2

I couldn't find a guide online to root my Oppo Realme 2 (RMX1805, Color OS Version 6.0, Android Version 9). So how can I root my Oppo Realme 2?

Update: I have unlocked my bootloader following the instructions here.

1
2
+25

first step is unlock bootloader, which you have done already. i will post this step as mandatory

1) unlock bootloader: WARNING all data lost

  • download latest platform-tools to PC
  • enable OEM unlocking in developer options
  • reboot device into bootloader mode (keep holding Volume Down while rebooting or power on device with Volume Down + Power)
  • connect device with usb cable and install usb drivers for PC
  • navigate to folder platform-tools from cmd.exe
  • unlock bootloader from fastboot (confirm with Volume Up)

    fastboot devices
    fastboot flashing unlock
    

2) boot custom recovery without modifying/flashing device

  • download custom recovery TWRP into platform-tools folder
  • boot TWRP from fastboot (do not flash)

    fastboot boot twrp.img
    
  • DO NOT swipe to allow modifications of system

  • wait 30 seconds then install adb usb drivers for PC
  • tap the icon lower right corner and check the log for
    a) Data successfully decrypted (or no error)
    b) Failed to mount '/data'

3) dump the current boot partition from device (depending on mounting /data a) successful or b) failed)

  • a) backup boot.emmc.win from TWRP

    • TWRP - tap Backup - select Boot partition
    • copy TWRP/BACKUPS folder to PC via MTP
  • b) backup boot.img from adb

    adb devices
    adb pull /dev/block/bootdevice/by-name/boot boot.emmc.win
    

edit: (other method)

  • c) extract boot.img from OTA (stock ROM) with ozipdecrypt.py
    if for whatever reason TWRP is not available (or not booting) you still can find stock ROM for your device. However, flashing boot.img from download is risky, make 100% sure that this build number is matching your device

    ro.build.description=S88051AA1-user 9 PKQ1.190319.001 eng.root.20190830.025347 release-keys
    ro.build.display.full_id=RMX1805_11_A.60_190830
    
    • install Python 3.8.2
    • install pycryptodome

      pip3.exe install pycryptodome
      
    • download and extract oppo_ozip_decrypt-master.zip

    • download stock ROM
    • run ozipdecrypt.py from cmd.exe

      python.exe ozipdecrypt.py RMX1805EX_11_OTA_0600_all_LtoqeM8aS1Gq.ozip
      
    • check folder out and rename out\boot.img into boot.emmc.win (just to not confuse with encrypted boot.img, name of file doesn't matter)

      oppo_ozip_decrypt.png

      (i have uploaded the converted stock ROM here, recovery.img is missing)


4) root your device with Magisk

  • a) install Magisk directly from TWRP (may brick device)

    • copy Magisk-v20.4.zip to Storage or MicroSD via MTP
    • TWRP - tap Install - select Magisk-v20.4.zip - Swipe to confirm Flash
    • reboot device (TWRP - tap Reboot - tap System)

  • b) patch boot.emmc.win "offline" with Magisk Manager

    • reboot device (TWRP - tap Reboot - tap System)
    • copy boot.emmc.win to Internal Storage via MTP
    • install + launch MagiskManager-v7.5.1.apk
    • enable Advanced Settings - Preserve force encryption
    • tap on Install (1) - Install (2) - Select and Patch a File
    • allow permissions for storage
    • navigate to Internal Storage and select boot.emmc.win
      (this will start patching immediately but does not modify your device - no worry the text "Flashing.." is misleading)

      Install-Magisk-on-Android-using-Patched-Boot-Image-01.jpg


      (5) flash the rooted boot image from fastboot

      • copy magisk_patched.img to PC via MTP
      • reboot device into bootloader mode (keep holding Volume Down while rebooting or power on device with Volume Down + Power)
      • boot magisk_patched.img without modifying/flashing device (for testing purposes)

        fastboot devices
        fastboot boot magisk_patched.img
        
      • if it works: reboot device into bootloader mode

      • flash magisk_patched.img to boot partition (may brick device)

        fastboot flash boot magisk_patched.img
        fastboot reboot
        

Unbricking (method b) only)

  • reboot device into bootloader mode (keep holding Volume Down while rebooting or power on device with Volume Down + Power)
  • flash your backup of original boot.emmc.win from fastboot

    fastboot devices
    fastboot flash boot boot.emmc.win
    fastboot reboot
    
2
  • In the second step, not able to boot TWRP from fastboot. It shows "booting... FAILED (remote: unknown reason)"
    – rashid
    May 4 '20 at 17:48
  • TWRP is not requirement.. update question with screenshot of device info build number (settings - about phone) so we can search for boot.img
    – alecxs
    May 4 '20 at 17:51
1

I think the ROOT of Oppo phones is not too difficult because it has Recovery Mode by itself, can directly flash ROOT files.

Important: Please backup your data and download the original ROM file on OPPO homepage before doing so, in case of any possible uncertainties. Now, all you need to do is download the SuperSU file, save it to the storage device or SD card.

Download this file: SuperSU 2.82 SR5

If it does not work, try with this file, it works on most Oppo devices (however, this is not the latest version of SuperSU, but it is still fully supported): OPPO SuperSU

Next, turn off the phone. Now start pressing Volume Down and Power keys together for a few moments. Wait for a while, the screen will display the language selection menu, it supports English, Simplified Chinese and Traditional Chinese. Here, we choose English. You can move options with the volume up and down keys, select them with the power key, or you can press directly on the screen.

In the ColorOS RECOVERY options panel, select Install from storage device, navigate to the SuperSU file you just selected and flash it.

Before rebooting, go to Wipe data then wipe cache.

Everything is completed, when you reboot, on the phone screen will appear SuperSU, you have successfully ROOT!

Note: Using this method SuperSU will be saved to the system partition. Ie you will not be able to uninstall it but can turn it off as other system applications. To remove ROOT, go to Oppo homepage, download the original ROM, then use the above method to reinstall the operating system.

Good luck.

4
  • How can unsigned zip flashed from stock recovery?
    – alecxs
    May 11 '20 at 5:03
  • @alecxs If you need to restore the original ROM of the manufacturer, follow the above method. ColorOS RECOVERY is a simple recovery, it is not as functional and difficult to use as CWM Recovery or TWRP, but it meets the needs of inexperienced users, easy to use without worrying about damaging the system operating. If you have installed TWRP or CWM Recovery, you will not lose them when you restore using the manufacturer ROM file, but if you want to remove TWRP or CWM Recovery to use ColorOS RECOVERY, you must to flash manufacturer ROM with SP Flashtool. May 11 '20 at 14:07
  • of course you can flash OEM-signed OTA zip from ColorOS Recovery. but SuperSU is not signed with oppo certificates. if it is true what you say, this is a big surprise and security vulnerability
    – alecxs
    May 11 '20 at 19:16
  • ColorOS Recovery is different from OTA. With the default OTA on your phone, your device must not have ROOT, but with ColorOS Recovery, it's like developer mode, rescue your phone when something goes wrong, not just an OS update . Not a security vulnerability, it's a great way to save your phone. May 12 '20 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.