The 1.090 updates on the A202KC, A204KC, and KY-43C most likely also block rooting, but this has not yet been confirmed. A way of bypassing this has been found, but not yet documented on this wiki. Join our community if you would like the details.

Prerequisites:

1. Have ADB setup (see the Setting up ADB page).
   
   
2. Understanding how to sideload an app (see the Sideloading apps page).
   
   
3. Having read, and understood the warning at the beginning of the page.

The rooting process will require a tool called MTKClient, which will facilitate dumping images from the phone, unlocking the bootloader, and flashing the patched images back onto the device.

MTKClient is unfortunately not easily usable on platforms other than Linux, and even on Linux it can be a hassle to set up. Due to this, we have created a Live USB environment with the tool preinstalled and ready to use.

The rest of this page is a step by step guide for the rooting process.

You will need to install Magisk onto the device.

Install from F-Droid: https://f-droid.org/en/packages/com.topjohnwu.magisk/

Install from the Magisk GitHub: https://github.com/topjohnwu/Magisk/releases

It is highly recommended that you use the NixOS live boot as it removes the hassle of setting up MTKClient.

The live boot has a dedicated page for setting up and preparing your PC for the live boot. You can find it here: NixOS live boot.

The wiki does not go through the process of installing MTKClient manually at this time.

If you would like to install MTKClient manually for any reason then feel free to reach out on our Discord for assistance. You can find the install steps on the MTKClient GitHub but they are very outdated: https://github.com/bkerler/mtkclient#installation.

The rest of this guide, as well as the command syntax will differ from using the manually installed version. You can use this guide as reference however while paying close attention to the differences on the MTKClient official usage guide: https://github.com/bkerler/mtkclient/blob/4ee021531144e7aadff63479bb5c4a44b721131e/README-USAGE.md

In the live boot open the terminal icon on the taskbar:

In the terminal run the following command:

sudo mtk r boot,vbmeta boot.img,vbmeta.img

The terminal should start a repeating message that says “waiting for handshake”. At this point, turn off your phone completely, and plug it into your computer using a USB cable that supports data transfer.

If successful you will find the files “vbmeta.bin” and “boot.bin” in your home folder. The home folder is accessible through opening “Files” in the taskbar, which should automatically put you in the correct folder. It will be the one with the house icon.

In the terminal again, type in and run:

sudo mtk reset

This will reboot the phone and you can now unplug the device.

If something goes wrong during the rooting process these images will be instrumental to reviving the phone. The live boot is impermanent and the dumped files will be lost forever once you exit it.

Because of this it is important to backup these files through some method. Here are some recommended options:

Plug in another USB capable device, and using the file explorer move the files onto the device, and safely eject the drive.

If you do not have a USB you can use your phone to transfer the files from the live boot to your regular operating system.

After rebooting your phone, reconnect the USB and accept the “Allow MTP” prompt (if you dismiss it just re-plug the phone again). On the PC you will find a phone icon on the desktop, navigate to “Downloads” and place the files there. Safely eject your phone.

Now at the top right press the red power button and shut down, immediately after unplug the live boot USB. Turn your computer back on and boot into your regular operating system.

Now plug in your phone and copy paste the files you put on the phone to somewhere safe on your computer. Specially copy paste them as you will need to keep them on your phone. Safely eject the phone.

Now plug the live boot USB back in and repeat the steps you took to enter the live boot. Once back in the live boot plug the phone back in and copy paste the files on the phone into the Home folder shown earlier.

If you used your phone to backup your files in the last step ignore this next part.

In the live boot, plug your phone into your PC and accept the “allow MTP” prompt. On the PC you will see a phone icon on the desktop.

Double click the phone icon and navigate to the “Downloads” folder. Now copy paste the boot.bin file into that folder.

You may want to use screen mirroring which can be accessed by opening a new terminal window and entering:

scrcpy –render-driver vulkan

Now on your phone open Magisk, select “Install”>“Select and Patch a file” and in the file chooser go to “Downloads” and select boot.bin.

After completion Magisk will display the name of the patched file. Back on the PC go back to the phones downloads folder and find the patched file. Copy this file and place it in your home folder, rename it to boot.patched (.patched is the file extension).

If you need to exit the live environment before the next step, you will need to backup the boot.patched file. Otherwise you will lose the file as you will be wiping the phone. It also is good to have for our archive if you would like to contribute.

Now we will be unlocking the bootloader, which in the process will delete all data on the phone.

Turn the phone off again and plug into your PC.

The first command will erase metadata and userdata (and md_udc if existing). In the terminal run:

sudo mtk e metadata,userdata,md_udc

Next you will unlock the bootloader:

sudo mtk da seccfg unlock

If you had no errors congratulations, your bootloader is now unlocked!

Now restart the phone:

sudo mtk reset

You'll see that there is an “orange state” warning on the reboot, seeing this means that the bootloader was successfully unlocked. It is relevant to mention that you may want to relock the bootloader after rooting, a sub section of the final step will go over how to do so.

After the phone restarts, immediately turn it off again for the next steps.

This section assumes that you have the vbmeta.bin and boot.patched file in your home directory like so:

These two commands will flash the files onto the phone, open a terminal and run:

sudo mtk da vbmeta 3

and immediately after:

sudo mtk w boot boot.patched

And finally:

sudo mtk reset

Congratulations! Your phone should now be rooted. At this stage you can exit the live environment if you so choose, although there are a few things you may want to consider from the following first:

After you are rebooted just press enter on all the prompts in Japanese until you get to the home screen. To change the language to English go to settings, select the bottom option (“more settings”) and the 7th option down is language where you can swap it to English.

You can immediately test if the phone has been successfully rooted by opening a terminal on your PC and running some ADB commands to the phone. You'll need to activate USB Debugging in Developer settings again: ADB Setup.

Run:

adb shell

You will now be in the phones terminal basically. Attempt for root access by simply entering:

su

If you get a prompt on screen asking to allow root access you have successfully rooted the phone and have root access.

Keeping the bootloader unlocked is a security risk technically but it is up to you if you would like to or not. If you would like to lock the bootloader again then in the terminal run:

da seccfg lock