Root any MediaTek Device on Locked Bootloader

In this guide, we will show you the steps to root your MediaTek device having a locked bootloader. Android has literally become a synonym with the word “customization”. Well, if an OS is open-source in nature, then a plethora of mods and tweaks are always on the cards. We aren’t just talking about installing launchers and icon packs, there exists another less traveled territory that beholds a plentitude of tweaks.

This road leads us to custom development, where the possibilities stand endless. For example, you could replace the device’s stock recovery with a custom one such as TWRP. Likewise, you could also install custom ROMs, or gain access to the system partition. The latter is possible by rooting the device via Magisk- flashing Magisk App via TWRP or patching and flashing the boot.img via Fastboot Commands.

This way you could then flash binaries such as Magisk Modules, Substratum Themes, Xposed Frameworks, and the likes. However, to carry out any of the aforementioned tweaks, you need to checkmark a major requirement- your device’s bootloader needs to be unlocked. Or should it? Well there now seems to be a workaround that allows you to root your Mediatek device directly on a locked bootloader.

As a result, your device warranty might not be nullified and there will be no data loss as well. Furthermore, in some Xiaomi MTK devices, you have to wait around 168 hours before you could start with the unlocking process. But using this guide, you could easily skip this wait time as well (since no unlocking is required!). So without any further ado, let’s get started with the instructions.

• How to Install TWRP on MediaTek using SP Flash Tool
• How to Root any MediaTek Device Using SP Flash Tool
• A Detailed Guide to Install OTA Updates in Rooted Android Device
• How to Unbrick any MediaTek Phone using SP Flash Tool

How to Root any MediaTek Device on Locked Bootloader

Before starting off with the steps, make sure to take a backup of all the data on your device. Furthermore, the below instructions are listed under separate sections for ease of understanding. Make sure to follow in the exact same sequence as mentioned below. Droidwin and its members wouldn’t be held responsible in case of a thermonuclear war, your alarm doesn’t wake you up, or if anything happens to your device and data by performing the below steps.

Important Points

• This guide to root MediaTek devices on a locked bootloader is applicable for devices that come with MediaTek ARMV8 chipset. These include the MT67xx, MT816x, MT817x, or MT6580 chipsets. [Credits: XDA Senior Member diplomatic.]
• Since the bootloader is locked, you wouldn’t be able to modify the boot partition. As a result, you should not use the Direct Install Method of Magisk to update it.
• Furthermore, as of now, this method works on Magisk v19.4 to v21.4 only. It isn’t compatible with Magisk v22. But this shouldn’t be a cause of concern as the earlier builds work pretty well without any issue. With that said, there is still a way of updating magisk, which we have mentioned at the end of this guide. Interested users should definitely check it out.

So keeping all these points in mind, let’s start off with the guide to root your MediaTek device with a locked bootloader.

STEP 1: Set Up init.d Support

1. To begin with, download and install the init.d scripts support App from Play Store.
2. Now create a new folder on your Internal Storage and name it init.d.
   
3. After this, create a new folder inside this init.d folder and name it bin.
   
4. Now launch the init.d scripts support app and set it up as follows:
   • Try to acquire root privileges: Leave it Disabled.
   • Run scripts at boot time: Enable it.
   • Execution delay: Open this option, check-mark No Delay, and tap Accept.
     
   • Selected folder: Select the init.d folder, tap on use this folder, and then hit Allow in the permission prompt.
     
   • Execute all files in the selected folder: Enable it.

Before moving ahead, make sure that the init.d script support on your device exactly matches the value as is shown in my screenshot. Furthermore, the Selected Folder patch should be: /storage/emulated/0/init.d. If that is all well and good, then you are good to proceed ahead to root your MediaTek device on a locked bootloader.

STEP 2: Setting up Magisk Boot and MTK-SU

1. Download and install the Magisk Manager app on your device.
2. Next up, download the magisk-boot.zip file and extract its content. Upon extraction, you should get the magisk-boot.sh file. Transfer it to the init.d folder.
   
3. Then download the mtk-su_r23.zip file and extract it. You should get two folders: arm and arm64. Head over to the folder that corresponds to your device’s CPU architecture [Reference: How to Check Android Device’s CPU Architecture] and copy the resultant mtk-su file from that folder.
   
4. Now paste that copied mtk-su file to the bin folder (which you have created inside the init.d folder).
5. Next up, download the Magisk ZIP [any version between v19.4 to v21.4]. Please don’t use the latest Magisk as of now. You may update it to the latest build after the setup is complete (instructions for which are given at the end of this guide).
6. Now extract this Magisk ZIP file, go to its arm folder and copy the required magiskinit file [magiskinit for 32 bit and magiskinit64 for 64-bit devices].
   
7. Move this file to the init.d > bin folder on your device. If you have downloaded the 64 bit, then rename it from magiskinit64 to magiskinit.
8. When that is done, launch the init.d scripts support app and tap on Run scripts now.

   

9. The script should be executed within a few seconds and you should the output along the following lines:

   Temporary root by diplomatic@XDA Home 
   URL: https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213 
   -------------------------------------------------- 
   /data/data/com.ryosoftware.initd/files/bin 
   UID: 0 cap: 3fffffffff selinux: permissive 
   Load policy from: /sys/fs/selinux/policy 
   20.3:MAGISK (20300) 
   client: launching new main daemon process

10. Now launch the Magisk Manager app and you shall get a Requires Additional Setup prompt. Tap on Yes and wait for the process to complete. Your device might automatically reboot once and the process stands complete.
    

So with this, we conclude the guide on how to root any MediaTek device on a locked bootloader. If you have any queries concerning the aforementioned steps, do let us know in the comments. We will get back to you with a solution at the earliest. With that said, let’s now turn our attention to how to update the Magisk app. Follow along.

FAQ1: How to Update Magisk on a Locked Bootloader Rooted MediaTek Device

Since your device’s bootloader is locked, you wouldn’t be able to update it via the conventional Direct Install method. Rather, download the latest Magisk ZIP file, extract it, copy the magiskinit file, and copy it to the bin folder. Then launch the init.d scripts support app and run the scripts.

So this is all from this section. I will be populating this FAQ section with more queries and tips as and when I get hold of the same. In the meantime, if you have any questions on the steps to root any MediaTek device on a locked bootloader, feel free to drop them in the comments below.