Home > Root

Root any MediaTek Device on Locked Bootloader

In this guide, we will show you the steps to root your MediaTek device having a locked bootloader. Android has literally become a synonym with the word “customization”. Well, if an OS is open-source in nature, then a plethora of mods and tweaks are always on the cards. We aren’t just talking about installing launchers and icon packs, there exists another less traveled territory that beholds a plentitude of tweaks.

This road leads us to custom development, where the possibilities stand endless. For example, you could replace the device’s stock recovery with a custom one such as TWRP. Likewise, you could also install custom ROMs, or gain access to the system partition. The latter is possible by rooting the device via Magisk- flashing Magisk App via TWRP or patching and flashing the boot.img via Fastboot Commands.

This way you could then flash binaries such as Magisk Modules, Substratum Themes, Xposed Frameworks, and the likes. However, to carry out any of the aforementioned tweaks, you need to checkmark a major requirement- your device’s bootloader needs to be unlocked. Or should it? Well there now seems to be a workaround that allows you to root your Mediatek device directly on a locked bootloader.

As a result, your device warranty might not be nullified and there will be no data loss as well. Furthermore, in some Xiaomi MTK devices, you have to wait around 168 hours before you could start with the unlocking process. But using this guide, you could easily skip this wait time as well (since no unlocking is required!). So without any further ado, let’s get started with the instructions.

How to Root any MediaTek Device on Locked Bootloader

root mediatek locked bootloader

Before starting off with the steps, make sure to take a backup of all the data on your device. Furthermore, the below instructions are listed under separate sections for ease of understanding. Make sure to follow in the exact same sequence as mentioned below. Droidwin and its members wouldn’t be held responsible in case of a thermonuclear war, your alarm doesn’t wake you up, or if anything happens to your device and data by performing the below steps.

Important Points

  • This guide to root MediaTek devices on a locked bootloader is applicable for devices that come with MediaTek ARMV8 chipset. These include the MT67xx, MT816x, MT817x, or MT6580 chipsets. [Credits: XDA Senior Member diplomatic.]
  • Since the bootloader is locked, you wouldn’t be able to modify the boot partition. As a result, you should not use the Direct Install Method of Magisk to update it.
  • Furthermore, as of now, this method works on Magisk v19.4 to v21.4 only. It isn’t compatible with Magisk v22. But this shouldn’t be a cause of concern as the earlier builds work pretty well without any issue. With that said, there is still a way of updating magisk, which we have mentioned at the end of this guide. Interested users should definitely check it out.

So keeping all these points in mind, let’s start off with the guide to root your MediaTek device with a locked bootloader.

STEP 1: Set Up init.d Support

  1. To begin with, download and install the init.d scripts support App from Play Store.
  2. Now create a new folder on your Internal Storage and name it init.d.
    create init.d folder root mediatek locked bootloader
  3. After this, create a new folder inside this init.d folder and name it bin.
    create bin folder root mediatek locked bootloader
  4. Now launch the init.d scripts support app and set it up as follows:
    • Try to acquire root privileges: Leave it Disabled.
    • Run scripts at boot time: Enable it.
    • Execution delay: Open this option, check-mark No Delay, and tap Accept.
      no execution delay root mediatek
    • Selected folder: Select the init.d folder, tap on use this folder, and then hit Allow in the permission prompt.
      init.d folder permission root mediatek locked bootloader
    • Execute all files in the selected folder: Enable it.

init.d script support setup

Before moving ahead, make sure that the init.d script support on your device exactly matches the value as is shown in my screenshot. Furthermore, the Selected Folder patch should be: /storage/emulated/0/init.d. If that is all well and good, then you are good to proceed ahead to root your MediaTek device on a locked bootloader.

