[Android General] WeiKaiTsai:
Thank you @mvikrant97 for helping me piece this puzzle together.

This approach uses MTK Client and SP Flash Tools. Requires downloading earlier official stock ROMs. No TWRP required nor available.

I'm no developer or programmer of any kind, so the steps are written with a lot of details that some may find excessive. I don't know what others know and don't know about unlocking bootloader and rooting.

The stock ROM I started this with is TW's latest stock ROM, 14.0.4.0 (Jan. 10, 2024). Downgraded to Global stock ROM, 14.0.9.0 (Mar. 8, 2023)

Required files and programs

sdk platform tools (download)

https://developer.android.com/tools/releases/platform-tools#downloads.html

google android usb driver (download)

https://developer.android.com/studio/run/win-usb

python 3.9 and above + Git (download and install)

https://www.python.org/downloads/

https://git-scm.com/

mtkclient (download)

https://github.com/bkerler/mtkclient/releases/

usbdk (download, install, and restart)

https://github.com/daynix/UsbDk/releases/

mtk usb driver (download and install)

https://androidmtk.com/download-mtk-usb-all-drivers

sp flash tools (download)

https://spflashtools.com/ or

https://androidmtk.com/smart-phone-flash-tool

as mentioned on the androidmtk link, you will need v5 of this and not v6 because the firmware package comes with .txt scatter files. v6 is for .xml scatter files

libusb-win32 driver (download)

https://github.com/mcuee/libusb-win32/

https://sourceforge.net/projects/libusb-win32/

go to their latest stable release, and download the bin .zip.

mtk bypass utility, exploits collection, and libusb-1.0.dll (download)

https://github.com/MTK-bypass/bypass_utility/releases/

https://github.com/MTK-bypass/exploits_collection/releases

Not sure if "libusb-1.0.dll" is needed from "bypass_utility" github page. I think with libusb-win32 installed correctly, you shouldn't need this. You can place this .dll under the extracted "bypass_utility" folder.

Old FASTBOOT ROM for Redmi A2 (download)

https://xiaomirom.com/en/download/r...ter-stable-V14.0.9.0.TGOMIXM/#global-fastboot

https://miuirom.org/load?o=redmi-a2&v=14.0.10.0.TGOMIXM&l=en&t=Fastboot

There is no way around flashing the older firmware without needing a data wipe (factory reset) I know of, so back up any important files you have on the device first. One link is 14.0.9 Global but slower, the other is 14.0.10 Global but faster. I used 14.0.9, but 14.0.10 should work too.

Magisk (download)

https://github.com/topjohnwu/Magisk

Download the version you need. If you dont know which, then probably just try the latest stable one. I used magisk canary (27001) on 14.0.9 Global, and it works.

BROM Mode for Redmi A2

Vol- and Vol+ held together, and then connect to USB. After connecting to USB for a few seconds, if there are no applications trying to connect to the device's BROM mode, the device will boot into Fastboot. This is very annoying because it wastes a lot of time having you boot up the phone just to power it off. To avoid this, for any commands we launch in SP Flash Tool or MTK Client, always execute the commands first, let the application wait for a BROM mode device, hold down the Redmi A2 Vol- and Vol+, and connect the USB cable.

Start

On Redmi A2

1. Settings -> About Phone -> Build Number. Tap on build number repeatedly until you unlock developer options.

2. Settings -> System -> Developer Options -> OEM Unlocking. Toggle oem unlocking on. If it asks to reboot device, then reboot device.

3. While we are at it, might as well also enable Developer Options -> USB Debugging. (this toggle resets on firmware flash, so it's optional for now).

Installing ADB/Bootloader Drivers

1. With USB Debugging enabled, plug device in to PC. Make sure to monitor the phone screen so you "Allow" the PC to connect to phone through ADB. If this happens, then the PC likely already has the proper ADB driver for you.

