WARNING: If you fail/misunderstand a step, you may accidentally brick your device. This method involves messing with the actual partitions of the device in order to root. All user data (files, music, apps, games, users, call logs, messages, etc.) will be wiped, so make sure your device is backed up. If your device no longer works, it's your fault as you made the modifications.
TL;DR: Bricking risk, lost of user data
Requirements:
Windows 7+ (I used Windows 7 build 7601 Professional x64) (Windows 10 recommended)
Python 3.8+ (I used 3.8.10) (3.11.x recommended)
UsbDk (I used 1.0.22 x64)
ADB
MtkClient
Unbricked and set-up TCL 20 XE with access to Developer Options
A USB-C to whatever your computer has cable, that allows data transfer (I have an USB-C to USB-A data cable)
Downloads:
Python 3.8.10 Download Page
UsbDk 1.0.22 x64 Direct Download
MtkClient Latest Direct Download
Magisk Manager Patched for MTK Direct Download
Orange State Disabler Download Page (auto install)
Steps:
1. Download everything under the Downloads section above. Optionally, you can install a newer version of UsbDk and Python if you want.
2. Make a folder somewhere. For me, I made an "android modding" folder in my downloads, however this means my files are in C:\Users\Nostii\Downloads\android modding (aka %USERPROFILE%\Downloads\android modding), instead of something easy like C:\android modding.
3. Run and setup Python and UsbDk, make sure to install Python to the PATH.
4. Reboot your computer.
5. Extract MtkClient, (don't extract the Orange State Disabler, otherwise it won't work).
6. Open the command prompt. (Open the start menu and type cmd.exe, and click on it, or go to folder you downloaded and extract the files to, hold shift and right click, and hit Open command window here.)
7. Type cd mtk into the cmd window and press tab, and then enter.
8. Grab your phone. Hold the power button and press the Power off button in the top left corner.
9. Run the command python mtk r boot,vbmeta boot.img,vbmeta.img in the cmd window. After running the command, plug the phone into the computer using the cable you have.
10. Unplug the phone and hold the power button. Make sure you have you patched Magisk apk ready.
11. Enable ADB debugging. Unlock the phone, go to settings, scroll all the way down to the bottom, and tap System. Tap About phone 5087z and scroll all the way down. Tap on Build number about 15 times, go back, and tap Developer options. Tap on OEM unlocking and tap Yes. Scroll down a little it until you see USB debugging, and tap on it, and then press Ok.
12. On your computer, run adb install app-release.apk or whatever you renamed the Magisk apk to and wait.
13. On the phone, go to the home screen, scroll up, and find Magisk and tap Install in the Magisk menu that has the mask icon.
14. On the computer, run adb push boot.img /sdcard/Download and wait.
15. On the phone, press Select and Patch a File, and find the file boot.img in your Downloads. Press Select and wait. When it finishing patching your phones boot.img file, it should give you a file that is named magisk-WHATEVER-HERE.img, You need to know what this file is named. It should be located in your Download folder, but take a screenshot anyways to avoid losing it.
16. On the computer, run adb pull /sdcard/Download/[displayed magisk patched boot filename here] and also run ren [displayed magisk patched boot filename here] boot.patched.
These next steps will unlock the bootloader of the phone and wipe ALL USER DATA. After running the command in step 17, there will be no turning back as all user data will be WIPED, DESTROYED and GONE
17. Turn off the phone entirely and unplug it, and then run the command python mtk e metadata,userdata,md_udc and then plug the phone back in to wipe the user data.
18. Unplug the phone, run the command python mtk xflash seccfg unlock and plug the phone back in. This will unlock the bootloader.
19. Unplug the phone, and turn the phone back on. If done correctly, the phone should reboot back to the device setup screen, which should be the same as AOSP.
If you are getting a dm-verity error on Android 11 (which should be the latest officical build for the 20 XE), just press the power button, then the device should boot and show a warning about having an unlocked bootloader (Orange State) and then the device should boot into Android within 5 seconds or so. The Orange State warning will show on every boot.
20. Turn the phone back off, and run python mtk w boot,vbmeta boot.patched,vbmeta.img.empty and plug the phone back in to root the phone.
21. Turn the phone back on, and set the device up. Repeat step 11 but skip enabling OEM unlocking as that option will be grayed out due to the unlocked bootloader (re-enable ADB debugging).
22. Run adb install app-release.apk (or whatever the Magisk APK is named) to restore the Magisk app (the one that is in the app drawer is supposed to download Magisk but fails) and run it. It should show Installed 1eb83ad8-alpha-30 (23001) like mine does. Optionally, you can install Root Checker, run it, grant it root permission with Magisk, and see it is fully rooted.
Optional Steps to disable the Orange State warning:
1a. Optionally, you can disable Orange State, which is the text that shows how the bootloader is unlocked and the device is not trusted, which makes the device boot take at least 5 seconds longer (they really want you to read that, and I guess relock the bootloader), do NOT extract the zip file, it is meant to be flashed.
2a. THIS PART OF THIS GUIDE IS UNFINISHED, DON'T WORRY THOUGH, THE ORANGE STATE WARNING ISN'T GOING TO BRICK YOUR DEVICE OR ANYTHING, THIS IS REALLY ONLY TO MAKE THE DEVICE BOOT 5 SECONDS LONGER WITHOUT RELOCKING THE BOOTLOADER WHILE NOT SHOWING THIS WARNING. SORRY.
Optional Steps to Relock the Bootloader:
1b. Power the device back off.
2b. Run python mtk xflash seccfg lock on the computer. Plug the phone back in. Unplug when finished and reboot. The bootloader is now locked again, but the device should still be rooted. Do NOT run this if you are going to flash a custom ROM like LineageOS, Linux (such as Ubuntu Touch), or CaylxOS. Running this command should also fix the Orange State warning on device boot (when it says TCL powered by Android), however if you want to keep an unlocked bootloader while disabling this warning, try doing steps 1a to step a.
Proof of Root: Google Photos link to 4 photos of my rooted TCL 20 XE
TL;DR: Bricking risk, lost of user data
Requirements:
Windows 7+ (I used Windows 7 build 7601 Professional x64) (Windows 10 recommended)
Python 3.8+ (I used 3.8.10) (3.11.x recommended)
UsbDk (I used 1.0.22 x64)
ADB
MtkClient
Unbricked and set-up TCL 20 XE with access to Developer Options
A USB-C to whatever your computer has cable, that allows data transfer (I have an USB-C to USB-A data cable)
Downloads:
Python 3.8.10 Download Page
UsbDk 1.0.22 x64 Direct Download
MtkClient Latest Direct Download
Magisk Manager Patched for MTK Direct Download
Orange State Disabler Download Page (auto install)
Steps:
1. Download everything under the Downloads section above. Optionally, you can install a newer version of UsbDk and Python if you want.
2. Make a folder somewhere. For me, I made an "android modding" folder in my downloads, however this means my files are in C:\Users\Nostii\Downloads\android modding (aka %USERPROFILE%\Downloads\android modding), instead of something easy like C:\android modding.
3. Run and setup Python and UsbDk, make sure to install Python to the PATH.
4. Reboot your computer.
5. Extract MtkClient, (don't extract the Orange State Disabler, otherwise it won't work).
6. Open the command prompt. (Open the start menu and type cmd.exe, and click on it, or go to folder you downloaded and extract the files to, hold shift and right click, and hit Open command window here.)
7. Type cd mtk into the cmd window and press tab, and then enter.
8. Grab your phone. Hold the power button and press the Power off button in the top left corner.
9. Run the command python mtk r boot,vbmeta boot.img,vbmeta.img in the cmd window. After running the command, plug the phone into the computer using the cable you have.
10. Unplug the phone and hold the power button. Make sure you have you patched Magisk apk ready.
11. Enable ADB debugging. Unlock the phone, go to settings, scroll all the way down to the bottom, and tap System. Tap About phone 5087z and scroll all the way down. Tap on Build number about 15 times, go back, and tap Developer options. Tap on OEM unlocking and tap Yes. Scroll down a little it until you see USB debugging, and tap on it, and then press Ok.
12. On your computer, run adb install app-release.apk or whatever you renamed the Magisk apk to and wait.
13. On the phone, go to the home screen, scroll up, and find Magisk and tap Install in the Magisk menu that has the mask icon.
14. On the computer, run adb push boot.img /sdcard/Download and wait.
15. On the phone, press Select and Patch a File, and find the file boot.img in your Downloads. Press Select and wait. When it finishing patching your phones boot.img file, it should give you a file that is named magisk-WHATEVER-HERE.img, You need to know what this file is named. It should be located in your Download folder, but take a screenshot anyways to avoid losing it.
16. On the computer, run adb pull /sdcard/Download/[displayed magisk patched boot filename here] and also run ren [displayed magisk patched boot filename here] boot.patched.
These next steps will unlock the bootloader of the phone and wipe ALL USER DATA. After running the command in step 17, there will be no turning back as all user data will be WIPED, DESTROYED and GONE
17. Turn off the phone entirely and unplug it, and then run the command python mtk e metadata,userdata,md_udc and then plug the phone back in to wipe the user data.
18. Unplug the phone, run the command python mtk xflash seccfg unlock and plug the phone back in. This will unlock the bootloader.
19. Unplug the phone, and turn the phone back on. If done correctly, the phone should reboot back to the device setup screen, which should be the same as AOSP.
If you are getting a dm-verity error on Android 11 (which should be the latest officical build for the 20 XE), just press the power button, then the device should boot and show a warning about having an unlocked bootloader (Orange State) and then the device should boot into Android within 5 seconds or so. The Orange State warning will show on every boot.
20. Turn the phone back off, and run python mtk w boot,vbmeta boot.patched,vbmeta.img.empty and plug the phone back in to root the phone.
21. Turn the phone back on, and set the device up. Repeat step 11 but skip enabling OEM unlocking as that option will be grayed out due to the unlocked bootloader (re-enable ADB debugging).
22. Run adb install app-release.apk (or whatever the Magisk APK is named) to restore the Magisk app (the one that is in the app drawer is supposed to download Magisk but fails) and run it. It should show Installed 1eb83ad8-alpha-30 (23001) like mine does. Optionally, you can install Root Checker, run it, grant it root permission with Magisk, and see it is fully rooted.
Optional Steps to disable the Orange State warning:
1a. Optionally, you can disable Orange State, which is the text that shows how the bootloader is unlocked and the device is not trusted, which makes the device boot take at least 5 seconds longer (they really want you to read that, and I guess relock the bootloader), do NOT extract the zip file, it is meant to be flashed.
2a. THIS PART OF THIS GUIDE IS UNFINISHED, DON'T WORRY THOUGH, THE ORANGE STATE WARNING ISN'T GOING TO BRICK YOUR DEVICE OR ANYTHING, THIS IS REALLY ONLY TO MAKE THE DEVICE BOOT 5 SECONDS LONGER WITHOUT RELOCKING THE BOOTLOADER WHILE NOT SHOWING THIS WARNING. SORRY.
Optional Steps to Relock the Bootloader:
1b. Power the device back off.
2b. Run python mtk xflash seccfg lock on the computer. Plug the phone back in. Unplug when finished and reboot. The bootloader is now locked again, but the device should still be rooted. Do NOT run this if you are going to flash a custom ROM like LineageOS, Linux (such as Ubuntu Touch), or CaylxOS. Running this command should also fix the Orange State warning on device boot (when it says TCL powered by Android), however if you want to keep an unlocked bootloader while disabling this warning, try doing steps 1a to step a.
Proof of Root: Google Photos link to 4 photos of my rooted TCL 20 XE
Last edited: