Realme C53 (RMX3760) — Bootloader Unlock & Root Toolkit

Unlock bootloader and root your Realme C53 (and other Realme devices). Supports KernelSU, Magisk, or a hybrid of both.

⚠️ RMX3760 (Unisoc T612): Bootloader unlock + Magisk root are verified working on BOTH Android 15 and Android 14. KernelSU LKM works only on the Android 15 kernel (5.15.178, MODULE_SIG_FORCE=n). On Android 14 (5.4.254, MODULE_SIG_FORCE=y) the kernel rejects unsigned modules (insmod → Key was rejected by service) — use Magisk there.

Every GitHub release you create on your own fork is YOUR personal build — save it and reuse it anytime you need to root again on the same device.

✅ Verified Results (2026-08-02)

Method	Android 15 (`5.15.178`)	Android 14 (`5.4.254`)
Bootloader unlock (CVE-2022-38694)	✅ OK	✅ OK
Magisk root	✅ OK	✅ OK
KernelSU LKM (module-load)	✅ OK (`MODULE_SIG_FORCE=n`)	❌ blocked (`MODULE_SIG_FORCE=y`)

🔎 Check your kernel first: adb shell uname -r

5.15.178-android13-8 → KernelSU / hybrid works

5.4.254-android12-9 → use Magisk (KernelSU needs a full kernel rebuild)

Full step-by-step with exact commands, logs, and MD5 checksums: docs/UNLOCK_ROOT_GUIDE.md

✅ Relock bootloader — VERIFIED (2026-08-05, Android 14): fastboot flashing lock → Lock bootloader successfully! → ro.boot.flash.locked=1, verifiedbootstate=green, vbmeta.device_state=locked, device boots normally. Full procedure: Relock Bootloader.

🔒 Relock Bootloader

Restore the device to a fully stock, locked state (verified on Android 14 / RMX3760).

Prerequisites

Stock boot images backed up (e.g. output/backup/boot_a_a14_stock.img, boot_b_a14_stock.img)
Root removed — restore stock boot on both slots so AVB verification passes after locking

Steps

# 1. Flash stock boot to BOTH slots (replaces Magisk-patched boot / removes root)
adb reboot bootloader
fastboot flash boot_a output/backup/boot_a_a14_stock.img
fastboot flash boot_b output/backup/boot_b_a14_stock.img

# 2. Re-lock the bootloader (confirm on the phone screen with volume keys if prompted)
fastboot flashing lock
#   → fastboot getvar locked   → "Lock bootloader successfully!"

# 3. Reboot and verify
fastboot reboot
adb shell getprop ro.boot.flash.locked        # 1
adb shell getprop ro.boot.verifiedbootstate   # green
adb shell getprop ro.boot.vbmeta.device_state # locked

ℹ️ fastboot flashing lock works even though the bootloader was unlocked via the CVE exploit. First boot after locking takes longer (factory reset) — just wait.

ℹ️ If your device reports Not implement. for flashing lock, re-lock by zeroing the miscdata marker (offset 8192, 64 bytes) with the same spd_dump CVE toolchain used for unlocking: a zeroed marker = locked state.

📋 Requirements

Item	Needed For
GitHub account	Fork + GitHub Actions (build kernel module)
Python 3.10+	CLI tool (`python cli.py`)
ADB + Fastboot	Flash & verify (included with Platform Tools)
USB cable	Data transfer capable
Windows PC (or Linux VM)	Bootloader unlock (spd_dump.exe only runs on Windows)

Don't have Python? Download the Release ZIP instead — it includes flash scripts and requires zero setup.

🤖 Use an AI assistant? See AI_PROMPT_TEMPLATE.md for ready-to-use prompts. Recommended: opencode — AI agent CLI that can read/edit files and run commands directly in your terminal. Run it from this repo folder.

How It Works

You fork this repo
  → Run GitHub Actions (builds kernelsu.ko for YOUR device)
     OR use a pre-built Release
  → Unlock bootloader (CVE-2022-38694 for SPRD/Unisoc)
  → Flash KernelSU, Magisk, or hybrid root
  → Done. Keep the Release for future use.

No need to set up a kernel build environment. Everything runs in GitHub's cloud.

Two Ways to Use

🟢 Path A — Use an Existing Release (No Build)

If someone has already built for the same device/kernel, just download their Release:

Download Release ZIP or kernelsu.ko from an existing GitHub Release
  → Place kernelsu.ko in downloads/kernelsu.ko
  → Follow "Quick Start" from Step 2

No GitHub account or fork needed. Only prerequisite: matching kernel version (vermagic).

🔵 Path B — Build Your Own (Recommended)

Build your own personal kernel module — your Release, your backup:

Fork this repo → Run GitHub Actions → Get YOUR Release
  → Download kernelsu.ko from your own Release
  → Follow "Quick Start" from Step 2

📋 Device Compatibility

Chipset Family	SoC/Platform	Unlock Method	Status
SPRD (Unisoc)	T606, T610, T612, T618	CVE-2022-38694	✅ Tested (C53)
Realme C53 (RMX3760) Android 15	T612	CVE-2022-38694	✅ Unlock + Magisk + KSU LKM
Realme C53 (RMX3760) Android 14	T612	CVE-2022-38694	✅ Unlock + Magisk (KSU blocked: `MODULE_SIG_FORCE=y`)
MediaTek	Helio Gxx, Dimensity	BROM mode (mtkclient)	⚠️ Profile example
Qualcomm	Snapdragon 6xx/7xx	EDL / fastboot oem	⚠️ Profile example

Multi-device + multi-chipset: Setiap device punya profile TOML di devices/. Ganti dengan menu d) atau env var RMX_DEVICE=example_mediatek python cli.py.

Bikin profile sendiri: copy devices/template.toml → devices/MODEL_ANDA.toml, isi nilai device-nya.

Untuk chipset non-SPRD, unlock tools tidak termasuk dalam repo. Lihat petunjuk unlock di CLI menu 5 untuk link download tools yang diperlukan.

🚀 Quick Start (Full Flow)

Step 1 — Fork & Build Kernel Module

Fork this repo to your GitHub account
Go to Actions tab → Build & Create Complete Release → Run workflow
Wait ~15 minutes
GitHub creates a Release with kernelsu.ko inside

Step 2 — Prepare PC & Phone

# Clone your fork
git clone https://github.com/YOUR_USERNAME/realme-c53-unlock-root.git
cd realme-c53-unlock-root

# Download the Release from GitHub
#   → Go to your fork's Releases page
#   → Download kernelsu.ko from the latest release
#   → Place it in: downloads/kernelsu.ko

# Install SPRD driver (Windows only)
python cli.py       # select menu 4

Step 3 — Unlock Bootloader

python cli.py       # select menu 5 (follow the screwdriver trick)

Phone will factory reset. Set up Android, enable USB debugging.

Step 4 — Build & Flash

Choose your root method:

Option A — Hybrid Magisk + KernelSU (Recommended for RMX3760)

# 1. Download Magisk v27.0 APK to tools/apk/
# 2. Extract and run boot_patch.sh on-device, or use Magisk app to patch stock boot
# 3. Flash patched boot to both slots:
adb reboot bootloader
fastboot flash boot_a magisk_patched_boot.img
fastboot flash boot_b magisk_patched_boot.img
fastboot reboot

# 4. Install ksu_loader Magisk module:
#    Push tools/modules/ksu_loader/ksu_loader_v2.zip to phone
#    Open Magisk app → Modules → Install from storage → select the zip
#    Reboot

# 5. Install KernelSU Next APK for KSU app root management
adb install tools/apk/KernelSU_Next.apk

Option B — KernelSU LKM (Test-boot safety)

# Backup stock boot from your phone
python cli.py       # select menu 3

# Build flashable KernelSU boot image
python release/build_release.py --kernelsu downloads/kernelsu.ko --stock output/backup/stock_boot_*.img

# Verify the artifact
python release/build/verify_release.py

realme-c53-unlock-root

인기