How To Guide [EU model] Unlock bootloader of European model - Realme GT 2 Pro

As you may know, at the time of writing it's not possible to unlock the bootloader of the European model. Fortunately there's a workaround. To know how it works, scroll to the end of the post.
First of all, this is only for the European RMX3301, but you can try on any other global model that doesn't allow the unlocking of the bootloader. I'm not talking about temporary errors, but of the infamous This phone model does not support deep testing error message.
Before starting I would like to thank polygraphene for their implementation of the Dirty Pipe vulnerability on Android. Without that, this would not have been possible.
Requirements:​
The phone with a decent charge. Do not attempt this procedure with the phone at 10% and then cry if something goes wrong
A compatible build, read below
A Windows or Linux PC with adb and fastboot drivers installed
Check if your build is compatible:​
Go to Settings -> About device -> Version and check Build number:
If your build is between RMX3301_11_A.14 and RMX3301_11_A.21, go to the procedure below
If your build is lower than RMX3301_11_A.14, or higher than RMX3301_11_A.21, install this OTA package to downgrade (or upgrade) to RMX3301_11_A.14
Procedure:​
Make sure under Developer options you have OEM unlocking and USB debugging enabled
Download and extract the attached gt2pro_eu_unlock_dirtypipe_v0.2.zip file
Open a terminal in the folder of the extracted files
Connect the phone to the PC and select the File transfer option
Run the script:
On Windows, type run.bat and press enter
On Linux, type ./run.sh and press enter
Now the phone is temporarily rooted and the phone model is changed to RMX3301. Do not reboot or you will lose this status.
At this point you can follow the procedure on the official forum to unlock the bootloader of the global model. If you already have the Deeptesting app installed, clear its data to make sure it will update.
Changelog:​v0.2:
Show more info about device for better debug
Show the model at the end to check if it worked
For technical people: how does it work?​The script abuses a vulnerability of the Linux kernel called Dirty Pipe (or CVE-2022-0847). For further details, you can visit the official website. This allows us to gain temporary root and overwrite the ro.product.name property, the only one checked by the Deeptesting app. The vulnerability is present in Android and it has been fixed, at least for the Pixel 6, in the May 2022 security update. On the GT 2 Pro, the vulnerability has been fixed with the Android 13 update, while the latest Android 12 build (RMX3301_11_A.21) is still vulnerable. I have tested the procedure personally up to build RMX3301_11_A.16. If you're on a newer build and it doesn't work, please report it in the comments.
Will it work on device X?​If the following conditions are met:
it is a Realme device;
the kernel version is 5.10.66;
there's a global model with a different ro.product.name that can be unlocked;
then you can edit the startup-root file and replace RMX3301 (near the end) with the ro.product.name of the global model and try if it works. If it doesn't, it could be for a lot of reasons. Unfortunately, I can't help you without physically having the device in hand.
If you have further questions about the procedure, please post them below.

---

woowww... thanks for you aport

---

I wonder if we can use this temporary root to do some modifications on system.

---

criszz said:
I wonder if we can use this temporary root to do some modifications on system.
criszz said:
I wonder if we can use this temporary root to do some modifications on system.
Click to expand...
Click to collapse
Excellent question... for example try modific the build regist
Click to expand...
Click to collapse

---

Rapper_skull said:
As you may know, at the time of writing it's not possible to unlock the bootloader of the European model. Fortunately there's a workaround. To know how it works, scroll to the end of the post.
First of all, this is only for the European RMX3301, but you can try on any other global model that doesn't allow the unlocking of the bootloader. I'm not talking about temporary errors, but of the infamous This phone model does not support deep testing error message.
Before starting I would like to thankpolygraphene for their implementation of the Dirty Pipe vulnerability on Android. Without that, this would not have been possible.
Requirements:
The phone with a decent charge. Do not attempt this procedure with the phone at 10% and then cry if something goes wrong
A compatible build, read below
A Windows or Linux PC with adb and fastboot drivers installed
Check if your build is compatible:
Go to Settings -> About device -> Version and check Build number:
If your build is RMX3301_11_A.14, RMX3301_11_A.15 or RMX3301_11_A.16, go to the procedure below
If your build is lower than RMX3301_11_A.14, or higher than RMX3301_11_A.16, install this OTA package to downgrade (or upgrade) to RMX3301_11_A.14
Procedure:
Make sure under Developer options you have OEM unlocking and USB debugging enabled
Download and extract the attached gt2pro_eu_unlock_dirtypipe.zip file
Open a terminal in the folder of the extracted files
Connect the phone to the PC and select the File transfer option
Run the script:
On Windows, type run.bat and press enter
On Linux, type ./run.sh and press enter
Now the phone is temporarily rooted and the phone model is changed to RMX3301. Do not reboot or you will lose this status.
At this point you can follow the procedure on the official forum to unlock the bootloader of the global model. If you already have the Deeptesting app installed, clear its data to make sure it will update.
For technical people: how does it work?
The script abuses a vulnerability of the Linux kernel called Dirty Pipe (or CVE-2022-0847). For further details, you can visit the official website. This allows us to gain temporary root and overwrite the ro.product.name property, the only one checked by the Deeptesting app. The vulnerability is present in Android and it has been fixed, at least for the Pixel 6, in the may 2022 security update. At the time of writing, the latest build for the GT2 Pro is RMX3301_11_A.16, and it's still vulnerable.
If you have further questions about the procedure, please post them below.
Click to expand...
Click to collapse
When you try the procedure... delete al date of phone? whe finish---- type run.bat and press enter ---- erase all?

---

criszz said:
I wonder if we can use this temporary root to do some modifications on system.
Click to expand...
Click to collapse
Theoretically you can do everything you can do on a rooted phone (Magisk, but without modules and Zygisk). In practice I never got Magisk to work properly, so I just limited myself to change the property. My goal was to unlock the bootloader, so I did it and installed Magisk.

---

manu81cba said:
When you try the procedure... delete al date of phone? whe finish---- type run.bat and press enter ---- erase all?
Click to expand...
Click to collapse
My procedure will not delete any data, but after that you have to follow the official procedure to unlock the bootloader, and that will factory reset your phone.

---

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have this error... why?

---

manu81cba said:
View attachment 5634133
I have this error... why?
Click to expand...
Click to collapse
Can you post the output of adb devices?

---

Rapper_skull said:
Can you post the output of adb devices?
Click to expand...
Click to collapse
You can explain? no understand.. what do you say?

---

manu81cba said:
You can explain? no understand.. what do you say?
Click to expand...
Click to collapse
In the terminal, where you are, type adb devices and press enter, then post the output.

---

Rapper_skull said:
In the terminal, where you are, type adb devices and press enter, then post the output.
Click to expand...
Click to collapse

---

manu81cba said:
View attachment 5634133
I have this error... why?
Click to expand...
Click to collapse
Yes i have same output on A.16 installed.

---

manu81cba said:
View attachment 5634153
Click to expand...
Click to collapse
I can see that you have two different versions of adb, one inside the platform-tools folder and one installed elsewhere. Please confirm that by running adb version inside platform-tools and then outside.

---

Rapper_skull said:
In the terminal, where you are, type adb devices and press enter, then post the output.
Click to expand...
Click to collapse
now put all file decripted to plataform adb... and this result... all ok?

---

manu81cba said:
now put all file decripted to plataform adb... and this result... all ok?
View attachment 5634159
Click to expand...
Click to collapse
Yes. To make sure, run adb getprop ro.product.name and confirm it's RMX3301.

---

manu81cba said:
now put all file decripted to plataform adb... and this result... all ok?
View attachment 5634159
Click to expand...
Click to collapse
Working now?
Is rooting temporary? i can modific build.pro? or this process is only for change the model propety?

---

manu81cba said:
Working now?
Is rooting temporary? i can modific build.pro? or this process is only for change the model propety?
Click to expand...
Click to collapse
No, you can't modify any files, since /system is read-only. Even if you manage to do it, you will brick your device since the bootloader is still locked. If you want to unlock your bootloader, follow the official guide I've linked.

---

Rapper_skull said:
Yes. To make sure, run adb getprop ro.product.name and confirm it's RMX3301.
Click to expand...
Click to collapse

---

manu81cba said:
View attachment 5634169
Click to expand...
Click to collapse
Sorry, adb shell getprop ro.product.name