Realme C53 (RMX3760) — Bootloader Unlock & Root Toolkit

Unlock bootloader and root your Realme C53 (and other Realme devices). Supports KernelSU, Magisk, or a hybrid of both.

⚠️ RMX3760 (Unisoc T612): Bootloader unlock + Magisk root are verified working on BOTH Android 15 and Android 14. KernelSU LKM works only on the Android 15 kernel (5.15.178, MODULE_SIG_FORCE=n). On Android 14 (5.4.254, MODULE_SIG_FORCE=y) the kernel rejects unsigned modules (insmod → Key was rejected by service) — use Magisk there.

Every GitHub release you create on your own fork is YOUR personal build — save it and reuse it anytime you need to root again on the same device.

✅ Verified Results (2026-08-02)

🔎 Check your kernel first: adb shell uname -r

5.15.178-android13-8 → KernelSU / hybrid works

5.4.254-android12-9 → use Magisk (KernelSU needs a full kernel rebuild)

Full step-by-step with exact commands, logs, and MD5 checksums: docs/UNLOCK_ROOT_GUIDE.md

✅ Relock bootloader — VERIFIED (2026-08-05, Android 14): fastboot flashing lock → Lock bootloader successfully! → ro.boot.flash.locked=1, verifiedbootstate=green, vbmeta.device_state=locked, device boots normally. Full procedure: Relock Bootloader.

🔒 Relock Bootloader

Restore the device to a fully stock, locked state (verified on Android 14 / RMX3760).

Prerequisites

Stock boot images backed up (e.g. output/backup/boot_a_a14_stock.img, boot_b_a14_stock.img)
Root removed — restore stock boot on both slots so AVB verification passes after locking

Steps

# 1. Flash stock boot to BOTH slots (replaces Magisk-patched boot / removes root)
adb reboot bootloader
fastboot flash boot_a output/backup/boot_a_a14_stock.img
fastboot flash boot_b output/backup/boot_b_a14_stock.img

# 2. Re-lock the bootloader (confirm on the phone screen with volume keys if prompted)
fastboot flashing lock
#   → fastboot getvar locked   → "Lock bootloader successfully!"

# 3. Reboot and verify
fastboot reboot
adb shell getprop ro.boot.flash.locked        # 1
adb shell getprop ro.boot.verifiedbootstate   # green
adb shell getprop ro.boot.vbmeta.device_state # locked

ℹ️ fastboot flashing lock works even though the bootloader was unlocked via the CVE exploit. First boot after locking takes longer (factory reset) — just wait.

ℹ️ If your device reports Not implement. for flashing lock, re-lock by zeroing the miscdata marker (offset 8192, 64 bytes) with the same spd_dump CVE toolchain used for unlocking: a zeroed marker = locked state.

📋 Requirements

Don't have Python? Download the Release ZIP instead — it includes flash scripts and requires zero setup.

🤖 Use an AI assistant? See AI_PROMPT_TEMPLATE.md for ready-to-use prompts. Recommended: opencode — AI agent CLI that can read/edit files and run commands directly in your terminal. Run it from this repo folder.

How It Works

You fork this repo
  → Run GitHub Actions (builds kernelsu.ko for YOUR device)
     OR use a pre-built Release
  → Unlock bootloader (CVE-2022-38694 for SPRD/Unisoc)
  → Flash KernelSU, Magisk, or hybrid root
  → Done. Keep the Release for future use.

No need to set up a kernel build environment. Everything runs in GitHub's cloud.

Two Ways to Use

🟢 Path A — Use an Existing Release (No Build)

If someone has already built for the same device/kernel, just download their Release:

Download Release ZIP or kernelsu.ko from an existing GitHub Release
  → Place kernelsu.ko in downloads/kernelsu.ko
  → Follow "Quick Start" from Step 2

No GitHub account or fork needed. Only prerequisite: matching kernel version (vermagic).

🔵 Path B — Build Your Own (Recommended)

Build your own personal kernel module — your Release, your backup:

Fork this repo → Run GitHub Actions → Get YOUR Release
  → Download kernelsu.ko from your own Release
  → Follow "Quick Start" from Step 2

📋 Device Compatibility

Multi-device + multi-chipset: Setiap device punya profile TOML di devices/. Ganti dengan menu d) atau env var RMX_DEVICE=example_mediatek python cli.py.

Bikin profile sendiri: copy devices/template.toml → devices/MODEL_ANDA.toml, isi nilai device-nya.

Untuk chipset non-SPRD, unlock tools tidak termasuk dalam repo. Lihat petunjuk unlock di CLI menu 5 untuk link download tools yang diperlukan.

🚀 Quick Start (Full Flow)

Step 1 — Fork & Build Kernel Module

Fork this repo to your GitHub account
Go to Actions tab → Build & Create Complete Release → Run workflow
Wait ~15 minutes
GitHub creates a Release with kernelsu.ko inside

Step 2 — Prepare PC & Phone

# Clone your fork
git clone https://github.com/YOUR_USERNAME/realme-c53-unlock-root.git
cd realme-c53-unlock-root

# Download the Release from GitHub
#   → Go to your fork's Releases page
#   → Download kernelsu.ko from the latest release
#   → Place it in: downloads/kernelsu.ko

# Install SPRD driver (Windows only)
python cli.py       # select menu 4

Step 3 — Unlock Bootloader

python cli.py       # select menu 5 (follow the screwdriver trick)

Phone will factory reset. Set up Android, enable USB debugging.

Step 4 — Build & Flash

Choose your root method:

Option A — Hybrid Magisk + KernelSU (Recommended for RMX3760)

# 1. Download Magisk v27.0 APK to tools/apk/
# 2. Extract and run boot_patch.sh on-device, or use Magisk app to patch stock boot
# 3. Flash patched boot to both slots:
adb reboot bootloader
fastboot flash boot_a magisk_patched_boot.img
fastboot flash boot_b magisk_patched_boot.img
fastboot reboot

# 4. Install ksu_loader Magisk module:
#    Push tools/modules/ksu_loader/ksu_loader_v2.zip to phone
#    Open Magisk app → Modules → Install from storage → select the zip
#    Reboot

# 5. Install KernelSU Next APK for KSU app root management
adb install tools/apk/KernelSU_Next.apk

Option B — KernelSU LKM (Test-boot safety)

# Backup stock boot from your phone
python cli.py       # select menu 3

# Build flashable KernelSU boot image
python release/build_release.py --kernelsu downloads/kernelsu.ko --stock output/backup/stock_boot_*.img

# Verify the artifact
python release/build/verify_release.py

# Flash to phone (test-boot first)
python cli.py       # select menu 6

Option C — Magisk only (Direct flash)

# Use Magisk app to patch stock boot, then:
fastboot flash boot_a magisk_patched_boot.img
fastboot flash boot_b magisk_patched_boot.img
fastboot reboot

Step 5 — Verify Root

python cli.py       # select menu 8
# or
adb shell su -c id  # should show uid=0(root)

🔄 Reusing Your Release

Your GitHub Release is tied to your fork and your phone. If you ever need to root again (after OTA update, factory reset, etc.):

KernelSU root:

Go to your fork's Releases page
Download the same kernelsu.ko
Backup fresh stock boot: python cli.py → menu 3
Rebuild: python release/build_release.py --kernelsu kernelsu.ko --stock output/backup/stock_boot_*.img
Flash: python cli.py → menu 6

Hybrid Magisk+KSU root:

Follow Step 4 Option A — re-patch stock boot with Magisk v27
Reinstall ksu_loader Magisk module
Keep the same kernelsu.ko and KernelSU Next APK

No need to rebuild the kernel module — the same .ko works as long as the kernel version hasn't changed.

