Rooting path for units where 'fastboot oem unlock' is vendor-locked (mtkclient/BROM route) + the stage-2 DRAM-hang fix

[haohowareyou]

The wiki's Getting Root assumes fastboot oem unlock succeeds — which it does on some LoopDL units (sounds like yours included). On other units the fastboot/UI bootloader is vendor-locked and both fastboot oem unlock and fastboot flashing unlock are refused. The good news: on those units the BROM is fully unauthenticated (SLA/SBC/DAA off), so they're still rootable over BROM with mtkclient:

1. Confirm the BROM is open: mtk printgpt succeeds with no auth/crypto errors.
2. mtk_gui → Flash Tools → Unlock bootloader, then erase userdata + metadata.
3. Resume the wiki's normal flow: flash the Magisk-patched init_boot over fastboot (bootloader is unlocked now).

The gotcha that cost me hours: mtkclient's stage-2 hangs at "DRAM config" if you connect the device in BROM mode. The fix is to connect in PRELOADER mode instead — power the device fully off and plug in the USB cable with no buttons held. Stage-2 then loads its DA and proceeds normally.

Full step-by-step (plus an A2DP-sink + dual dumb-speaker / full-phone setup built on top) is in my repo: https://github.com/haohowareyou/loopdl-speaker — happy to PR this into the Getting Root wiki page if it'd be useful.

[sparxooo]

The Preloader route definitely works as per my post on #10 (Maybe more noob friendly as using the GUI, but are you really a noob if you're getting this involved? 😄)

Re: BROM - I think there may be an issue with the most recent mtkclient build (the last time I tried it), hence using the older live-cd version... does that version also hang on the brom? I can't recall 100% I don't think it does. The latest version of the mtkclient/gui certainly doesn't work - it just hangs regardless of preloader/brom.

I'll have to check out your repo when I'm back at home with my loop! I was looking at getting A2DP sink enabled but had to shelve it for the time being.

[haohowareyou]

I had a Mac and couldn’t go the GUI route sadly.

Let’s just say I threw a lot of tokens at said issue, it got what I wanted but I did not know how! Let me know what you think after checking it out.

[sparxooo]

Is some of the app code AI generated? I've never heard of the term "Earcon" before although now searching it seems to be somewhat used

Fantastic work though, I was exploring building a custom rom based off of Lineage but the aforementioned shelving and time restrictions meant that I couldn't complete the OEM fetching bits from the firmware. If we can just modify the OEM one (as your guide) then even better!

[haohowareyou]

100% vibe-coded.