STEP 2: Setting up Magisk Boot and MTK-SU

  1. Download and install the Magisk Manager app on your device.
  2. Next up, download the magisk-boot.zip file and extract its content. Upon extraction, you should get the magisk-boot.sh file. Transfer it to the init.d folder.
    magisk boot sh root mediatek locked bootloader
  3. Then download the mtk-su_r23.zip file and extract it. You should get two folders: arm and arm64. Head over to the folder that corresponds to your device’s CPU architecture [Reference: How to Check Android Device’s CPU Architecture] and copy the resultant mtk-su file from that folder.
    mtk-su zip root mediatek locked bootloader
  4. Now paste that copied mtk-su file to the bin folder (which you have created inside the init.d folder).
  5. Next up, download the Magisk ZIP [any version between v19.4 to v21.4]. Please don’t use the latest Magisk as of now. You may update it to the latest build after the setup is complete (instructions for which are given at the end of this guide).
  6. Now extract this Magisk ZIP file, go to its arm folder and copy the required magiskinit file [magiskinit for 32 bit and magiskinit64 for 64-bit devices].
    magisk zip root mediatek locked bootloader
  7. Move this file to the init.d > bin folder on your device. If you have downloaded the 64 bit, then rename it from magiskinit64 to magiskinit.
  8. When that is done, launch the init.d scripts support app and tap on Run scripts now.

    run scripts now root mtk

  9. The script should be executed within a few seconds and you should the output along the following lines:
    Temporary root by diplomatic@XDA Home 
    URL: https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213 
    UID: 0 cap: 3fffffffff selinux: permissive 
    Load policy from: /sys/fs/selinux/policy 
    20.3:MAGISK (20300) 
    client: launching new main daemon process
  10. Now launch the Magisk Manager app and you shall get a Requires Additional Setup prompt. Tap on Yes and wait for the process to complete. Your device might automatically reboot once and the process stands complete.

So with this, we conclude the guide on how to root any MediaTek device on a locked bootloader. If you have any queries concerning the aforementioned steps, do let us know in the comments. We will get back to you with a solution at the earliest. With that said, let’s now turn our attention to how to update the Magisk app. Follow along.

FAQ1: How to Update Magisk on a Locked Bootloader Rooted MediaTek Device

Since your device’s bootloader is locked, you wouldn’t be able to update it via the conventional Direct Install method. Rather, download the latest Magisk ZIP file, extract it, copy the magiskinit file, and copy it to the bin folder. Then launch the init.d scripts support app and run the scripts.

So this is all from this section. I will be populating this FAQ section with more queries and tips as and when I get hold of the same. In the meantime, if you have any questions on the steps to root any MediaTek device on a locked bootloader, feel free to drop them in the comments below.

  • Don Bentley

    As of 2021 mediatek has blocked access to the bootloader via
    Software methods and hardware exploit methods.
    This also means no access to the system files needed to
    switch out for root , or even temp root .

    I would appreciate if you conveyed this in your article ,
    and let your readers also know that if they purchased their
    mediatek devices recently as of 2021 and newer ,

    Its completely locked down with protection mechanisms enabled to
    prevent unlocking and or root.

    • Erwin Smith

      Is it true ? So the above mentioned method won’t work for OnePlus Nord CE 2 ? It works on MediaTek 900 Dimensity

      • Erwin Smith

        I mean device operates on MediaTek 900 Dimensity not this method. Just to clarify

  • Umar Zeb

    My init.d app shows me that .” Mtk_su is inaccessible or Not Found”.

  • Islam Ghunym

    I have followed the instructions carefully on my Realme 7 device, but once I reached to click on “Run Scripts now” the following results are shown:

    Can’t acquire root privileges (Nov 14 at 10:42:01 AM)

    Executing scripts from /storage/emulated/0/init.d (Nov 14 at 10:42:01 AM)


    /data/user/0/com.ryosoftware.initd/files/script-6043333492741872052[139]: ./mtk-su: inaccessible or not found

    However as the guide mention “Try to acquire root privileges” is Disabled

  • I tried it on an LG K61. Nothing. Says that it can’t aquire root privileges. Any help?

  • Can you use this method with the bootloader unlocked successfully or does it have to be locked?

    • Sadique Hassan

      Hi Rosco, I haven’t tried this on an unlocked bootloader. For that, I go for the conventional method, such as the fastboot oem unlock command. Could you let me know the device you’re using?

      • Do you have ways to unLock bootLoader for Lenovo S5 K520? My phone stock on bootLoader after updating Magisk… Please heLp me?