realme 8 Discussion, Realme 8 Updates, Realme 8 AOSP
Thanks for reading, written by lemonek with 💖
Tested on 8/1/2023