A523-root: First Root Method for Allwinner A523/T527

Root any Allwinner A523 tablet via FEL mode -- no exploit, no UART, no fastboot unlock required.

A bare-metal eMMC driver that runs entirely from 40 KB of SRAM, bypassing TrustZone, signed boot chains, and every other obstacle the A523 puts in your way.


Target SoC	Allwinner A523 / T527 (sun55iw3p1 "saturn")
Method	FEL mode -> SRAM eMMC driver -> Magisk patch -> Secure Storage unlock
Confirmed on	Jeazans KT1016 (863C_MB_V2.8), Android 14, kernel 5.15.144
Root	Magisk 28.1, `uid=0(root)`

Quick Start

For people who just want root and already have FEL mode working.

# 1. Build the eMMC driver
cd tools && make docker

# 2. Enter FEL mode (SD card method or Vol Down + Power)
xfel version   # verify: AWUSBFEX ID=0x00185900(A523)

# 3. Read the partition table
./emmc-tool.sh gpt

# 4. Dump init_boot_a (keep this backup!)
./emmc-tool.sh dump init_boot_a init_boot_a_original.img
sha256sum init_boot_a_original.img

# 5. Boot tablet normally, install Magisk, patch init_boot_a
adb install Magisk-v28.1.apk
adb push init_boot_a_original.img /storage/emulated/0/Download/
# On tablet: Magisk > Install > Select and Patch a File > init_boot_a_original.img
adb pull /storage/emulated/0/Download/magisk_patched-*.img .

# 6. Re-enter FEL mode, flash patched image
./emmc-tool.sh flash init_boot_a magisk_patched-28100_xxxxx.img

# 7. Unlock bootloader via Secure Storage
./emmc-tool.sh read 12288 256 secure_storage.bin
python3 unlock-bootloader.py patch secure_storage.bin secure_storage_unlocked.bin
python3 unlock-bootloader.py verify secure_storage_unlocked.bin
./emmc-tool.sh write 12288 secure_storage_unlocked.bin

# 8. Remove SD card, reboot, verify
adb shell su -c id
# uid=0(root) gid=0(root) groups=0(root) ...

Why the A523 Is Hard to Root

The Allwinner A523 is a budget SoC that is surprisingly difficult to root:

Locked bootloader with no unlock mechanism. fastboot flashing unlock is a no-op. The "OEM Unlocking" toggle does nothing.
Signed boot chain with per-item RSA certificates. Patching U-Boot is cryptographically rejected.
TrustZone blocks DRAM writes from Non-Secure code. FEL mode gives Non-Secure SVC (EL1). The SPC at the bus fabric silently drops all DRAM writes.
TOC0 SD boot gives Secure SVC, not EL3. Self-signed TOC0 payloads cannot reconfigure TrustZone.
No UART visibility. Debugging is entirely via register dumps over USB.
GKI kernel hardening (kCFI, SCS) blocks software exploit paths.
No firmware images available publicly for this device.

Five approaches were tried and failed before the working method was found. See docs/failed-approaches.md for the full story.

The Key Insight

Instead of fighting TrustZone or the signed boot chain, the working method bypasses them entirely: run everything from SRAM, never touch DRAM.

The A523 BROM maps 40 KB of SRAM. The SMHC2 eMMC controller supports PIO/FIFO mode (no DMA needed). A bare-metal C driver can read and write the entire eMMC from SRAM alone -- no DRAM, no TrustZone, no signed code in the way.

Full Root Procedure

Prerequisites

xfel built from git HEAD with A523 support (github.com/xboot/xfel)
Magisk v28.1+ APK (github.com/topjohnwu/Magisk)
emmc-tool.sh + fel-emmc.bin (from this repository's tools/ directory)
unlock-bootloader.py (from this repository's tools/ directory)
USB-A to USB-C cable
macOS or Linux host
Docker (for building, or arm-none-eabi-gcc installed locally)

Step 1: Enter FEL Mode

Option A: SD Card (recommended)

Write the FEL boot TOC0 to a microSD card at sector 16:

dd if=fel-sdboot-a523.toc0 of=/dev/sdX bs=512 seek=16

Insert the SD card, hold Vol Down, and power on. The BROM loads the TOC0 from SD and drops into FEL mode reliably every time. No timing-sensitive button combos needed.