2. On Windows: Control Panel -> Hardware and Sound -> Device Manager.

3. Find your device. Right Click -> Update Driver -> Browse... -> Let me pick... -> Show All Devices -> Next -> Have Disk...

4. Browse and navigate to the previously downloaded Google Android USB Driver folder -> select "android_winusb.inf".

Here, you might get a compatibility error message. It's okay. The point of this is to familiarize and make sure you can do this step later when needed. If there is no error, then just select the one that's only the ADB driver.

Installing MTK Client

1. First download and install Python 3.9 or above, and install Git.

2. Extract the MTK Client folder.

The "README.MD" includes instructions on installation, but that isn't necessary. I at first tried to follow the instructions, but they didn't work at all. However, I did redundantly install it again by slightly modifying the installation instructions and borrowing a few lines from the linux instructions. I doubt it's needed, but if anyone is unsure, then this is how I redundantly installed it:

- move the "requirements.txt" to the "mtkclient" folder

- select empty space on address bar to select the address text -> replace that text with "cmd" -> hit "Enter" key

- in command prompt, type in and hit enter: pip3 install -r requirements.txt

- go back to "mtkclient-x.xx" folder

- select empty space on address bar to select the address text -> replace that text with "cmd" -> hit "Enter" key

- in command prompt, type in and hit enter: python setup.py build

- in command prompt, type in and hit enter: python setup.py install

Installing SP Flash Tool

1. Extract the SP Flash Tool folder.

Setting Up MTK Bypass Utility for SP Flash Tools

(Make sure MediaTek USB Driver is installed first)

Install Python dependency:

1. Go to Python installation directory. It is usually under "C:\Users\[your username]\AppData\Local\Programs\Python\

2. Go into the folder that has the installed python files: select empty space on address bar to select the address text -> replace that text with "cmd" -> hit "Enter" key

3. Type in and hit enter to run command: python pip install pyusb pyserial json5

(or, if the first one doesn't work: python -m pip install pyusb pyserial json5)

The steps below using MTK Bypass Utility can probably be simplified with the Auth Bypass Tool v7:

https://androidfilehost.com/?fid=17825722713688274960

Download this tool. Before running SP Flash Tools, run this -> "Disable Auth" -> connect device in BROM mode (hold VOL- and VOL+, connect USB) -> let the tool bypass auth.

When bypass is done, you should be able to flash the ROM in SP Flash Tools without authentication related errors. You likely won't need to locate the "auth_sv5.auth" authentication file in SP Flash Tool if you use this tool.

If you want to do this the harder but more transparent way with MTK Bypass Utility:

1. Extract the "bypass_utility" and "exploits_collection" folder.

2. Go to Windows Defender, and allow all the files that Windows Defender blocked. Usually, it's the "exploits.py" and "bruteforce.py" that gets blocked. If you can't find the files still, you can download from the Bypass Utility github directly.

3. Create a new folder under "bypass_utility" folder called "payloads". Go to "exploits_collection" folder's "payloads", and copy mt6765_payload.bin to "bypass_utility\payloads".

4. Copy default_config.json5 from "exploits_collection" folder into "bypass_utility" folder.

(Move "libusb-1.0.dll" to "bypass_utility" folder if you downloaded it from bypass_utility's github)

5. Extract the "libusb-win32-bin" folder.

6. Go into "bin" subfolder, and open read.me to make sure which one your PC uses.

7. Run the appropriate "install-filter...exe" -> Install a device filter -> Next

8. Be ready to react quickly here:

- Connect device in BROM mode (hold VOL- and VOL+, connect USB). Once the install-filter program detects your device, the device should be shown under "MediaTek USB Port".

- QUICKLY select and install the MediaTek USB Port before the device reboots. If you fail to install before the device reboots, just repeat until you get it.

Make sure the reboot happens AFTER the installation completes. A strategy is to remember about where the device will show up on the Device Selection screen, so you can select it quickly and click install.

9. Go to "bypass_utility" folder: click empty space on address bar to select the address text -> replace that text with "cmd" -> hit "Enter" key

- In command prompt, type in and hit enter: python main.py

10. It will wait for your device, so connect device through BROM mode by: holding VOL- and VOL+ -> connect USB.

This should run itself and succeed with "Protection Disabled".

11. Don't close the command prompt here yet, and move on to the next step with flashing firmware.

Downgrading and Flashing Fastboot ROM Firmware 14.0.9 (or 14.0.10 should work too)

The firmware that I used to downgrade is 14.0.9. In this thread, user @mvikrant97 noticed that an August/September 2023 firmware update patched the MTK Client's bootloader unlock. Therefore, it's likely that any firmware earlier than this time will work. But, to save time, I just went with the oldest firmware I could find -- 14.0.9 Global Fastboot ROM.

Flashing this downgrade will require you to wipe data. You can either do it along with the Fastboot ROM flash in SP Flash Tool; or you can take the chance, let the device fail to boot after flashing and use the error dialog during boot up to let the device wipe data for you. Either way, you will lose your user data, so backup anything you don't want to lose.

1. Make sure you downloaded the Fastboot ROM, and not the Recovery ROM nor the OTA Update.

2. Open SP Flash Tool folder.

3. In SPFT folder, run "flash_tool.exe"

4. Go to "Download" tab.

5. Here are 3 files SPFT needs to locate before flashing:

- Download Agent: "MTK_AllInOne_DA.bin" that is in the SPFT folder, should be loaded already by default.

- Scatter-loading File: "MT6765_Android_scatter.txt" under the ROM's "images" folder.

- Authentication File: "auth_sv5.auth" also under the ROM's "images" folder. (likely not needed if you ran "Auth Bypass V7" or "MTK Utility Bypass" correctly)

6. In the small drop down menu: select "Download Only".

Once you locate the scatter-loading file for SPFT, a list appears, with the partition names listed and the respective files to be flashed to those partitions.

7. Though it should be all checked by default, still make sure all boxes are checked.

8. Hit the green downward arrow saying "Download".

Now, SPFT will wait for a BROM mode device.

9. Hold down VOL- and VOL+ on device, and connect to USB.

10. With the drivers installed correctly, SPFT will now flash, and you will see a progress bar at the bottom that's either red or yellow.

11. When done, a small dialog window will notify the flashing is complete. Unplug the device and power up the device.

The device may take a few seconds before you can boot up. I usually need to hold power button down once for a few seconds, release, then another time to boot up.

12. Once it loads to the new phone setup screen, we know the downgrade succeeded. Power it off.

MTK Client Unlock Bootloader

Now, the device is in a state that lets MTK Client unlock its bootloader. Without the downgrade, the bootloader unlock will "succeed" on the MTK Client, but MIUI blocks it and will prevent the device from booting into the OS.

If we try to unlock bootloader with MTK Client before properly downgrading, the device will be stuck in a "dm-verity corrupted" bootloop if you try to proceed with booting the OS. Attempting to relock through MTK Client or using "fastboot oem cdms" will not resolve the "dm-verity corrupted" bootloop. The only fix from here I know is to flash a stock firmware.

It is possible however, to attempt booloader unlock with MTK Client, get the "dm-verity corrupted" bootloop, flash downgrade firmware, and immediately get bootloader unlock on boot up. This is the process I went though during my trial-and-error.

When we unlock the bootloader on a downgraded firmware, that message will appear too, but that message can be removed with a simple fastboot command later.

1. In the "mtkclient-x.xx" folder: click empty space on address bar to select the address text -> replace that text with "cmd" -> hit "Enter" key

2. In command prompt, type in and hit enter: python mtk e metadata,userdata,md_udc

MTK Client will now, like SPFT, wait for a BROM mode device.

3. Hold Vol- and Vol+, and connect USB to enter BROM mode and let MTK Client connect to execute the command.

4. In command prompt, type in and hit enter: python mtk xflash seccfg unlock

5. In command prompt, type in and hit enter: python mtk reset

6. Unplug the device, and boot up the device while holding down the VOL- button to enter Fastboot mode.

If you want to check, you can also just boot up the device, and see if the boot up screen now shows a small unlocked key icon at the top. If so, then bootloader unlock is successful. You will also see the "dm-verity corrupted" message. You can either 1) let the device boot off and proceed to next step, or 2) let the device continue to boot to make sure you're not stuck in a bootloop.

7. If not already, put the device into Fastboot mode by holding VOL- while booting or rebooting. Go to the downloaded "platform-tools" folder:

- click empty space on address bar to select the address text -> replace that text with "cmd" -> hit "Enter" key

- in command prompt, type in and hit enter: fastboot devices

Here, you will likely get nothing, and this is where we need to do the google android usb driver selection steps. If you do see the device, still do the following steps to prevent the fastboot commands failing. Up to you, you can always come back to do this if need be.

1. To find the device in device manager, you can unplug and replug the device while in Fastboot mode. You should see that the device has an "!" exclamation mark on its icon, indicating some Windows' device recognition error.

2. In Fastboot mode, when you browse to and select "android_winusb.inf", there should be no compatibility error message. Choose the "ADB/Bootloader" driver.

3. Then, try again the command prompt: fastboot devices

It should appear now.

4. In command prompt, type in and hit enter: fastboot oem cdms

5. In command prompt, type in and hit enter: fastboot reboot

The device should reboot properly now, with bootloader unlocked but without the "dm-verity corrupted" error message.

Installing Magisk Through Patched Boot.img

Let the device boot up, and bear through the annoying setup screens. Then, re-enable Developer Options and USB Debugging.

In the Settings search bar, search "USB", and go into any one that reads "USB Preferences > Connected Devices". Plug in the device, and select "File Transfer".

1. Move the downloaded magisk .apk to a place in phone storage where you can find.

2. Go to the Fastboot ROM folder's "images" folder, and COPY "boot.img" to phone storage.

Unless you want to redownlod the ROM in case of any error, do not cut (ctrl+x) the boot.img.

3. On Redmi A2, disable Google Play Protect in the Google Play Store.

4. Install the magisk .apk

When I tried to install in the Redmi A2's stock "Files" bloatware app, it doesn't have permission to installing apks, so I installed another file manager to install the apk.

If you don't plan on installing any files manager, put the magisk apk into the "platform-tools" folder. Then, 1) go to Developer Options and turn off "Verify apps over USB" 2) go to "platform-tools" folder and launch cmd there 3) use command prompt: adb install [magisk apk file name, including the ".apk" extension]

5. Open up magisk app, there are two "Install" buttons. Go to the "Magisk" one. Then go with the only available "Patch boot.img" option. There, select the "boot.img" you copied from Fastboot ROM folder. Let magisk patch.

6. Disconect and reconnect USB, Settings -> "USB Preferences > Connected Devices" -> "File Transfer". You should also have a notification show up on the status bar that lets you set "File Transfer".

7. Copy the PATCHED boot.img. out to "platform-tools" folder. Rename it to something recognizable as the patched boot.img. e.g. patchedboot.img

8. Enter Fastboot mode and connect USB. If device fails to be recognized, do the previous steps in selecting the "ADB/Bootloader" google usb android driver.

9. Launch cmd in the "platform-tools" folder, check with command "fastboot devices".

10. Then, use this command to directly flash the patched boot.img: fastboot flash boot_a patchedboot.img

In the SPFT, when we downgraded the firmware, we see that boot.img is flashed into the partition "boot_a".

10. Command: fastboot reboot

If the device isn't stuck in bootloop or gets bricked, then magisk is installed. You might need to reboot once more when launching magisk to finalize root.