yashsingh1/xdaforums huggingface dataset:
[Realme GT 2 Pro] GIutton:
Well maybe you or someone else can tell me if this process I tried should work or not.

I took the boot.img posted in this thread by Rapper_Skull and patched it with magisk then used "fastboot boot magisk_patched-25200.img" to boot the phone with it which seems to have worked and that gave me temporary root access to accomplish the following step. Next, I used "adb shell getprop ro.boot.slot_suffix" to find that my active slot is _a and then used "adb shell su -c dd if=/dev/block/by-name/boot_a of=/sdcard/boot_a.img" to pull a copy of the boot image from that slot which should be from my current OTA A.17 correct? I also took one from the inactive _b slot which should be previous OTA A.16 and they were both the exact same size at 192MB. I then patched the _a boot.img with magisk and that seemed to work but I have not tried booting into yet. My main concern here is that the boot.img posted in this thread was only 50MB but the one I pulled from the phone is much larger at 192MB so did I do something wrong here? Would it still be safe to try booting into the magisk patched boot image I pulled from the active slot?
[Realme GT 2 Pro] Quake94:
Hmm..wouldn't running adb shell su -c dd if=/dev/block/by-name/boot_a of=/sdcard/boot_a.img pull the magisk_patched-25200.img from slot A since it is active partition? Maybe pull boot_b instead. Or double check how fastboot boot command works.

Also, if the phone boots successfully using magisk_patched-25200.img, maybe that is good enough to flash...

A surefire method is extracting boot.img directly from firmware release or OTA update file but you probably know that already.
[Realme GT 2 Pro] Rapper_skull:
The boot partition is not filled to the max of course, so the boot.img extracted from the firmware files is smaller than the partition size (192 MB). When you dd, you copy the entire partition, including any empty space.
[Realme GT 2 Pro] GIutton:
Right I just can't find the A.17 OTA anywhere and keep getting an error when I try to use the beta or rollback package to get the phone back to an OTA version that I have access to download.

I thought, but definitely could be wrong, that "fastboot boot magisk-patched_25200.img" would boot the phone using the patched boot image I saved to the PC and leave the boot image in the active slot unchanged for me to pull. But if I am right about "fastboot boot" I shouldn't have to pull a copy anyway since I could just do a "direct install" from the magisk app which would patch the A.17 active slot boot image?
[Realme GT 2 Pro] Rapper_skull:
Exactly. Once you boot your patched boot.img you can use Magisk to direct install. BTW this is the global A.17 firmware.
[Realme GT 2 Pro] GIutton:
Oh okay that makes sense.

Maybe you can answer this cuz I can't find one anywhere but when trying to do the dd command I messed up and idk if it did something I should be worried about. I typed "adb shell su dd" then I accidentally hit enter so then I thought I could just type "exit" and hit enter to back out but that didn't work and honestly idk what it did. I searched and found that I should have done "ctrl + c" to back out and that's what I did. Everything seems fine but people call dd "disk destroyer" which doesn't sound too good lol.
[Realme GT 2 Pro] Rapper_skull:
Don't worry you didn't destroy anything.
[Realme GT 2 Pro] xn0live:
does it work on

oppo find x5 lite?
[Realme GT 2 Pro] Rapper_skull:
The scope of this procedure is to temporarily change one system property (ro.product.name) to allow the unlocking of the bootloader via official means. If it is the case for the Find X5 Lite too, and you're running kernel version 5.10.66, you can modify the script and try.
[Realme GT 2 Pro] xn0live:
that mean? what i must do
[Realme GT 2 Pro] xn0live:
that is the infotmation:

Buil Number

CPH2371_11A.12

Basisband Version

M_V3_P10,M_V3_P10

Kernel Version

4.14.186+

Hardware Verdion

CPH2371_11
[Realme GT 2 Pro] Pf_Plays06:
Hello, rooting noob here, interested in buying the gt 2 pro soon. Does this still work to this day? Once the bootloader is unlocked, is it permanent meaning you can also root the phone for as much as you want. About the kernel sources, do you think realme will publish them leaving space for custom roms?