The SD card method was invaluable during the hundreds of reboot cycles required for driver development and debugging. If you plan to do any iterative work, use this method.

Option B: Button combo (no SD card needed)

Power off completely. Then:

Hold Vol Down
Press Power for 2 seconds, release Power
Tap Power 3 more times (keep holding Vol Down)
Screen stays completely off = success
Connect USB cable

On some 863C boards, there is also a hardware FEL button on the PCB.

Verify FEL mode:

xfel version
# Expected: AWUSBFEX ID=0x00185900(A523) ...

Step 2: Build the eMMC Driver

cd tools
make docker    # builds via Docker, no local toolchain needed
# Or: make     # if you have arm-none-eabi-gcc installed

Step 3: Read the Partition Table

./emmc-tool.sh gpt

This reads the GPT and caches partition offsets. You need this before dump or flash commands.

Step 4: Back Up Everything

Do this before making any changes. These backups are your recovery path.

./emmc-tool.sh dump init_boot_a init_boot_a_original.img
./emmc-tool.sh read 12288 256 secure_storage_original.bin
./emmc-tool.sh dump env_a env_a_backup.bin
sha256sum init_boot_a_original.img secure_storage_original.bin env_a_backup.bin

Save these files somewhere safe. If anything goes wrong, you can restore them via FEL.

Step 5: Patch init_boot_a with Magisk

Boot the tablet normally (disconnect USB, remove SD card if present, hold power). Then:

adb install Magisk-v28.1.apk
adb push init_boot_a_original.img /storage/emulated/0/Download/

On the tablet: open Magisk > Install > Select and Patch a File > select init_boot_a_original.img.

adb pull /storage/emulated/0/Download/magisk_patched-*.img .

Step 6: Flash Patched init_boot_a

Re-enter FEL mode (Step 1), then:

./emmc-tool.sh flash init_boot_a magisk_patched-28100_xxxxx.img

Step 7: Unlock Bootloader via Secure Storage

This is the critical Allwinner-specific step. The bootloader unlock state is stored in a proprietary "Secure Storage" area, not controlled by fastboot flashing unlock. See docs/secure-storage-format.md for the full format documentation.

# Dump current Secure Storage
./emmc-tool.sh read 12288 256 secure_storage_original.bin

# Add unlock flags
python3 unlock-bootloader.py patch secure_storage_original.bin secure_storage_unlocked.bin

# Verify the patch
python3 unlock-bootloader.py verify secure_storage_unlocked.bin

# Write back
./emmc-tool.sh write 12288 secure_storage_unlocked.bin

The unlock-bootloader.py script adds two items:

fastboot_status_flag = "unlocked"
device_unlock = "unlock"

Step 8: Keep Original vbmeta

Do NOT flash a disabled vbmeta. This is an Allwinner-specific gotcha:

On most Android devices, vbmeta --flags 0x02 (disable verification) lets you boot modified images.
On this Allwinner bootloader, vbmeta with flags=0x02 causes an immediate boot halt: "your device is corrupt."
The correct approach: keep the original vbmeta (flags=0x00), unlock via Secure Storage, and let AVB do warn-and-continue (yellow boot state).

Step 9: Boot and Verify

Remove the SD card (if used for FEL entry). Power cycle the tablet.

You will see an orange/yellow "Your device has been unlocked" warning for 5 seconds, then Android boots normally.

adb shell su -c id
# uid=0(root) gid=0(root) groups=0(root) ...

Open Magisk -- it should show "Installed" with version 28.1.

Technical Deep Dive

Architecture

Host (xfel) <--USB--> BROM FEL <--SRAM--> fel-emmc.c <--SMHC2/FIFO--> eMMC
                                    |
                                    +-- 40KB SRAM only, no DRAM

Memory Map

0x20000           Code (loaded by xfel, ~4KB)
0x2FFF0           Command block (16 bytes, written by host before each exec)
0x30000-0x4FFFF   Data buffer (128KB = 256 sectors)
0x58000           Stack (grows down)

Command Protocol

The host writes a 16-byte command block to SRAM, then executes the code:

Offset	Field	Description
+0x00	cmd	0x01=read, 0x02=write, 0x03=info, 0x04=boot_read, 0x06=fix_extcsd
+0x04	sector	Starting eMMC sector (LBA)
+0x08	count	Number of sectors (max 128 for reads, 64 for writes)
+0x0C	flags	Reserved / PARTITION_CONFIG for boot_read

Status is reported via RTC General Purpose registers (0x07090100), which survive across FEL exec calls:

Register	Purpose
GP0	State: 0x01=init, 0x02=card_ready, 0x10=reading, 0x20=writing, 0xAA=done, 0xEE=error
GP1	Progress (sectors completed) or error code
GP2	Diagnostic: first data word / CID / error detail
GP3	Diagnostic: CID[1]

The Orchestration Layer

Since each FEL exec call must complete within ~3 seconds (BROM USB timeout), large operations are chunked by emmc-tool.sh:

Write command block to 0x2FFF0 (+ data to 0x30000 for writes)
Write code to 0x20000 and exec
Poll RTC_GP(0) until state = 0xAA (done) or 0xEE (error)
Read data from 0x30000 (for reads)

A full init_boot_a dump (8 MB) takes about 2-3 minutes.

Critical Bugs Discovered During Development

Bug 1: Stack Pointer Corruption. FEL exec payloads must preserve the BROM's stack pointer. Overwriting it kills the FEL USB handler, requiring a full power cycle.

Bug 2: Bus Width Mismatch. The BROM's boot attempt leaves SMHC2 in 8-bit mode. Software reset does NOT clear the WIDTH register. Must explicitly write 0 to SMHC_WIDTH after every reset.

Bug 3: END_ERR After BROM Boot. The BROM's high-speed eMMC config causes spurious END_ERR on 400 kHz reads. The data is valid -- accept reads when DATA_OVER is set regardless of END_ERR.

Bug 4: PARTITION_CONFIG Wipe. Writing EXT_CSD[179] without preserving BOOT_PARTITION_ENABLE bits [5:3] permanently disables eMMC boot mode. Always use read-modify-write for non-volatile EXT_CSD fields.

FIFO Gotchas

Three undocumented SMHC2 FIFO behaviors:

FIFO_RESET clears ACCESS_BY_AHB: Setting GCTRL BIT(1) clears BIT(31) as a hardware side effect. Without BIT(31), FIFO reads return the same first word infinitely. Re-assert after every reset.
Stale FIFO between CMD17s: A second CMD17 times out if the FIFO is not reset between reads. Each sector drain must be followed by FIFO_RESET + ACCESS_BY_AHB.
BROM USB timeout (~3 seconds): Code via xfel exec must return quickly. This limits chunk sizes at 400 kHz / 1-bit to 128 sectors (reads) and 64 sectors (writes).

SyterKit-Informed Improvements

After discovering SyterKit (A523/T527 bare-metal reference), five improvements were applied:

Proper CCU reset dance (assert reset, deassert gate, wait, set gate, set reset)
Missing init registers: csdc, dbgc, thldc, samp_dl
D0 masking during clock changes (CLKCR BIT(31))
Hardware reset on command errors (full GCTRL reset instead of just clearing RINT)
12 MHz clock with graceful fallback (~30x speed improvement over 400 kHz)

Tools

Tool	File	Purpose
eMMC driver	`tools/fel-emmc.c`	Bare-metal eMMC read/write from SRAM via FEL
Orchestration	`tools/emmc-tool.sh`	Shell script for chunked eMMC operations
Bootloader unlock	`tools/unlock-bootloader.py`	Patch Allwinner Secure Storage for bootloader unlock
PMIC power-off	`tools/fel-pmic-poweroff.c`	Full cold shutdown via AXP717 I2C
I2C scanner	`tools/fel-i2c-scan.c`	Discover PMIC addresses on R_TWI bus
Register dump	`tools/fel-regdump.c`	DRAM controller/PHY register dump

Building

cd tools

# Option 1: Docker (no local toolchain needed)
make docker

# Option 2: Local ARM toolchain
make

# Option 3: Individual tool
make fel-emmc.bin

Third-Party Dependencies

Tool	Version	Source
xfel	1.3.5+ (git HEAD)	github.com/xboot/xfel
Magisk	28.1+	github.com/topjohnwu/Magisk

Optional: | sunxi-fel | 1.4.2+ | github.com/linux-sunxi/sunxi-tools |

Documentation

Document	Description
docs/secure-storage-format.md	Complete Allwinner Secure Storage binary format (original research)
docs/hardware-profile.md	KT1016 hardware specifications, DRAM parameters, thermal zones
docs/partition-map.md	GPT partition layout, boot area structure, eMMC layout
docs/failed-approaches.md	Five failed approaches and why they did not work

Compatibility

Confirmed Working

Jeazans KT1016 (863C_MB_V2.8, 863C_V28_C10_EEA_20240807)

Should Work As-Is

Any device with:

Allwinner A523 or T527 SoC
Accessible FEL mode (Vol Down + Power, or hardware FEL button)
eMMC storage (not NAND)

The FEL eMMC driver talks to SMHC2 at 0x04022000, the standard Allwinner eMMC controller address. The PIO/FIFO approach does not depend on device-specific parameters.

What Might Need Adjustment

Partition layout: Other devices may have different GPT offsets. Run emmc-tool.sh gpt first.
Boot area layout: TOC0 position (sector 16 vs 48) and related offsets may differ.
vbmeta behavior: The "flags=0x02 kills boot" behavior may be specific to this U-Boot build.

Known Compatible Boards (Unconfirmed)

These use the same 863C board design:

Pritom B8
Pritom M10
Teclast P85T (different firmware, may need different parameters)

Other A523/T527 devices with FEL access:

Avaota A1 (A523 dev board)
Radxa Cubie A5E (A523 dev board)
Various TV boxes using T527

FAQ

Q: Can I use this without a second device for reference? A: Yes. Make full backups before starting (init_boot_a, Secure Storage, env_a, full pre-GPT boot area). The FEL eMMC driver makes comprehensive backups straightforward. A second device is only needed if you need to recover from corruption without backups.

Q: Can this brick my device? A: The BROM (mask ROM) cannot be bricked. FEL mode is always available as a recovery path. The worst case is restoring the eMMC from backup via FEL. However, the eMMC driver can cause damage if you write to wrong sectors or corrupt non-volatile EXT_CSD fields, so always make backups first.

Q: Why not just use fastboot flashing unlock? A: It does not work on Allwinner devices. The bootloader ignores the standard Android unlock mechanism. Unlock state is stored in a proprietary Secure Storage area, not in the misc partition.

Q: Does root survive OTA updates? A: Unknown. Magisk patches init_boot, and the Secure Storage unlock persists across reboots. An OTA that replaces init_boot would remove root (re-patchable via FEL). An OTA that rewrites Secure Storage would re-lock the bootloader (re-unlockable via FEL).

Q: What about T527 devices? A: T527 is the same die as A523 with different marketing. The eMMC controller, SRAM layout, and FEL mode should be identical. The procedure should work, but partition layout and boot area offsets may differ.

Q: Can I use this to install a custom ROM? A: The FEL eMMC driver gives raw block-level access to the entire eMMC, including the super partition. You could flash any partition image. However, the signed boot chain (boot0, BL31, OP-TEE, U-Boot) cannot be modified, so you are limited to replacing Android partitions within the framework the stock bootloader supports.

References

linux-sunxi A523 wiki
SyterKit -- A523/T527 bare-metal reference
xfel -- FEL mode tool
ARM Trusted Firmware A523 branch
U-Boot A523 patches
CVE-2024-4610 advisory (ARM-SA-2024-006)

Contributing

If you have an A523 or T527 device and attempt this procedure, please:

Report your results -- success or failure, with device model and firmware version
Share partition maps -- run ./emmc-tool.sh gpt and share the output
Note any differences -- different TOC0 offsets, Secure Storage layouts, or vbmeta behavior
Submit fixes -- if you adapt the tools for a different A523/T527 device

The more devices confirmed compatible, the better the documentation becomes.

Acknowledgments

linux-sunxi community for decades of Allwinner reverse engineering
YuzukiHD (SyterKit) for the A523 SMHC reference driver
jernejsk for the ARM Trusted Firmware A523 branch
Andre Przywara (apritzel) for sunxi-fw and A523 U-Boot upstreaming
topjohnwu for Magisk
xboot project for xfel

Name		Name	Last commit message	Last commit date
Latest commit History 1 Commit
docs		docs
tools		tools
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md

Folders and files

Latest commit

History

Repository files navigation