Documentation for rooting, bootloader analysis, and firmware research on the Realme C55 (RMX3710). Covers the full process from stock firmware to rooted device, including the MediaTek-specific toolchain required, AVB internals, dynamic partition structure, and first-hand recovery from a hard brick.
This is not a generic Android rooting guide. Everything here is specific to the RMX3710 hardware, its MediaTek MT6769 SoC, and the firmware constraints introduced across Android 13, 14, and 15 releases.
| Field | Value |
|---|---|
| Model | Realme C55 |
| Codename | RMX3710 |
| SoC | MediaTek Helio G88 (MT6769) |
| Android | Ships Android 13 |
| Bootloader | Not exposed via standard Fastboot |
| Recovery | No dedicated recovery partition |
- Unlocked bootloader (covered in 07)
- Device on Android 13 or Android 14 pre-1800 build (MTKClient compatibility)
- Python 3.x on Linux (Arch Linux used throughout this documentation)
- USB cable with data support
- Battery above 60% before any flashing operation
If the device is on Android 14 (≥1800 build) or Android 15, downgrading to Android 13 is required before MTKClient can connect. This is covered in the flashing document.
| # | Document | Description |
|---|---|---|
| 01 | Device Overview | Hardware specs, partition layout, SoC overview |
| 02 | Boot Chain | Preloader → LK → kernel boot sequence |
| 03 | Bootloader | LK internals, lock states, available interfaces |
| 04 | Stock Firmware | Firmware structure, version identification, sources |
| # | Document | Description |
|---|---|---|
| 05 | Extracting boot.img | Pulling stock boot image from firmware package |
| 06 | Magisk and Boot Image | Patching boot.img with Magisk |
| 07 | Flashing the Patched Image | Downgrade path, MTKClient unlock, flashing |
| 08 | Verifying Root Access | Magisk verification, su access, SELinux state |
| # | Document | Description |
|---|---|---|
| 09 | Android Verified Boot (AVB) | AVB chain, boot states, dm-verity |
| 10 | Dynamic Partitions and super.img | liblp format, lpunpack, lpmake, erofs |
| 11 | OTA Updates After Root | OTA behavior on rooted device, repatching |
| 12 | Kernel Modules | Module signature enforcement, custom kernel, WiFi drivers |
| # | Document | Description |
|---|---|---|
| 13 | Recovery and Unroot | MTKClient/SP Flash Tool recovery, partition restore |
| 15 | Lessons Learned | Hard brick, BootROM recovery, IMEI loss and restoration |
| 16 | Tools Used | Full tool reference with commands and device-specific notes |
Standard Android rooting via Fastboot does not work on the RMX3710. The bootloader Fastboot interface is not exposed on retail firmware.
See 07 - Flashing the Patched Image for the full workflow including firmware compatibility details.
nvram / nvcfg / md1img — back these up before touching anything
These three partitions contain device-specific IMEI, modem calibration, and RF tuning data written at the factory. They are unique to each physical unit and cannot be recovered from any firmware package.
python mtk r nvram nvram_backup.img
python mtk r nvcfg nvcfg_backup.img
python mtk r md1img md1img_backup.imgLosing these without a backup means either a dead modem or a paid IMEI restoration service. See 15 - Lessons Learned for the full account of what happens when you skip this step.
Never flash a scatter file without unchecking nvram, nvcfg, and md1img.
Do not run a full partition erase as a recovery step. A failed erase is harder to recover from than a bad flash. Always target specific partitions.
Official Realme C55 firmware packages (including downgrade OTAs):
https://realmefirmware.com/realme-c55-firmware/
Match the firmware build number exactly to the version installed on the device before extracting any partition image for patching.
| Tool | Purpose |
|---|---|
| MTKClient | Partition R/W, bootloader unlock |
| bypass_utility | Preloader crash → BootROM access |
| SP Flash Tool | Bulk firmware flash, BootROM recovery |
| Magisk | Systemless root |
| MTK-SuperBuilder | MediaTek super.img pack/unpack |
Full tool reference with commands: 16 - Tools Used
This documentation is for educational and security research purposes on hardware I own. Rooting voids the device warranty. Bootloader unlock triggers a factory reset and permanently places the device in ORANGE AVB state. Incorrect partition operations can brick the device.
Everything in this repository reflects operations performed on my own Realme C55 (RMX3710). Your results may differ based on firmware version, hardware revision, or build variant.
0xNeo77 — github.com/AnonNeo77
Security researcher. Offensive security, firmware analysis, Android internals.