Edit: Discussing with a friend I have found this, so those should be the kernel sources right? https://github.com/realme-kernel-opensource/realme_GT2pro-AndroidS-kernel-source
[Realme GT 2 Pro] Rapper_skull:
Yes, that's the kernel source. As for the method, it sure works on the device side. I don't know if Realme changed something server side, but I don't think so.
[Realme GT 2 Pro] Pf_Plays06:
I was wondering if you could make a mirror of the latest ota unpatched package in case realme shuts the link down, especially for people who come later
[Realme GT 2 Pro] Rapper_skull:
I have it offline. When I have the time, I will upload it somewhere.
[Realme GT 2 Pro] GIutton:
I ran the .bat and it says it worked but how do I give adb shell root access it does not recognize su? Or better yet Is there a way to make the magisk app recognize the phone is temporarily rooted so I can do a direct install from the app? I am trying to find a way to magisk root the phone since the bootloader is already unlocked but it will not boot.
[Realme GT 2 Pro] Rapper_skull:
That's not the scope of this guide. Just flash the patched boot.img with fastboot. If it doesn't boot, probably it's because you didn't run

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

vbmeta.img can be found alongside boot.img in the firmware files.
[Realme GT 2 Pro] GIutton:
Sry I know it is not what this is meant for I am just trying to find a workaround to root it since the phone will not go into fastboot mode so I cannot run any fastboot commands. Was trying to find a way to root the phone without using fastboot.
[Realme GT 2 Pro] mindtrappergr:
Any chance this could also work for the Realme 9 Pro+ if I somehow could downgrade to a version with a suitable kernel/security patch?
[Realme GT 2 Pro] Georgik143:
Hi. I have Gt neo 3, rmx3561, global (mea), kernel 5.10.66, firmware version is A.09

The Chinese version is rmx3560.

What exactly should I change in script to work it.

Thank you.

For now in cmd it shows at end "it worked" and after 30 secs ro.product.name still rmx3561...
[Realme GT 2 Pro] Rapper_skull:
You can try and edit startup-root and replace RMX3301 with RMX3560 near the end. Let me know if it works.
[Realme GT 2 Pro] Georgik143:
This is first what I have done.

Still rmx3561
[Realme GT 2 Pro] Rapper_skull:
This could be for a number of reasons. Unfortunately, without having the device is difficult for me to help you.
[Realme GT 2 Pro] Georgik143:
Ok, understand.

But what about my screenshot?

Is there correct \right information?

Does the script work at now?

And what is "oriole" and "i18n"?
[Realme GT 2 Pro] Rapper_skull:
I don't see anything that is obviously wrong with your screenshot. Where did you read oriole and i18n?
[Realme GT 2 Pro] hill67:
Hi,

Unfortunately this is not working for me. I am on A21.

I get the following messages:

View attachment 5742737
[Realme GT 2 Pro] Rapper_skull:
Try to update adb to the latest version
[Realme GT 2 Pro] hill67:
I am not sure how to do that.
[Realme GT 2 Pro] Rapper_skull:
Just download the latest SDK Platform Tools
[Realme GT 2 Pro] hill67:
I managed to get the procedure working but in the end it says RMX3301EEA . After that I tried the deeptest app but still got the message 'Failed to submit application' This phone model does not support deep testing. I am on android 13.
[Realme GT 2 Pro] Rapper_skull:
That's the expected behavior, you have to downgrade first. It's all written in the first post.
[Realme GT 2 Pro] hill67:
Thanks, I overlooked that
[Realme GT 2 Pro] hill67:
I downgraded to A14 and tried the procedure again without luck.

I updated to A21 and tried it again. I got the following screen:

View attachment 5760647

Again ro.product.name = RMX3301EEA????
[Realme GT 2 Pro] Rapper_skull:
Can you tell me your kernel version?
[Realme GT 2 Pro] hill67:
View attachment 5760687
[Realme GT 2 Pro] Rapper_skull:
That's the correct version. Have you tried on A.14 or directly on A.21? Also, can you send the full output of the script?
[Realme GT 2 Pro] hill67:
I have tried it on A14 and A21. Hereby the full output:

View attachment 5761055
[Realme GT 2 Pro] Rapper_skull:
Maybe a silly question, but have you copied the magisk folder alongside the other three files?
[Realme GT 2 Pro] hill67:
Not silly at all because I didn't 🙄. Just find out myself as well. After I also copied the magisk folder in I tried it on A21. Now it worked, the phone booted but .. no luck again with the deep testing app . So now i am gonna roll back to A14 again and try from there.
[Realme GT 2 Pro] Rapper_skull:
You don't have to reboot the phone, just install the deeptesting app and run it.
[Realme GT 2 Pro] hill67:
Finally, finally I managed to get the bootloader unlocked. Thanks for your help.

But, a question: can you do an OTA update with an unlocked bootloader?

I am asking because I want to do an update via local installation but this button is grayed out because an OTA update is already available for download.
[Realme GT 2 Pro] Rapper_skull:
The unlocked bootloader is not a problem for OTA updates, but if you root your phone, the OTA update will fail.
[Realme GT 2 Pro] Effizio01:
Processing after half hour nothing
[Realme GT 2 Pro] Rapper_skull:
Tap back and check again.
[Realme GT 2 Pro] Effizio01:
Thanks, it 's Second time 😔
[Realme GT 2 Pro] MB525:
So to be clear, the dirtypipe vulnerability has finally been fixed in Android 13, right? And if I unlock the bootloader on Android 12, does it stay unlocked after updating to Android 13?
[Realme GT 2 Pro] Rapper_skull:
The vulnerability is only used to trick the app. Once you unlock the bootloader, it will stay unlocked until you lock it again. If you're on Android 13 and want to unlock the bootloader, you can use the downgrade package.
[Realme GT 2 Pro] MB525:
Good to know that we can downgrade. I was worried about a possible fuse.
[Realme GT 2 Pro] lucy1983:
There is a possibility to speculate the same vulnerability for the European model of Realme GT2? The unlock app is finally out, but not for the European variant. So I was thinking if maybe someone could build a file like for the PRO variant to be able to unlock the European variant too.
[Realme GT 2 Pro] Rapper_skull:
Someone already asked, but unfortunately the GT 2 kernel version on Android 12 is older and not vulnerable. I don't know about Android 13, but I don't think something changed.
[Realme GT 2 Pro] lucy1983:
Shouldn't the older versions be more vulnerable then the newer ones?
[Realme GT 2 Pro] Rapper_skull:
Maybe it has other vulnerabilities, but DirtyPipe was introduced in Linux in version 5.8. The GT 2 uses kernel version 4.19.
[Realme GT 2 Pro] lucy1983:
5.4 but still older then 5.8.
[Realme GT 2 Pro] Effizio01:
Hi, I have Android version 12 a21 and I received this update, I have the bootloader unlocked and the root, is it better for me?
[Realme GT 2 Pro] Rapper_skull:
Someone posted the procedure to update without losing root. In a nutshell you have to restore images from Magisk, apply the update without tapping "Install" when asked, install Magisk to the inactive slot, NOT reboot, go to the installer again and tap "Install".
[Realme GT 2 Pro] Effizio01:
Thanks
[Realme GT 2 Pro] ruicc:
It's on processing screen for 2 hrs...it's normal?
[Realme GT 2 Pro] ruicc:
Nevermind
[Realme GT 2 Pro] Rapper_skull:
The "magisk" directory was not copied to the device. Please make sure it's in the same folder as "run.bat" and update adb to the latest version.
[Realme GT 2 Pro] ruicc:
D:\Programas\Android\ADB>run

Android Debug Bridge version 1.0.41

Version 33.0.3-8952118

Installed as D:\Programas\Android\ADB\adb.exe

Device info:

ro.build.product = RMX3301

ro.product.name = RMX3301EEA

ro.build.oplus_nv_id = 01000100

ro.build.display.full_id = RMX3301GDPR_11_A.21_2022092223360000

ro.build.fingerprint = realme/RMX3301EEA/RED8ACL1:12/SKQ1.211019.001/S.GDPR.202209222223:user/release-keys

dirtypipe-android: 1 file pushed, 0 skipped. 27.0 MB/s (46184 bytes in 0.002s)

env-patcher: 1 file pushed, 0 skipped. 14.2 MB/s (13224 bytes in 0.001s)

startup-root: 1 file pushed, 0 skipped. 6.9 MB/s (4977 bytes in 0.001s)

magisk/: 3 files pushed, 0 skipped. 30.0 MB/s (2807528 bytes in 0.089s)

6 files pushed, 0 skipped. 26.3 MB/s (2871913 bytes in 0.104s)

Failed to set property 'a' to 'a'.

See dmesg for error reason.

Ignore device info.

Device version: Product=RMX3301 Fingerprint=realme/RMX3301EEA/RED8ACL1:12/SKQ1.211019.001/S.GDPR.202209222223:user/release-keys

stage1_lib: /system/lib64/libc++.so

stage2_lib: /system/lib/libldacBT_enc.so

stage2_param_libname: /vendor/lib/libcamxifestriping.so

d503233f PACIASP was found. Offset hook address by +4.

Offset found: shellcode_offset: a57d0 hook_offset: 5b264 first instruction: a9be7bfd

Empty space size: 2096 bytes

Run index: 1

Stage1 debug filename: /dev/.dirtypipe-0001

Shell code size: 344 0x158 bytes

startup script: /data/local/tmp/startup-root

It worked!

Waiting 30 seconds before checking if it worked...

Waiting for 0 seconds, press CTRL+C to quit ...

ro.product.name = RMX3301

Press any key to continue . . .

Yeah, my bad, now i did it right.

Now, it's on Application submitted screen...but it's taking a long time....i'm waiting for more than 2 hrs
[Realme GT 2 Pro] Rapper_skull:
This depends entirely on Realme. Try to go back, close and reopen the app, etc.
[Realme GT 2 Pro] ruicc:
Many thanks, mate, it's unlock now...i think, lol... it was a little weird...

On the apk unlock tool i,ve clicked on the "Query Verification Status", and the app went almost immediately to the START INTERFACE , there i was able to enter via ADB the fastboot flashing unlock where it shows the 2 options: not unlock the bootloader OR lock...after i choosed Unlock, appear something wrtitten in Chinese, then the phone rebooted itself....

How can i see if it's unlocked?
[Realme GT 2 Pro] Rapper_skull:
If you start the phone holding the volume up button, you can get in fastboot and see the status.
[Realme GT 2 Pro] ruicc:
Using adb reboot bootloader....showing it's unlocked...many thanks, mate :)
[Realme GT 2 Pro] Pavel_350:
Will this work on GT Neo 3? Soon I am going to visit the service center and rollback my phone to android 12. I hope that after that I can use your method to unlock the bootloader. When I have 12 android, I can send you the kernel version.
[Realme GT 2 Pro] Rapper_skull:
I added a paragraph about it to first post.
[Realme GT 2 Pro] miky03:
Thank you

I tried to unlock today the European model gt2 pro and i was successful!

