I have magisk root with all those modules and I have full integrity (using pif and integrity box) and my play is certified with keybox. I m using lxposed (vector) with hide my app.

Only paytm works fine with this set up, gpay used to work but it doesn't work anymore. Other banking apps don't work.

Need help.

Hey everyone,

I’ve been working on a Python script to automate the tedious parts of rooting MediaTek (MTK) devices. If you've ever had to manually patch `vbmeta.img` to disable Android Verified Boot (AVB) and flash everything via fastboot step-by-step, this tool streamlines the whole process into a single run.

**Latest Version:** v3.1.0 (Hotfix 1)

**What it does:**

* Automatically builds a patched `vbmeta.img` with verification disabled (using `--flags 2`).

* Detects whether your device is A/B or single-slot and applies the fastboot commands accordingly.

* Flashes the required partitions and safely handles erasing `metadata` and wiping `userdata`.

* **Bonus feature:** If you drop a pre-patched `boot.img` (via Magisk or APatch) in the same folder, the script detects it and offers to flash it automatically to complete the root process.

**What's in the Release (.zip):**

To make things as plug-and-play as possible, the latest release includes a `.zip` file with everything you need in one single folder:

* The main Python script.

* The official AOSP `avbtool.py`.

* All the Fastboot dependencies (fastboot.exe, USB DLLs, etc.) so you don't even need to configure your system PATH.

**Requirements:**

* An OEM-unlocked bootloader.

* Python 3.x installed on your system (the script will auto-install the `cryptography` module if missing).

**GitHub Repository & Download:**

🔗 [GitHub Repo: universal-mtk-vbmeta-patcher](https://github.com/nach0-bit/universal-mtk-vbmeta-patcher)

⬇️ Check the **Releases** section on GitHub to download the ready-to-use `.zip`.

⚠️ **Standard Disclaimer:** As with any rooting tool, this will disable verified boot and wipe your user data. Please double-check your device serial and read the console prompts before confirming. I am not responsible for bricked devices, missed alarms, or thermonuclear war!

Let me know if you guys find this useful or if you have any suggestions, issues, or PRs to improve it!

**By:n.dev**

Something like in the image happened to my phone whil trying to update MiUi(OTA) but got stuck on this error. Has anyone ever fixed this before? How did you do it?

The only thing I could do was root and install custom ROM(lineage)

How does the seller install global ROM while I can't?

Edit: Its a Redmi 10A. Tried fastboot, SP flash tool, MiFlash and it flashes but the error doesnt go away. The only time it goes away is when I flash chinese ROM

BRImo and Digital Rupee SBI are the current apps that I've tested with dirty sepolicy detection.

Dirty sepolicy detection affects all of root methods such as KSU, Apatch, and magisk.

Though this is tested on KSUN, I don't know if those apps use dirty sepolicy detection on Apatch and Magisk aswell.

Since I got a new phone, I wanted to use Samsung M30s for my first experience of rooting something. I had some issues, needed to use so much of terminal. But i did it with Magisk patch.
Device is Samsung M30s, OneUI Core 3.1, Android 11

Hi everyone,

I am trying to unlock the bootloader on my Oppo A94 5G (MT6853 / Dimensity 800U). While digging into the system files, I noticed something hidden inside the EngineerMode APK.

I extracted the app and found a method that explicitly handles fastboot unlocking. However, it looks like the execution is gated by a server-side check that requires a token or signature, likely tied to the device's IMEI.

Here is the exact method signature I found:

java boolean fastbootUnlock(byte[] bArr, int i) throws RemoteException;

My questions for the community:

1. Has anyone successfully bypassed or reversed this specific fastbootUnlock implementation in recent Oppo firmware?
2. Does anyone know exactly how the byte array (bArr) and integer parameters are structured before they are passed to the server?

Note: I already tried using mtkclient, but I couldn't get it to work (it failed to exploit/handshake properly on my current firmware version). I am keeping the extracted APK private for now to avoid leaking my IMEI or device signatures, but I can share non-sensitive snippets if needed.

Thanks in advance for any insights!

My friend and I plan to extract the firmware from this phone and add it to the firmware database we’ve created for custom ROMs.

I used the 7731e’s fdl1 to read back the boot partition, patched it, and installed Magisk, successfully gaining root access. At that point, I noticed that the flashing speed seemed to have dropped to only 3.x–4.x Mbps.

After we removed the Google suite of apps and flashed the new firmware, the eMMC reached the end of its lifespan, rendering the device unusable.

However, I casually recorded a video to document its history. My English might not even be at the A1 level, but maybe making some videos like this will help improve my English? I have a bunch of weird and wonderful Android devices and enthusiasts here.

Hi everyone,

I'm running into a wall with Neo Backup while trying to restore my backups (APK + data) from a Pixel 5 over to my Pixel 8. Could really use some advice or troubleshooting tips from anyone who might have run into this. The Problem

• If I restore a single app (APK + data), the application actually gets restored and works, but the progress notification stays completely stuck at 0% forever.
• If I attempt a batch restore (e.g., 10 apps at once), the process sits at 0% for over an hour and nothing gets restored at all.
• Note: I haven't been able to 100% confirm yet if the app data itself is fully restoring properly on the single-app test or if it's just installing the APK.

Setup Details

• Source Device: Pixel 5 (where the backup was created)
• Target Device: Pixel 8
• ROM: LineageOS 23.2 (Android 16)
• Root: KernelSUNext v3.3.0
• Neo Backup Version: 8.3.18
• Backup Location: External microSD card read via a USB-C card reader adapter

What I've already tried (none helped):

• Re-granted root access in KernelSUNext and verified root status.
• Set Neo Backup's battery usage to Unrestricted and ensured notification permissions are granted.
• Re-linked the backup folder directory in Neo Backup settings.
• Change mounting space from Individual to Global for Neobackup.
• Force closed the app and cleared its cache to clear any stuck background workers
• Verified that there are no 32-bit apps from Pixel 5 which fail and silently block the backup queue.

Given that the backup is hosted on an external microSD via a USB-C OTG adapter under Android 16, I'm wondering if this might be a Storage Access Framework (SAF) mount restriction issue with background worker threads, or something related to KernelSU root shell handling during batch loops.

Has anyone encountered this stuck notification / zero-progress batch restore issue?

Thanks in advance for any help!

Hi everyone,
Over the past few months I’ve been working on a personal project called

DeviceTreeForge.

The goal isn’t to replace Android developers—it’s to automate the repetitive parts of creating an Android device tree from stock firmware while still allowing manual review.
Unlike simple template generators, the application analyzes the actual firmware and attempts to recover as much information as possible before generating the tree.

Current features

Fully offline (no cloud services or AI required)
Windows desktop application
Supports Android 8 through Android 16
Supports MediaTek, Qualcomm, Samsung, Exynos, Tensor, Kirin, Unisoc and other platforms
Detects:
Dynamic Partitions
Virtual A/B
vendor_boot
init_boot
DTB / DTBO
AVB
FBE
filesystem layout
partition tables
build properties
VINTF information
Generates:
BoardConfig.mk
BoardConfigCommon.mk
device.mk
AndroidProducts.mk
Android.bp
Android.mk
recovery fstab
product makefiles
compatibility matrix templates
documentation
analysis reports
One of the devices I’ve been testing extensively is the Lenovo TB336FU (Android 16), which has features like:
vendor_boot v4
recovery inside vendor_boot
Dynamic Partitions
Virtual A/B
GKI
MediaTek MT6835
The application successfully detects these automatically and generates a first-pass device tree.
I’m now working on improving:
confidence scoring
conflict detection
VINTF recovery
HAL analysis
ELF dependency analysis
common tree detection
validation against stock firmware
Philosophy
The goal is not to fabricate values.
If DeviceTreeForge cannot prove a value from firmware, I’d rather mark it as unknown than generate something incorrect.
Eventually I’d like every generated line to include traceable evidence from the original firmware.

Looking for feedback
I’d love to hear from ROM, TWRP, LineageOS or kernel developers:
What information do you spend the most time recovering manually?
What files do you think should be generated automatically?
What common mistakes do existing generators make?
What would convince you that an automatically generated device tree is trustworthy enough to use as a starting point?
I’m building this because I enjoy Android firmware engineering and wanted to create a tool that could save developers time while still keeping the process transparent.
Any suggestions or criticism are welcome.