Unlock, Root, and Flash Custom Firmware on the Tiq Mini M5 - A Comprehensive Guide

sh7411usa · June 12, 2026, 5:57am

Introduction

Before starting, power on your device, enable developer options by tapping build 7 times in about phone, tick allow OEM unlocking, and enable ADB. It goes without saying that you made all the necessary backups, and that you are solely responsible for bricking your device or otherwise hastening its demise.

Unlock the Bootloader:

Download and extract mtkclient. It requires python, and can be a slight hassle with drivers on windows. Google is your friend.
Weird but important fix: Open the extracted mtkclient folder, and find the seccfg.py file. In my mtkclient release, it was located at:

./mtkclient/mtkclient/Library/Hardware/seccfg.py

Open this file in your favorite text editor.

Find the line that contains:

self.critical_lock_state = 1

And replace the 1 with a 0 as such: For detailed instructions on how to replace a 1 with a 0, please see this post. I also encourage you to watch this instructional video, as it really illustrates the concept.

self.critical_lock_state = 0

In my seccfg.py file, it was located on line 91. After you complete the edit, save your changes to the file.

If you are running linux, you can do it using sed:

sed -i.bak 's/self\.critical_lock_state = 1/self.critical_lock_state = 0/' ./mtkclient/mtkclient/Library/Hardware/seccfg.py

Open a shell or command prompt in the root mtkclient folder and run:

python mtk.py da seccfg unlock

While mtkclient is searching for your device, hold the left soft key and complete the USB connection to your PC. Oib s’hut shoin mechiber gevein tzim compyooter, den plug it out in leig es shoin tzirik arim.
For some reason, I found that it did not always detect the first time I stuck it in (on Windows), and the device screen showed a battery charging graphic. If I subsequently removed and immediately replaced the USB it then the PC detected it and MTKClient ran.
Once detected, the tool will unlock your bootloader.

Successful Command Output

C:\mtkclient>python mtk.py da seccfg unlock
MTK Flash/Exploit Client Public V2.0.1 (c) B.Kerler 2018-2024

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.


...........


Port - Device detected :)
Preloader -     CPU:                    MT6761/MT6762/MT3369/MT8766B(Helio A20/P22/A22/A25/G25)
Preloader -     HW version:             0x0
Preloader -     WDT:                    0x10007000
Preloader -     Uart:                   0x11002000
Preloader -     Brom payload addr:      0x100a00
Preloader -     DA payload addr:        0x201000
Preloader -     CQ_DMA addr:            0x10212000
Preloader -     Var1:                   0x25
Preloader - Disabling Watchdog...
Preloader - HW code:                    0x717
Preloader - Target config:              0x0
Preloader -     SBC enabled:            False
Preloader -     SLA enabled:            False
Preloader -     DAA enabled:            False
Preloader -     SWJTAG enabled:         False
Preloader -     EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:  False
Preloader -     Root cert required:     False
Preloader -     Mem read auth:          False
Preloader -     Mem write auth:         False
Preloader -     Cmd 0xC8 blocked:       False
Preloader - Get Target info
Preloader -     HW subcode:             0x8a00
Preloader -     HW Ver:                 0xca01
Preloader -     SW Ver:                 0x200
Preloader - ME_ID:                      DD840BA83DD4EF17B5DB39159FE89FAD
Preloader - SOC_ID:                     665ADF716510CA02E29B26A1B606F5C4976683F5F8000CB07FDA8FB3FF2910D3
DaHandler - Device is unprotected.
DaHandler - Device is in Preloader-Mode.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - EMMC FWVer:      0x0
DAXFlash - EMMC ID:         HBG4a2
DAXFlash - EMMC CID:        90014a484247346132a5520018511503
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size:   0x0
DAXFlash - EMMC GP2 Size:   0x0
DAXFlash - EMMC GP3 Size:   0x0
DAXFlash - EMMC GP4 Size:   0x0
DAXFlash - EMMC RPMB Size:  0x400000
DAXFlash - EMMC USER Size:  0x747c00000
DAXFlash - HW-CODE         : 0x717
DAXFlash - HWSUB-CODE      : 0x8A00
DAXFlash - HW-VERSION      : 0xCA01
DAXFlash - SW-VERSION      : 0x200
DAXFlash - CHIP-EVOLUTION  : 0x0
DAXFlash - DA-VERSION      : 1.0
DAXFlash - Extensions were accepted. Jumping to extensions...
DAXFlash - Boot to succeeded.
DAXFlash - DA Extensions successfully added
XFlashExt - Detected V4 Lockstate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
SecCfgV4 - hwtype found: V4
Sej - HACC init
Sej - HACC run
Sej - HACC terminate
Progress: |██████████| 100.0% Write (0x1/0x1, ) 0.04 MB/s
DaHandler - Successfully wrote seccfg.

We are not finished. You have just put the device into “Orange state” - the bootloader is unlocked. Fastboot will now allow flashing partitions. However, if these partitions are not verified, your device will fail DM-Verity, and will move to “Red State” - corrupt firmware - and will refuse to boot. You still must break AVB if you wish to install unverified firmware.

(You can still root, and flash a patched boot. Just no vbmeta protected partitions, including super partitions (system, product, vendor). If you wish to install a modified or custom ROM, it will have to be signed - something you can do with some hair pulling and the haha-you-used-testkeys tool.)
At this point, your device should be connected and powered off, having just completed the MTKClient unlock. You now need to boot into fastboot. You can either use the You can do so using the auto booter tool, (run the executable, and reconnect the device to the PC while powered off, using the same key combination you used for MTKClient) or run:

adb reboot bootloader

Rooting:

Root is achieved by installing the magisk app and flashing a patched boot image. Incidentally, the Tiq Mini M5 is a dual slot device - but that is imaterial to this guide. The commands provided here will automatically flash to the active slot. If you wish root, continue here, if you want to continue to breaking AVB, skip to step 12.
Obtain a patched boot image. You can get it here for V02, or here for V03 - or make one yourself using the magisk app or a PC tool. Google is still your friend. Once in fastboot, note the name of your patched boot image and flash it, like below (replacing the image name with your specific image name).

fastboot flash boot magisk_patched-30700_gyNgB.img

Breaking AVB:

Users report that an interesting sequence of flashing and reboots is required in order to prevent DM-Verity panic (“Red State”). While possible that omitting some of the following steps may still achieve the desired results, the route presented here is tried and proven.
While still in fastboot, reflash vbmeta using the image pulled from your backup or from the update package (if using V03), using this command:

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

Reboot the device to fastbootd using:

fastboot reboot-fastboot

Return to low level fastboot by running:

fastboot reboot bootloader

Custom Firmware:

Now, reboot the device and Red State should be cleared. At this point, you should be able to flash even an unverified super, which you may do using the method of your choice. After flashing a new super, don’t forget that you usually have to wipe userdata, using:

fastboot erase userdata

Finally, you are ready to boot into system!

fastboot reboot

Credits

Info from this guide taken from posts by @cobre , @kosherboy , and also source from @Yidish. Credit is also due to this post from @4dev, documenting the method required to clear Red State. Shoutout to @ars18 for his guidance and assistance with this device (“To be precise, dumb’s the word”) and his excellent tool linked above. This guide brings together a working approach for unlock and root in one place - tried and tested.

kosherboy · June 12, 2026, 3:23pm

Please post your comments here: