下载backup_small,

解压 backup_small.txt 到MTKClient根目录下。

命令行进入MTKClient根目录F:\Tools\MTK Tools\mtkclient-main，

执行 python mtk.py script backup_small.txt 进行备份、禁用verity和验证、解锁

(先执行命令，出现等待设备时再按手机音量上+下键连接电脑)

也可以逐行进行备份，注意每执行一条，需要开机、关机一次

python mtk.py r boot_a ./backup/boot_a.img

python mtk.py r boot_b ./backup/boot_b.img

python mtk.py r vbmeta_a ./backup/vbmeta_a.img

python mtk.py r vbmeta_b ./backup/vbmeta_b.img

python mtk.py r nvram ./backup/nvram.bin

python mtk.py r nvdata ./backup/nvdata.bin

python mtk.py r nvcfg ./backup/nvcfg.bin

python mtk.py r protect1 ./backup/protect1.bin

python mtk.py r protect2 ./backup/protect2.bin

python mtk.py r boot1 ./backup/boot1.bin --parttype boot1

python mtk.py r boot2 ./backup/boot2.bin --parttype boot2

python mtk.py r seccfg ./backup/seccfg.bin

python mtk.py r lk_a ./backup/lk_a.bin

python mtk.py r lk_b ./backup/lk_b.bin

python mtk.py r misc ./backup/misc.bin

python mtk.py r para ./backup/para.bin

python mtk.py r expdb ./backup/expdb.bin

python mtk.py r frp ./backup/frp.bin

python mtk.py r vbmeta_system_a ./backup/vbmeta_system_a.bin

python mtk.py r vbmeta_system_b ./backup/vbmeta_system_b.bin

python mtk.py r vbmeta_vendor_a ./backup/vbmeta_vendor_a.bin

python mtk.py r vbmeta_vendor_b ./backup/vbmeta_vendor_b.bin

python mtk.py r md_udc ./backup/md_udc.bin

python mtk.py r metadata ./backup/metadata.bin

python mtk.py r md1img_a ./backup/md1img_a.bin

python mtk.py r md1img_b ./backup/md1img_b.bin

python mtk.py r spmfw_a ./backup/spmfw_a.bin

python mtk.py r spmfw_b ./backup/spmfw_b.bin

python mtk.py r scp_a ./backup/scp_a.bin

python mtk.py r scp_b ./backup/scp_b.bin

python mtk.py r sspm_a ./backup/sspm_a.bin

python mtk.py r sspm_b ./backup/sspm_b.bin

python mtk.py r gz_a ./backup/gz_a.bin

python mtk.py r gz_b ./backup/gz_b.bin

python mtk.py r vendor_boot_a ./backup/vendor_boot_a.bin

python mtk.py r vendor_boot_b ./backup/vendor_boot_b.bin

python mtk.py r dtbo_a ./backup/dtbo_a.bin

python mtk.py r dtbo_b ./backup/dtbo_b.bin

python mtk.py r tee_a ./backup/tee_a.bin

python mtk.py r tee_b ./backup/tee_b.bin

python mtk.py r sec1 ./backup/sec1.bin

python mtk.py r proinfo ./backup/proinfo.bin

python mtk.py r boot_para ./backup/boot_para.bin

python mtk.py r logo ./backup/logo.bin

python mtk.py r otp ./backup/otp.bin

python mtk.py r flashinfo ./backup/flashinfo.bin

python mtk.py r super ./backup/super.bin

去掉dm-verity corruption

进入bootloader模式：adb reboot bootloader

bootloader模式下执行：fastboot --disable-verity --disable-verification flash vbmeta_a "F:\Tools\MTK Tools\mtkclient-main\backup\vbmeta_a.img"

bootloader模式下执行：fastboot --disable-verity --disable-verification flash vbmeta_b "F:\Tools\MTK Tools\mtkclient-main\backup\vbmeta_b.img"

（报错，待验证）

执行：fastboot erase cache，会报错，但不用管它

再执行fastboot reboot fastboot

再执行fastboot reboot

在vbmeta上禁用verity和验证

python mtk.py da vbmeta 3

解锁引导加载程序

python mtk.py da seccfg unlock

解锁后，开机有如下提示：

dm-verity corruption

Your device is corrupt.

It can't be trusted and may not work properly.

Press power button to continue.

Or,device will power off in 5s

按一下电源键让它开机，要不然会关机，下面有去掉的办法。

下载安装Magisk-v27

上传boot到手机

adb push "F:/Tools/MTK Tools/mtkclient-main/backup/boot_a.img" /sdcard/Download

adb push "F:/Tools/MTK Tools/mtkclient-main/backup/boot_b.img" /sdcard/Download

分别用Magisk修补boot_a.img和boot_b.img（boot_b修补错误，待研究）

提取修补后的boot.img到电脑

adb pull /sdcard/Download/xxx.img

adb pull /sdcard/Download/xxx.img

mv xxx.img boot_a.patched

mv xxx.img boot_b.patched

擦除元数据和用户数据（没必要）

python mtk.py e metadata,userdata,md_udc

刷入magisk-patched引导镜像

在F:\Tools\MTK Tools\mtkclient-main目录下执行命令 python mtk.py w boot_a boot_a.patched，出现等待设备时再按手机音量上+下键连接电脑

python mtk.py w boot_b boot_b.patched

（因修补出错没做，待验证）