[Tutorial] Full Bootloader Unlock & KernelSU Guide for Unisoc T158 (RongYue E5 / Meizu Note 16)
[Tutorial] Full Bootloader Unlock & KernelSU Guide for Unisoc T158 (RongYue E5 / Meizu Note 16)
25-04-2026, 03:43 PM
![[Image: 001.jpg]](https://i.postimg.cc/qqSfTdff/001.jpg)
Introduction
Hello Hovatek community. I am sharing a complete guide and toolset for the Unisoc T158 (ums9158_1h10) platform. This research was conducted on the RongYue E5 (T9 industrial device), but the files and logic are confirmed to work on the Meizu Note 16 and other devices sharing this 6nm chipset architecture.
Platform Specs:
- SoC: Unisoc T158 (6nm, A76+A55 cores)
- OS: Android 13 + Kernel 5.15 (GKI)
- Root Method: KernelSU (recommended)
- Exploiting BROM carries a High Risk of Hard Bricking.
- NEVER skip Step 1 (Backup).
- I am sharing this for educational purposes. Use your brain and proceed at your own risk.
- Drivers: Unisoc Drivers | mirror link
- Unlock Toolset: Unisoc T158 Unlock Tool | mirror link
- ADB/Fastboot Tools: ADB Fastboot and USB driver installer tool
- Power Off: Completely shut down the device.
- Button Combination: Press and hold Volume Down + Power buttons simultaneously for about 3 seconds.
- Connect USB: While holding the buttons, connect the phone to your PC via a high-quality USB cable.
- Verification: You should hear the Windows USB connection sound. The screen must remain BLACK.
- Note: This is the Unisoc Deep Flash Mode (BROM), similar to Qualcomm's EDL/9008 mode. It is NOT Fastboot mode.
- Note: This is the Unisoc Deep Flash Mode (BROM), similar to Qualcomm's EDL/9008 mode. It is NOT Fastboot mode.
‼️ SPECIAL NOTE ON BOOT MODES (RongYue E5)
On the RongYue E5, hardware button combinations ONLY work for BROM mode.
- BROM Mode: Power + Back button.
- Fastboot/Recovery: There are NO hardware button combos to enter these modes. You must use ADB commands while the device is powered on:
- Enter Fastboot: adb reboot bootloader
- Enter Recovery: adb reboot recovery
Plan accordingly and ensure USB Debugging is enabled before you start!
- Enter Fastboot: adb reboot bootloader
Dump all partitions first to avoid losing NV/IMEI data.
- Entry: Power + Back (catch the port within 5-10s).
spd_dump exec_addr2 0x65017f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0xbefffe00 exec path BR r all reset
Extract the Unlock Toolset and run unlock_autopatch_9621.bat as Administrator.
Interaction Guide:
The script will pause for manual confirmation. Watch the console:
- Prompt y: Type y and press Enter.
- Prompt yes: Type yes and press Enter.
- Instruction to reconnect: Disconnect, force power off, and reconnect in BROM mode, then press Enter.
codeText
INFO: LOCK FLAG IS : UNLOCK!!!
WARNING: LOCK FLAG IS : UNLOCK, SKIP VERIFY!!!
Run this in FDL2 mode via spd_dump:
codeBash
spd_dump exec_addr2 0x65017f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0xbefffe00 exec verity 0 reset
- Since you can't use buttons, use adb reboot bootloader to enter Fastboot.
- Patch your init_boot.img (from Step 1 backup) using the KernelSU App.
- Flash via Fastboot:
fastboot flash init_boot <patched_image>.img
- Reboot. Done!
This post was last modified: 27-04-2026, 09:52 AM by hovatek.
01-05-2026, 02:59 AM
Latest Update:
Added a custom boot logo specifically for the Rongyue E5 to give the device a more personalized look. I have been using and rigorously testing this build for a week under heavy usage, with virtually no significant issues. It is now a highly stable and solid release.
Previous Updates:
•Successfully built a fully functional and stable version of this project after tireless efforts! (Special thanks and a huge shoutout to Hovatek for providing the device tree support).
•Fixed the instability issues with the MTP function.
⚠️ Disclaimer & Risks
This TWRP build includes an unlocked and modified low-level firmware (Bootloader / lk) to function properly, which carries certain risks. If you decide to flash this firmware, please make a full backup of your stock firmware beforehand just in case.
Since the stock low-level firmware does not support physical button combos to boot into Recovery, I successfully enabled the Recovery boot functionality by decompiling and modifying the uboot (and other core components).
Status & Working Features
•ADB - Working
•Fastbootd - Working
•MTP - Working
(Note: When flashing an .img via fastbootd, you must explicitly specify the slot (e.g., _a or _b), as it won't automatically flash to the current active slot).
❌ Important Note on Data Decryption:
Due to the poor ROM performance of this device, data partition decryption is NOT supported by default. Please keep this in mind before proceeding.
That being said, I am incredibly grateful for the amazing compilation tools and guides provided by Hovatek, which have been an immense help to newbies like us!
Online TWRP Builder:
https://www.hovatek.com/twrpbuilder/
Stable Build Download Link:
https://wdho.ru/cvpK
How to Boot into Recovery Mode:
You can boot into TWRP using either of the following methods:
Method 1: Physical Button Combo
Press and hold Volume Up + Power button. (Make sure to press and hold Volume Up first, then press the Power button).
Method 2: Via ADB Command
Connect your device to a PC and execute the following command:
bash
adb reboot recovery
This post was last modified: 19-07-2026, 02:29 PM by hovatek.
03-05-2026, 01:22 PM
04-05-2026, 01:46 PM
Changelog & Features:
1. Data Decryption: Disabled force-encrypt on /datato significantly boost R/W speeds (essential for low-end hardware).
2. KernelSU_NEXT Support: Provided a patched init_bootimage. You can flash this directly in BROM mode by double-clicking 4.Essential for Custom ROMs - Custom IMG Flasher & Wipe DataCache.bat.
3. Significant Sound Boost: Improved speaker output by approximately 70% compared to the stock system. It's now much louder and clearer.
4. Optional Software & Modules: The package includes common LSPosed modules, essential utility tools, and an optimized T9 input method .
Important Technical Note on KernelSU_NEXT:
By default, KernelSU_NEXT does not support module mounting. You MUST install a meta-module like meta-hybrid_mountor a similar solution to enable full module functionality.
⚠️ CRITICAL WARNING - READ BEFORE FLASHING ⚠️
• FULL DUMP IS MANDATORY: Ensure you have a complete backup (DUMP) of all partitions before proceeding. This is your ONLY safety net.
• Prerequisites: Your Bootloader must be UNLOCKED , and AVB/Vbmeta verification must be DISABLED .
• GMS: This build includes Google Mobile Services.
Download Link: https://krakenfiles.com/view/qzAFkLYvQI/file.html
This post was last modified: 04-05-2026, 01:48 PM by Kim_Kardashian.
05-05-2026, 11:15 AM
Hi everyone,
After resolving the final hurdles regarding partition write protection and verification errors, I am proud to present the ultimate version of the Rongyue E5 Mod. This build is designed to push this hardware to its absolute limit while ensuring a smooth flashing experience.
[FIXED] Critical Flashing Issues:
I’ve addressed the "Write img fail" and AVB/Super partition verification errors encountered in previous versions. This release includes a Full Partition Rescue Toolkit (excluding device-specific IMEI/NV configs) to fix hard-bricked devices or boot loops.
Changelog & Features:
- Data Decryption: Disabled force-encrypt on /data to significantly boost R/W speeds—essential for this low-end hardware.
- KernelSU_NEXT Support: Provided a patched init_boot image. You can flash this directly in BROM mode by using my automated script: 4.Essential for Custom ROMs - Custom IMG Flasher & Wipe DataCache.bat.
- Significant Sound Boost: Improved speaker output by approximately 70% compared to the stock system. Much louder and clearer.
