# Rooting an Android Blu View 2 BL130DL ## Background I needed a rooted physical android phone and the process to get one turned out to be surprisingly complicated. Here's the Short Version: - Acquire a Blu View 2 BL130DL - Enable developer mode, usb debugging, and oem unlocking in settings - Download the ISO from https://github.com/bkerler/mtkclient and boot it - Run the mtkclient gui app on the desktop - Plug in your phone, pull the battery, reinstall battery, hold down volume up/volume down and power - Dump all the partitions to a usb, come back in 12 hours - Use mtkclient gui to unlock the bootloader - Reboot the phone and it'll load recovery mode and when asked select delete all data - Copy boot.bin to the phone using adb - Install magisk using adb - Patch the boot.bin - Magisk can't install the firmware so you need to flash it using mtkclient - Use adb to copy the patched boot.bin to your computer - Pull the battery, reinstall battery, hold down volume up/volume down and power - Use mtkclient gui to patch boot using the new magisk modified image - Use mtkclient gui to patch vbmeta using mtkclients empty version in /opt/mtkclient/ - Reinstall magisk and have it run post install steps - Enjoy your root from adb shell -> su Here's the full journey: I needed a phone so I started by going to the store and grabbing the cheapest $30 phone I could find. It was a Verizon prepaid Nokia C110 Android 13 phone and a quick google told me that was rootable. When I got home googling how to root this thing lead me to a bunch of sketchy websites that say it is possible to root your phone just install our malware KingoRoot, but the truth is. As of Android 5 with new security enhancements you will need an unlocked bootloader. This phone does not have an unlocked bootloader and there is no way to unlock it without some crazy exploit that doesn't yet publicly exist. Prepaid phones also have a subsidized cost and most don't have a way to unlock the bootloader. YMMV if you manage to unlock one, I wasn't willing to pay $300 to unlock my device. So I returned the device and googled what phone brands have unlocked bootloaders and found out Blu phones have the OEM unlock permission in Settings. They have sketchy chinese origins and have been known to push updates that caused people to lose all their data, but that's a different story. https://www.consumerreports.org/electronics-computers/privacy/what-you-need-to-know-about-phones-secretly-sending-data-china-a6595861299/ https://www.xda-developers.com/blu-software-update-bug-locked-phones/ I picked up what my local bestbuy had in stock at $100 a Blu G63. And while the bootloader unlock privilege is enabled in settings, the bootloader is not unlocked. Blu also does not provide firmware updates to their devices. There are 7 walkthrough root guides for this phone that look legitamate, but they are all missing files as they do not exist. The manufacturers have to be making these fake guides, the troll is just too strong. In 2023 the way to root your device is to extract a firmware update, get a copy of the boot.img and patch it with Magisk. The patched boot.img can then be flashed and booted with a bootloader that has been unlocked. There were no boot.img's and no firmware updates for my phone and afaik no one had successfully rooted the Blu G63. So I returned it paying a $45 restocking fee. Yikes, lesson learned. I'm writing this post later, to be honest I can't recall if I was even able to unlock the bootloader using adb. For the longest time I was debating on buying a used Pixel as Google allows you to easily unlock the bootloader and root the device without an exploit... This is when I remembered I bought a Android phone a couple years ago for $30. It was a Blu View 2 BL130DL running Android 10. Googling that and I found someone did make an exploit which is able to dump the firmware from that device. So assuming I have an old firmware, this old android phone should be rootable. # The rooting process Googling how to root the device brought me to a bunch of the sketchiest of how to guides that just convinced me I was installing their malware. A whole lot of trust and run my binary, follow my generic youtube video written by some guy who doesn't speak english. I eventually found this: https://xdaforums.com/t/blu-b130dl-unlock-recovery-root-release.4350825/ Which told me mtkclient on github can be used and shortly there after I found this zip package for arch linux that could be used to automatically root the device for you. https://forum.earlybird.club/threads/release-blu-view-2-auto-flasher.1338113/ I enabled usb debugging and enabled the permission to unlock my bootloader from settings on the phone. I should be able to use these tools now. After installing arch in a vm with virtualbox and running the tool, I discovered the auto tool was written for Arch 2021 and it doesn't work with modern 2023 Arch. Taking a closer look at the code it looks like you just need mtkclient installed and their install.sh script lists the commands to root the device ``` echo We will be dumping your current firmware in cause anything goes wrong. Please be patient,as this can take a while! mkdir ~/backup ./resources/mtk r boot ~/backup/boot.img ./resources/mtk r super ~/backup/super.img ./resources/mtk r vbmeta ~/backup/vbmeta.img ./resources/mtk r recovery ~/backup/recovery.img read -n 1 -r -s -p "Press Any Key To Continue..." echo -e FINAL SANITY CHECK! We are about to unlock your bootloader,and flash a fully updated and rooted system. echo -e Please make sure you have read the readme! read -n 1 -r -s -p "Please press any key to continue..." mtk xflash seccfg unlock mtk w boot ./resources/rootedsystem/boot.img mtk w super ./resources/rootedsystem/super.img mtk w recovery ./resources/rootedsystem/recovery.img mtk w vbmeta ./resources/vbmeta.empty mtk w vbmeta_system ./resources/vbmeta.empty mtk w vbmeta_vendor ./resources/vbmeta.empty echo Flashing should have been successful! Please report back any success or failure,i can be reached at enby_dashie on telegram! ``` That's easy enough. Mtkclient is on github and has been updated in the last couple months cool. Mtkclient is a tool that exploits the bootloader to get file read/write access to the phone, which is the real magic. https://github.com/bkerler/mtkclient I downloaded, booted the iso, and ran the graphical mtkclient app on the desktop. I added a hdd to the VM, formatted the hdd, mounted it manually, and installed open-vm-tools. ``` sudo apt install open-vm-tools ``` I then removed the battery, put the battery back in, plugged it in, held down power, volume up, and volume down for 3 seconds and it booted into BROM mode and was recognized by mtkclient.  I dumped the 4 files listed in the commands above, this took about 1hr to get 4gb. For good measure I dumped all the partitions as well, the 24gb userdata took 11hrs. After dumping everything the VM was sluggish so I rebooted and reinstalled open-vm-tools and remounted the hdd. Once I have these files I can provide the boot partition to magisk to root the phone. There's a build of TWRP, but after reading https://xdaforums.com/t/blu-b130dl-unlock-recovery-root-release.4350825/page-2 they warn TWRP is not functional on this device and can brick your phone. Magisk can be ran from TWRP, but I'm not going to. Further reading has lead me to believe it's probably best not to use anyones base.img's as they will likely only work for their build. People should really stop uploading them. If I had to guess autoflash.zip will work on more devices as it restores enby_dashie's filesystem. But the script only overwrites part of the filesystem and this will also likely have incompatibilities depending on the version... I was reading people's wifi/bluetooth stopped working and they couldn't figure out why trying to follow the XDA writeup. No one has made a custom rom for this phone. I'm just going to go with the magisk method on the mtkclient github and skip overwriting partitions with binaries from whatever group. ### Sim Unlocking Detour I don't think anyone has publicly cracked the sim unlock process yet. You'll need to pay for an unlock code or active tracfone service and request after 12 months. It's mentioned on xdaforums that sim locking is done by the apk in `com.tf.tfsecurity` This $240 russian hardware can do it somehow: https://forum.gsmhosting.com/vbb/f1110/tracfone-b130dl-unlock-done-done-2989340/ There are online versions of it too, I'm guessing you can message them and come to a deal. I think the going rate is $70/year to use a remotely accessible box. https://forum.gsmhosting.com/vbb/f1110/list-resellers-pandora-box-pandora-online-ready-stock-2955203/ There a few services on ebay for $6 that'll unlock the carrier for you. There are a lot of scam unlocking services, some legit. I know some of these companies have been busted hacking into the cell networks and installing backdoors to unlock phones. So if you are wondering how they work that might be how. Some call the company for you and ask for it to be unlocked, if you had service long enough it'll work. If I were gonna risk $30 getting scammed I think I would try unlockbase.com, but who knows if it'll work. It's possible the com.tf.tfsecurity app has a backdoor code. https://blog.uint.dev/network-unlocking-without-carrier-or-oem-intervention-on-mtk/ Even if you unlock the phone, the IMEI will be blacklisted still for major carriers in the US. So you'll have to change that as well. Maybe one of those $6 ebay offers will do that for you for a fee too. You basically need to take a number from a broken phone with a clean imei then flash it over. This tool might work: https://androidmtk.com/download-sp-meta-tool I imagine carriers don't like it when two phones are reporting the same imei so make sure wherever you get your imei it doesn't get reused. I don't need cellular data, so I'm not gonna worry about that for now. ### Back to rooting the device Now finally to fully unlock the bootloader, I went to flash tools tab and pressed Unlock Bootloader  I unplugged the USB, and held down the power. On boot it says the bootloader is unlocked with a warning message before booting. It then gave me a Android Recovery screen telling me I needed to wipe the phone. Which I did and the phone booted properly. The Blu branded start screen can be disabled from the top right hamburger icon. I then used adb to put the partitions on the phone, used adb to install magisk, and ran magisk to patch the partition. ``` ./adb.exe push boot.bin sdcard/Download/ ./adb.exe install Magisk.apk ``` I then pulled back the patched image. ``` ./adb.exe pull sdcard/Download/magisk_patched-26400_yCKAn.img . ``` From here I needed to get back into BROM to flash it. I pulled the battery, plugged in the usb, held volume up, volume down, power. It showed the bootloader unlocked screen, I let go of volume up, down, power. I then held volume up, down, power again for 3 seconds and it booted into BROM and was detected by MTKClient I opened the Write partition(s) tab, found boot, clicked set and found my magisk modified boot image. I had to use terminal and rename it from `.img` to `.img.bin` I then found vbmeta, clicked set, and found the empty vbmeta in /opt/mtkclient I also had to rename it from `.img.empty` to `.img.empty.bin` Then taking a leap of faith I pressed `Write Partition(s)` When the writing was finished, I unplugged the USB, held down the power button and the phone booted. I opened magisk and it asked to do additional setup and I clicked ok and it rebooted the phone. This time when I opened magisk the super user tab was not grayed out. ``` ./adb.exe shell su whoami ``` Gives me a grant prompt and I have I root now. Quite the process. Also my wifi works. Once you give wifi a bunch of ad apps install Android OTA updates check to see if the bootloader is unlocked and stops the process if it is, so there's no cause for concern on an update bricking the device. ### Back to SIM Unlocking The SIM unlock binary is in: `/product/priv-app/TFSecurity/TFSecurity.apk` and there's another in: `/system/app/VZWRemoteSimlockService/VZWRemoteSimlockService.apk` I unpacked those binaries using dex2jar and jdgui, but I didn't see any hardcoded unlock codes. I imagine you could modify those binaries. Instead I went to https://tfwunlockpolicy.com and punched in my IMEI and it said my phone was eligible for unlocking. Even though I've never activated this phone and it's sat on the shelf for the last 2 years. Maybe tracfone just feels bad for anyone using a Blu phone. I guess I just wait for the email? # Update It has been a week and no email from trackfone. It's not worth sim unlocking this phone. My carrier uses eSim which this device does not support and I don't see myself using this device for cellular.