I have a Wingtech - Revvl 6 5G [Mediatek-MT6833] that has an A/B boot partition with vbmeta, OEM unlocked, Debug Mode, and Bootloader Unlocked (Via MTKClient). I've tried rooting the easy way with KingRoot, KingoRoot, iRoot, and the sort to no avail. I've tried flashing magiskpatchedboot.img to boot_a by itself, and with the following command to patch vbmeta:

fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img

Each method produces either Bootloop or Freeze on Logo/Loading Screen and requires flashing of the original boot_a/b.img's from the Stock Rom to return to functional order (boot_b.img flash is required even though I didn't replace it).

I've also tried booting a generic non-device specific twrp-recovery.img from the main TWRP website as one has not been crafted for this handset as of yet, and I'm pretty sure that there is no recovery.img for the Revvl 6 5G (Though there is a Recovery Mode). There isn't a recovery.img in the payload dump, nor is there one on the partition list in FastbootEnhance, nor the Stock Rom. I've also tried to boot the magiskpatchedboot.img directly:

C:\Platform-Tools>fastboot boot recovery.img
Sending 'boot.img' (28266 KB)                      OKAY [  0.768s]
Booting                                            FAILED (Status read failed (Too many links))
fastboot: error: Command failed

C:\Platform-Tools>fastboot boot magisk_patched-boot_a.img
Sending 'boot.img' (40960 KB)                      OKAY [  1.092s]
Booting                                            FAILED (Status read failed (Too many links))
fastboot: error: Command failed

Neither worked...

Someone said try it this way:

C:\Platform-Tools>fastboot boot boot magisk_patched-boot_a.img
fastboot: error: cannot load 'boot': No such file or directory

C:\Platform-Tools>fastboot boot boot_a magisk_patched-boot_a.img
fastboot: error: cannot load 'boot_a': No such file or directory

Neither worked..

I'm not sure what to try next. Are there any other rooting methods that I'm not thinking of? I could use assistance.


2 Answers 2


Seeing as I solved my question, I figured I would provide the answer. It took piecing several guides together from XDA forums as well as the Hovatek forums.

I should note this guide is for Android 12. It should still work for Android 13 if the firmware can be obtained.

I am not responsible should anyone brick their device. I personally bricked mine many times, and have had to flash with the original Firmware to repair the damage.

As of current, there is no available Android 13 Rom/Firmware that I can find. Though I have made some requests. I have opened ann issue with the Magisk Github page, working to achieve Root off an Android 13 backup file I made through using MTKClient. At current, it has been unsuccessful but everyone is working on correcting the issue.

Appreciation is expressed to all the techniques acquired by other/original sources.

Here is my path, step for step:

  1. Netork Carrier/SIM Unlock = After my year of service was up, I just tapped Network Unlock, and the SIM Unlocked.

  2. Unlock Developer Mode - Settings >About Phone >Build Number, Tap 7 times and unlock Dev Mode.

  3. Toggle OEM Unlock and Debug Mode in Developer Options.

  4. I then followed the - Hovatek Bootloader Unlock Guide. -Install Current Adb and Fastboot/Platform-Tools -Extract to C:/

-Install Medatek Drivers -Install Git -Install Python -Install MTKClient -to C:/platform-tools -Install UsbDK from MTKClient Github Page.

  1. Download the Revvl 6 5G - MT6833 - Stock Frimware - Android 12. -Extract to C:/platform-tools/mtkclient

  2. Open File Explorer to C:/platform-tools, Type cmd in the search bar, and open Command Prompt.

  3. Type: cd mtkclient -And we are ready to begin.

  4. Next, Type (If you installed Python from the Microsoft store, this step can be skipped):

    python setup.py install

Then Type:

pip3 install -r requirements.txt


py -3 -m pip install -r requirements.txt (works too)

  1. Run this Command to Wipe User Data (Each MTKClient Commad will require Reconnecting the Device in BRom Mode):

    python mtk e metadata,userdata

MTKClient will go into a Ready and Waiting for the Device to Connect State.

Now Power off the phone, and entered BRom Mode by Pressing Volume Down and Power while connecting to the PC.

  1. Next Type:

    python mtk xflash seccfg unlock


python mtk da seccfg unlock - (This is the One That Worked for Me)

  1. Bootloader is now Unlocked. Disconnect and Reboot by holding Power and Volume Down until the phone restarts.

Magisk v26.3+ is Needed

Extract the boot.a.img from the Stock ROM. Then Push the boot_a.img to the SDCard:

adb push boot_a.img <Path to SDCard>

(Important to use "adb push" as MTP Transfer will corrupt the file).


adb push magisk_26.3.apk <Path to SDCard>
  1. Install Magisk. Go to settings, and choose Stable Version. Go back and update Magisk. Then tap the top install, select the boot_a.img from the SDCard, and patch. Then pull the magisk_patched_boot.img from the internal download folder using:

    adb pull /storage/emulated/0/Download/magisk_patched_boot.img

(MTP Transfer will corrupt the file and bootloop your device, use "adb pull")

  1. Then extract the vbmeta_a.img from the Stock Rom and move it to the platform-tools folder. Next, reboot the device to fastbootd by Typing:

    adb reboot fastboot

  2. Now enter:

    fastboot devices

And Flash the boot_a partition with the Magisk Patched boot_a.img with this command:

fastboot flash boot_a magisk_patched-boot.img
  1. Then flash and patch the vbmeta partition with this command:

    fastboot flash vbmeta_a --disable-verity --disable-verification vbmeta_a.img

Reboot with:

fastboot reboot
  1. Open the Magisk App to check, but the device should have Root now. The App will take further steps to Harden the Root job. Then Tap the first Install again and perform a "Direct Install."

And that's it.

If you by chance Bricked or Bootlooped the device, follow these steps to Fix the Phone.

-First enter this Command to Wipe User Data:

py -3 mtk e metadata,userdata

Then run this command to Flash the Stock Firmware:

python mtk wl <full path to Stock Firmware Folder>

Warning: Remove/Delete the nvram.img and the nvdata.img from the Stock Firmware Folder to preserve the original IMEI number. Flashing these files will erase the IMEI and Baseband. Which will make the Device unable to read Sim Cards.


In mtkclient, use the terminal version, and use the seccfg unlock command which will officially unlock the bootloader and allow you to boot the Magisk-infused boot.img.

You can check after, by using the command fastboot getvar all. Use that command in the bootloader version and it will tell you.

Also, do not forget, if caught in bootloops after flashing a patched boot, you always have to erase userdata. If not, you will inevitably bootloop no matter what you do.

Also, there is no TWRP recovery for this device, I've lobbied for it and also have done most of the device tree if someone wants to edit for errors and finish it. Go to GitHub and search "revvl 6 device tree". I'm sure I'm the only that has worked on it, so it will be the only search result.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .