Unbrick Realme 6 (RMX2001)

cmfan
Newbie

2

21-01-2021, 11:09 PM

#1

Hi, I have hard-bricked my new Realme 6 while trying to root it with Magisk. At the moment I am stuck in a bootloop at the power-on logo (realme in white letters). The boot animation (yellow realme letters) does not appear, instead the phone reboots after ~35 seconds. The bootloader says "Orange State".

I can NOT enter fastboot nor recovery mode by any key combination. Holding Power and Vol- makes the string RECOVERY MODE appear for a split second in the lower left part of the screen, however nothing happens afterwards.

I can power down by holding Power and Vol+ an releasing them immediately after the screen goes blank.
Holding Vol- and Vol+ while the phone is off and connecting USB makes a USB serial device appear on a windows machine for about 1-2 seconds before it disappears again.

I am very thankful for any hints on how to unbrick the device.

Here's what I have done in detail to mess up the phone:

1. OTA-Update to the latest OS in my region (EU11.A.48)
2. Unlocked the bootloader with the realme In-depth Test app (everything fine so far)
3. Download stock firmware RMX2001EU_11.A.48 ozip from realmeupdater.com
4. Unzipped with gnu unzip (content was readable, no extra decrytion tool for the ozip needed?) and extracted boot.img
5. Installed Magisk Manager and uploaded boot.img to the phone
6. Patched boot.img with Magisk Manager (and if I remeber correctly DIDN'T UNCHECK Preserve AVB 2.0/dm-verity)
7. Certainly FORGOT to do anything with vbmeta.img
8. Did NOT erase cache and userdata
9. Flashed patched boot.img directly and WITHOUT --disable-verity or --disable-verification
10. Rebooted the phone.

Am I correct that my problem is the AVB/dm-verity part?
Why does the modified boot.img affect the recovery (I thought they were seperate)

I do have a second intact device that I didn't dare to touch yet, if that helps resolving the issue (e.g. for SP Flashtool readbacks). However SPFT doesn't communicate with neither phone (bricked one throws 0x60001 error, intact one throws 0x60005).

I thought about restoring original boot.img by creating a scatter file with only this partition inside and to flash it with SWD Aftersale. I know from the original firmware where it starts and how long it is. Would that work?

As said any advice is highly welcome. Please ask if you need any more information to help.

This post was last modified: 22-01-2021, 09:23 AM by cmfan.

hovatek
Administrator

49,869

22-01-2021, 01:40 PM

#2

(21-01-2021, 11:09 PM)cmfan Am I correct that my problem is the AVB/dm-verity part?

not disabling verification by flashing vbmeta, that's the problem

(21-01-2021, 11:09 PM)cmfan Why does the modified boot.img affect the recovery (I thought they were seperate)

they are but for many if not all device, it seems all boot modes are disabled once the device is stuck in orange or red state bootloop

(21-01-2021, 11:09 PM)cmfan I do have a second intact device that I didn't dare to touch yet, if that helps resolving the issue (e.g. for SP Flashtool readbacks). However SPFT doesn't communicate with neither phone (bricked one throws 0x60001 error, intact one throws 0x60005).

I thought about restoring original boot.img by creating a scatter file with only this partition inside and to flash it with SWD Aftersale. I know from the original firmware where it starts and how long it is. Would that work?

As said any advice is highly welcome. Please ask if you need any more information to help.

this device has secure boot and the DA is not available.
without the DA file, you won't be able to use sp flash tool, you'd need to look for an ofp firmware (usually includes an msm download tool that requires authorized id). either visit a service center OR search for someone with authorized id for flashing

cmfan
Newbie

2

23-01-2021, 05:53 PM

#3

Ok, thank you for your reply.

A second question about flashing vbmeta: is it crucial to use an emtpy one or can it also be the one from a downloaded ozip as long as I flash it with --disable-verity --disable-verification ?

hovatek
Administrator

49,869

23-01-2021, 05:57 PM

#4

(23-01-2021, 05:53 PM)cmfan Ok, thank you for your reply.

A second question about flashing vbmeta: is it crucial to use an emtpy one or can it also be the one from a downloaded ozip as long as I flash it with --disable-verity --disable-verification ?

Using stock vbmeta with --disable-verity --disable-verification works for some models. If it fails then try empty vbmeta

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions