[OPPO A72 Guides, News, & Discussion] Bobgle:
I have spent a couple days trying to root this phone using an exploit or similar now. What I've discovered so far is:

- Recovery, EDL, Fastbootd (without functions over USB) are all available

- Engineer Mode is available too, but not accessible without credentials

- Similar phones (Realme, OnePlus, other OPPOs) have supposedly been rooted using an "In-Depth Testing" APK

I'm not sure if using the APK on my own phone is a good idea, but I have tried reverse engineering it and have gotten as far as some other threads for other phones have. It seems like the lead ends there, but I don't think enough has been tried. My expertise with Android development is somewhat limited, but I found a couple lines of code that are interesting.

// This is the request sent to the server based on the status.
// for Realme:
if (this.myContext.getPackageManager().hasSystemFeature("oppo.version.exp")) {
this.myString = "https://lkf.realmemobile.com/realme/v1/";
} else {
this.myString = "https://lk.realmemobile.com/realme/v1/";
}

switch (((Integer) intent.getExtras().get("MessengerFlag")).intValue()) {
case 1000:
this.myString += "applyLkUnlock";
break;
case 1001:
this.myString += "checkApproveResult";
break;
case 1002:
this.myString += "updateLockStatus";
break;
case 1003:
this.myString += "acquireClientStatus";
break;
case 1004:
this.myString += "closeApply";
break;
case 1005:
this.myString += "acquireApplyStatus";
break;
}

// For ColorOS:
this.requestUrl = "https://ilk.apps.coloros.com/api/v2/";
switch ((Integer) intent.getExtras().get("MessengerFlag")) {
case 1000:
this.requestUrl += "apply-unlock";
break;
case 1001:
this.requestUrl += "check-approve-result";
break;
case Constants.USERCENTER_PLUGIN_ID /*{ENCODED_INT: 1002}*/:
this.requestUrl += "update-client-lock-status";
break;
case 1003:
this.requestUrl += "get-all-status";
break;
case 1004:
this.requestUrl += "lock-client";
break;
}

// Based on the response data, it accesses an included class to do the fastboot unlock. The actual value of bArr is based on the response.
((Boolean) Class.forName("android.engineer.OppoEngineerManager").getMethod("fastbootUnlock", byte[].class, Integer.TYPE).invoke(null, bArr, Integer.valueOf(bArr.length))).booleanValue();

// In another function it calls this without a value included. I think this might be used to lock it again.
byte[] bArr = {0};
((Boolean) Class.forName("android.engineer.OppoEngineerManager").getMethod("fastbootUnlock", byte[].class, Integer.TYPE).invoke(null, bArr, 1)).booleanValue();

// OEM Unlock is done after fastboot unlock
((PersistentDataBlockManager) this.activityRef.getSystemService("persistent_data_block")).setOemUnlockEnabled(true);

// You can access engineerMode using this code
engineerMode: *#9434#

Most of this information as available elsewhere, but those threads have stopped working on it. I think it would be worth trying to get a hand on the android.engineer.OppoEngineerManager package and check the fastbootUnlock function. Intercepting the values sent by a successful request might also be useful. If that works, one could probably easily create an APK to do this on any phone.

Is there anyone knowledgeable enough to do this?