- Global Multilang & GMS: Based on the latest international build with full Google Mobile Services support.
- Optional Software & Modules: Includes essential utility tools, optimized T9 input method, and common LSPosed modules.
By default, KernelSU_NEXT does not support module mounting. You MUST install a meta-module like meta-hybrid_mount or a similar solution to enable full module functionality.
⚠️ CRITICAL WARNING - READ BEFORE FLASHING ⚠️
- FULL DUMP IS MANDATORY: This is your ONLY safety net. Ensure you have a complete backup of all partitions before proceeding.
- Prerequisites: Your Bootloader must be UNLOCKED, and AVB/Vbmeta verification must be DISABLED.
- Final Recommendation: I strongly suggest all users switch to this version for the most stable and "unlocked" experience.
A huge shout-out to my friends and the top devs at Hovatek for their invaluable technical guidance in bypassing the bottom-layer write protection.
Download Links: https://wdho.ru/comE
Enjoy the Pineapple experience!
08-06-2026, 07:37 AM
Hi Hovatek Community,
I am excited to share a newly optimized custom ROM designed specifically for the Rongyue E5, transforming it into a next-generation elderly-friendly device with maximum performance and flexibility.
Here are the key features and highlights of this release:
1. Dual-Style Elderly UI (Hybrid Launcher)
•Feature: Seamlessly combines a Large Color-Block Desktop with a Traditional Big-Font Desktop.
•Benefit: Provides the ultimate accessibility, making navigation crystal clear and incredibly easy for elderly users.
2. Unleashed Speaker Performance (Super Volume Boost)
•Feature: Fully unlocked and optimized the hardware potential of the speaker.
•Benefit: Say goodbye to whisper-quiet audio. This mod breathes new life into the speaker, delivering massive, crystal-clear volume.
3. Root Ready: Built-in KernelSU_Next
•Feature: The init_boot has already been pre-patched with KernelSU_Next.
•Benefit: No extra patching needed! Just install the KernelSU manager APK, and you are ready to grant root access immediately.
4. True Multilingual Support
•Feature: Fully unlocked complete system localization.
•Benefit: Supports languages for various countries worldwide, making it a truly global firmware.
5. Heavily Debloated & Smooth GMS
•Feature: Stripped away all redundant and heavy Google core suites.
•Benefit: Keeps only the essentials, significantly freeing up system resources and making the OS runs buttery smooth.
6. Advanced Background App Management
•Feature: Added a dedicated background process manager.
•Benefit: Aggressively tames rogue apps, prevents RAM clogging, and ensures long-term system fluidness.
🛠️ Flashing Instructions & Steps
⚠️ IMPORTANT BEFORE YOU START:
It is highly recommended to dump/backup your stock firmware before flashing. The backup process uses the exact same key combination and steps as the flashing process described below.
How to Flash:
1.Extract the downloaded firmware zip archive on your PC.
2.Power off your device completely.
3.Press and hold the Back button on the device, then plug in the USB data cable to connect it to your PC.
4.Once connected in BROM mode, double-click to run the batch script:
02.[BROM Mode] One-Click Flash (Wipe Data) - Restore Image from Unlock-Flashing.bat
5.The script will automatically execute the complete process, unlocking the bootloader, wiping data, and flashing the custom ROM.
6.Wait for the process to finish, and your device will reboot automatically!
Please backup your data before flashing. Feedback, bug reports, and suggestions are always welcome in this thread!
Download Links: https://wdho.ru/8f37
09-06-2026, 05:49 PM
(08-06-2026, 07:37 AM)Kim_Kardashian [ROM]Rongyue E5 - Next-Gen Elderly OS | Multi-Lang | Debloated GMS | KernelSU_Next Built-in | Boosted Audio
Hi Hovatek Community,
I am excited to share a newly optimized custom ROM designed specifically for the Rongyue E5, transforming it into a next-generation elderly-friendly device with maximum performance and flexibility.
..
Nice!!
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)