📁 Repository Structure

realme-c53-unlock-root/
├── cli.py                       ← Thin entry point (end-user)
├── AGENTS.md                    ← AI agent instructions (10 workflows)
├── AI_PROMPT_TEMPLATE.md        ← Copy-paste prompts for any AI
├── pyproject.toml               ← Package metadata & tool config
├── src/rmx_unlock/              ← Python package (all logic)
├── docs/
│   └── KSU_INIT_BUG.md          ← KSU init binary bug details
├── release/
│   ├── build_release.py         ← BUILD STAGE: patch stock→release
│   ├── runtime/                 ← Build output (gitignored)
│   │   ├── metadata.txt         ← SHA256 checksums
│   │   └── kernelsu_patched_boot.img
│   └── build/
│       ├── flash.bat            ← One-click flash script
│       ├── verify_release.py    ← SHA256 verification
│       └── host_patch.py        ← Patch boot without phone
├── .github/workflows/
│   ├── build_kernelsu_module.yml ← CI: build module + Release
│   └── test_python.yml          ← CI: pytest on push/PR
├── tools/
│   ├── unlock/
│   │   ├── sprd/              ← SPRD/Unisoc tools (spd_dump.exe)
│   │   ├── mtk/               ← MediaTek tools (user-provided)
│   │   └── qcom/              ← Qualcomm tools (user-provided)
│   ├── modules/
│   │   └── ksu_loader/        ← Magisk module for auto-loading KSU
│   │       └── ksu_loader_v2.zip
│   ├── driver/                ← USB drivers per chipset
│   └── apk/                   ← KernelSU Next + Magisk APKs
├── tests/                       ← Pytest unit tests
├── output/                      ← Backups & logs (gitignored)
│   ├── backup/                  ← Stock boot images
│   └── logs/                    ← Session logs
├── devices/                      ← Device profiles (TOML)
│   ├── RMX3760.toml             ← Realme C53 (SPRD)
│   ├── RMX3750.toml             ← Realme C51 (SPRD)
│   ├── example_mediatek.toml    ← MediaTek example
│   ├── example_qualcomm.toml    ← Qualcomm example
│   └── template.toml            ← Template for new devices
├── downloads/                   ← User-provided kernelsu.ko
├── files/                       ← Reference data (partition layout)
├── kernel_ack_5.15/             ← ACK kernel source (local build)
├── kernel_source/               ← Realme GPL source (5.4, reference)
└── toolchain/                   ← Build toolchain (optional)

Key Design

No live patching — boot image patching is done safely in the build stage
Test-boot safety — KernelSU tested via fastboot boot before flashing
Checksum verification — SHA256 checked before every flash
Your own Release — each fork produces its own artifacts on its own GitHub
Multiple root methods — KernelSU LKM, Magisk, or hybrid (Magisk + KSU via Magisk module)
Zero Python dependencies — stdlib only

🧪 For Developers / Custom Builds

# Run tests
python -m pytest tests/ -v

# Patch boot image without a device (Linux x86_64)
python release/build/host_patch.py --kernelsu kernelsu.ko --stock boot.img

# Full build (requires phone connected)
python release/build_release.py --all

# Lint & format
pre-commit run --all-files

⚠️ Warning

Unlocking the bootloader wipes all device data. Backup before proceeding.

Credits

TomKing062 — CVE-2022-38694 unlock exploit
KernelSU-Next — KernelSU Next
topjohnwu — Magisk
Realme Open Source — Kernel source code

License

Educational purposes only. Use at your own risk.

Bootloader unlock (CVE-2022-38694)	✅ OK	✅ OK
Magisk root	✅ OK	✅ OK
KernelSU LKM (module-load)	✅ OK (`MODULE_SIG_FORCE=n`)	❌ blocked (`MODULE_SIG_FORCE=y`)

GitHub account	Fork + GitHub Actions (build kernel module)
Python 3.10+	CLI tool (`python cli.py`)
ADB + Fastboot	Flash & verify (included with Platform Tools)
USB cable	Data transfer capable
Windows PC (or Linux VM)	Bootloader unlock (spd_dump.exe only runs on Windows)

SPRD (Unisoc)	T606, T610, T612, T618	CVE-2022-38694	✅ Tested (C53)
Realme C53 (RMX3760) Android 15	T612	CVE-2022-38694	✅ Unlock + Magisk + KSU LKM
Realme C53 (RMX3760) Android 14	T612	CVE-2022-38694	✅ Unlock + Magisk (KSU blocked: `MODULE_SIG_FORCE=y`)
MediaTek	Helio Gxx, Dimensity	BROM mode (mtkclient)	⚠️ Profile example
Qualcomm	Snapdragon 6xx/7xx	EDL / fastboot oem	⚠️ Profile example

realme-c53-unlock-root

Populaires