Many thanks
[Realme GT 2 Pro] Pavel_350:
When I run the script it shows me this. (My phone is GT Neo 3)
[Realme GT 2 Pro] mkz14:
Awesome work guys, too bad we don't have any ROMS for this device... So only reason to unlock BL here is to use Magisk...
[Realme GT 2 Pro] Pavel_350:
on 4pda I found a method that works on all phones
[Realme GT 2 Pro] KrzysztofJ:
Hi,

I am thinking about unlocking the bootloader and get root and I have 3 questions, I will be grateful if someone is able to answer them:

1. Is it possible to roll back the firmware from RMX3301_11.C.18 to RMX3301_11_A.21?

2. Can an unlocked bootloader be locked back?

1. Do we lose any functions forever by unlocking the bootloader? I know that the widevine drm security level will change, that when the phone starts up, there will be information that the bootloader is unlocked, netflix or google play maybe will not work but after re-locking the bootloader and etting back to the stock firmware, will everything return to the state it was before unlocking the bootloader?
[Realme GT 2 Pro] Stano36:
1. There will be no rollback to version A.21 directly. Rollback is up to version A.14.

2. Yes

3. Yes

Edit:

Maybe you don't need Rollback, I have Deep Testing for RUI 4.0
[Realme GT 2 Pro] manu81cba:
I use this method last year to install India version... Now have last ota... I need Re lock bootloader...any know what is the guide to lock? No want brick my phone
[Realme GT 2 Pro] miky03:
As I know you have to rollback to Android 12 first then with adb command you can relock the bootloader again
[Realme GT 2 Pro] Rapper_skull:
You should be able to just lock it with adb, without downgrading.
[Realme GT 2 Pro] manu81cba:
if use the Oficial method the app no working View attachment 5948069
[Realme GT 2 Pro] emlo16:
After pressing "start deep testing" reboots and for a second I have only this (picrel), then it boots to the system.
[Realme GT 2 Pro] Stano36:
Try it through India
[Realme GT 2 Pro] Rapper_skull:
Unfortunately, Realme recently updated their servers. Now they return an unlock code containing the phone model. My hack changes the model from RMX3301EEA to RMX3301, so the code contains RMX3301. Then, when you reboot into fastboot, the codes are checked and they don't match, so the phone will reboot.

One solution would be to convert your device to the export ROM (India for example), and unlock the bootloader. At that point you can reinstall the European ROM, and you would still have an unlocked bootloader, but you won't be able to access fastboot anymore.
[Realme GT 2 Pro] Bozkurt_59:
Botloader açılmıyor
[Realme GT 2 Pro] Bozkurt_59:
Açıldı 😋🤣
[Realme GT 2 Pro] mind _spacer:
Hi, Is there any way to get entire raw code used for gt2 pro (the one you used)?

I want to adapt to another realme device.
[Realme GT 2 Pro] Rapper_skull:
Realme implemented a server side change that made it impossible to fool the server, but if you want to study my work out of curiosity, you can find everything in the first post.

Everything is straight from DirtyPipe-Android (make sure to build it by yourself, since my fixes are not included in the latest release), except for `run.bat/.sh` and `startup-root`, that are simple shell scripts.
[Realme GT 2 Pro] mind _spacer:
hey, I have PM ed you, can u take a look at it.
[Realme GT 2 Pro] mitriemin:
In global model cant boot to bootloader for unlock, because IN close this method. If you lock bootloader, only CN can help unlock.
[Realme GT 2 Pro] mitriemin:
realme closed IN servers for realme GT2 Pro. Recommend transfer to CN and unlock
[Realme GT 2 Pro] jakubm:
Hey i don't test this, but is possible to unlock bootloader with mtk client, root the phone, change the ro.product.name and lock the bootloader and unlock with in depth test? Why? Because hhe unlocking with mtk client not giving all options. For example the GSI not work for fastboot problem and ( I'm not sure about this but if I flash some zip's that end with error.) I try this for a some time (maybe...).
[Realme GT 2 Pro] mitriemin:
OMG🤯 Better change region via official Software Updater to unlock region (IN, maybe ID)
[Realme GT 2 Pro] Rejected77:
Solved
[Realme GT 2 Pro] moyses:
Hallo, i purchased today on Amazon.de Realme GT2 Pro

Build-Number: RMX3301_13.1.0.506(EX01)

Wenn i tried this tutorial i got Message: Failed to submit application. This phone model does not support deep testing

Any solution please
[Realme GT 2 Pro] Stano36:
Good evening, you need to change the region of the device to IN in order to unlock the bootloader.

