My Experience rooting the T-Mobile Revvl 6 5G

The T-Mobile Revvl 6 5G is a Mediatek MT6833 Dimensity 700-powered smartphone with an Android 12 Operating System. The client’s goal was to root; unlocking the bootloader first and then rooting.

Unlocking the Bootloader

Just to test, I tried unlocking the bootloader using fastboot but none of the commands worked. I had to turn to bootloader unlocking using MTK Client.

Entering BROM Mode

To use MTK Client, you need to get this model into BROM. To force the T-Mobile Revvl 6 5G into BROM mode, you power off, hold the volume decrease button then connect to the PC.

Once the Bootloader is unlocked, your screen will show a warning on every boot;

dm-verity corruption

Your device is corrupt.
It can’t be trusted and may not work properly.
Press power button to continue.
Or device will power off in 5s

dm-verity

This is normal and your device should boot up fine once you press the power button. If you’re stuck in a boot loop then you must have forgotten to wipe user data after unlocking the bootloader so run this command in the MTK client command line:

py -3 mtk e metadata,userdata

Extracting boot image

The plan was to root using magisk manager so the boot.img needed to be extracted from the phone. I chose to extract only the boot.img. The command was:

py -3 mtk r boot_a boot

If you wish to backup other partitions then here’s a list of partitions for this model

misc
para
expdb
frp
nvcfg
nvdata
vbmeta_a
vbmeta_system_a
vbmeta_vendor_a
vbmeta_b
vbmeta_system_b
vbmeta_vendor_b
metadata
persist
protect1
protect2
seccfg
otp
md1img_a
spmfw_a
pi_img_a
dpm_a
scp_a
sspm_a
mcupm_a
gz_a
lk_a
boot_a
vendor_boot_a
dtbo_a
tee_a
sec1
proinfo
efuse
nvram
boot_para
logo
md1img_b
spmfw_b
pi_img_b
dpm_b
scp_b
sspm_b
mcupm_b
gz_b
lk_b
boot_b
vendor_boot_b
dtbo_b
tee_b
super
userdata
flashinfo

T-Mobile Revvl 6 5G partitiions

It is important to note that backing up large partitions using MTK Client can be very slow so a better approach is to use the payload command to disable security and then (with the phone still connected), do a readback using WWR. The payload command is

py -3 mtk payload

Armed with the boot file, I renamed it to boot.img, then the client patched it using the latest version of Magisk Manager (as at this post) and copied it back to the PC.

Rooting the T-Mobile Revvl 6 5G

Rooting models -like this- which have fastbootD is done by flashing the magisk-patched boot in fastbootD instead of fastboot. You need to have set up adb and fastboot already.

To get into fastbootD from ADB, you run the following commands:

adb devices
adb reboot-bootloader
fastboot devices
fastboot reboot fastboot

Wait till the device enters fastbootD. Assuming the magisk-patched boot is named magiskboot.img, your flashing command would look like this:

fastboot flash boot magiskboot.img
fastboot reboot

Check for root in Magisk Manager once the device boots to the home screen.

How to bypass FRP on T-Mobile Revvl 6 5G

If you ever need to bypass Factory Reset Protection (FRP) on this model then you can easily achieve this by wiping the frp partition then rebooting. The command to bypass FRP is:

py -3 mtk e frp