Instructions for changing the region
[Realme GT 2 Pro] moyses:
Please how to change that.

On my Phone changed to India but same error Message? Or i need complet India Build?
[Realme GT 2 Pro] Stano36:
Dialer

*#6776#

Rolled screenshot
[Realme GT 2 Pro] moyses:
View attachment 6093802
[Realme GT 2 Pro] Stano36:
Use the new method to change the region.

Instructions

RMX3301_11_C.24_EUEX

RMX3301_11_C.24_IN
[Realme GT 2 Pro] moyses:
Just downloaded, i can't acces Local Update , i have Force activities to be resizable enabled and din t work
[Realme GT 2 Pro] Stano36:
Is the local installation option inactive? Clear application data Software update
[Realme GT 2 Pro] moyses:
Yes, that was the problem.

Now succeeded

My question now, please.

I was always on Pixel Experience, smooth, minimalist, Battery and performance.

Which Custom Rom is the best for this Phone please
[Realme GT 2 Pro] Stano36:
I can't advise you on that, I'm only a stock version user.
[Realme GT 2 Pro] moyses:
ARE YOU SATIFIED WITH sTCK RESTRICTIONSß
[Realme GT 2 Pro] Stano36:
I don't feel any restrictions, I'm happy with the stock rom.
[Motorola Moto G100 / Edge S] patwwh:
I got Motorola Edge S from China, and plan to:

1. Unlock (Succeeded !)

2a. fastboot flash boot twrp-3.5.2_11.0-2-nio.img

fastboot flash boot_b twrp-3.5.2_11.0-2-nio.img

SD card cannot work properly, as well as Adb sideload, so Official LOS.zip cannot be flashed,

OR

2b. fastboot flash boot lineage-19.1-20220604-recovery-nio.img

fastboot flash boot_b lineage-19.1-20220604-recovery-nio.img

Stucked on the Boot-up screen with Logo before Recovery mode.

3. flash Stock EU rom

(to achieve more international firmware, since I don't find independent firmware.zip)

4. flash LOS rom

N.B. [data] partition had been cleared, and I should haven't cleared [system] partition, but I cannot boot back to stock rom after Step 2, and I believe the stock rom has been removed for any accident.

Please help :cry:
[Motorola Moto G100 / Edge S] twelfth:
Might be a long shot here, but I bricked G100 when trying to flash to both slots. Use the Motorola device recovery tool to bring it back to stock and flash only ONE slot (the active one) with your rom. There's installation scripts on this forum that do exactly this for you.
[Motorola Moto G100 / Edge S] patwwh:
Initially I just flash one slot. Then I read that inconsistency between 2 slots can cause problem, so I have flash 2nd slot also, by copy-partitions-20210323_1922.zip or by "fastboot flash boot_b ...".

Now, I can also recovery and boot back to stock rom, by flash boot.img extracted from stock rom.zip with the same version as mine.

So the KEY problem is:

Under TWRP recovery loader, with ADB sideload turned on, the PC seems cannot connect & send below crucial command to Android:

$ fastboot flash boot lineage-19.1-20220604-recovery-nio.img

N.B. I have already used USB driver from Motorola, so ADB commands can run without problem, except ADB Sideload mode. Also, I have tried using USB 2.0 hub port with 2.0 cable (4-pins) as well.
[Motorola Moto G100 / Edge S] zsiezi:
TWRP for nio is not stable (yet). Use the instructions for lineageos official.
[Motorola Moto G100 / Edge S] outlaw0703:
Late here but on 2a step, you can actually copy the ROM zip to internal storage since windows can detect your phone as storage device when it is in TWRP recovery.