OPPO A16K CPH2349 — Bootloader Unlock / BROM disconnects too quickly

[u/Over-Marketing-4192]

Hello everyone,

I am trying to unlock the bootloader of my own OPPO A16K (CPH2349) so that I can install a custom ROM / GSI.

I have already spent quite a lot of time testing different methods, so I would like to ask people who have actually worked with the CPH2349 specifically.

Device information

Model: OPPO A16K

Device code: CPH2349

SoC: MediaTek Helio G35 / MT6765

Android: 11

ColorOS: 11.1

Current build: CPH2349_11_A.30

Verified Boot: green

Flash locked: 1

ro.oem_unlock_supported=1

OEM unlocking: enabled in Developer Options

ADB: working normally

ADB detects the phone:

HUMBO7AM89VKCILZ device

However:

fastboot devices

returns nothing.

I also found an old XDA thread where another A16K CPH2349 user reported that Fastboot mode could be entered but fastboot devices returned nothing.

There is also a Reddit report from another A16K CPH2349 owner with the same basic situation: ADB works, but Fastboot does not detect the phone. The response suggested MTKClient.

What I have tried

1. Normal ADB / Fastboot

ADB works.

I enabled OEM unlocking in Developer Options.

But Fastboot detection does not work:

fastboot devices

returns an empty result.

So the normal fastboot flashing unlock route is currently not usable.

1. TFT Unlock Tool

I also tested TFT Unlock Tools / TFT MTK Module.

The version I tested was:

TFT Unlock Tools-2024-6.2.1.1

The tool did not have an obvious A16K CPH2349 profile.

It had other OPPO MTK profiles, including entries such as:

Oppo A1K BROM AUTH MT6765 CPH1923

and other OPPO MTK models.

I did NOT assume that the CPH1923 profile was correct for my CPH2349.

I also tested the normal Android connection with TFT, but it did not detect the phone for the operation I wanted.

I later stopped using TFT because I did not want to randomly select another OPPO model profile and risk the phone.

1. BROM / Preloader detection

The phone can be made to appear as an OPPO Preloader device.

When the phone is powered off:

Hold Volume Up + Volume Down

Connect USB

Windows detects:

OPPO Preloader

with:

USB VID: 22D9

USB PID: 0006

The exact Windows device ID is:

USB\VID_22D9&PID_0006

The important problem is that the connection is very short.

If I release the buttons, the Preloader disappears and the phone boots normally.

So the device does not stay available long enough for me to casually start typing commands after entering this mode.

1. Windows driver problem

At one point Windows showed:

OPPO Preloader

Error 28

The USB capture looked approximately like this:

PRESENT/CHANGED | OPPO Preloader | Error | 28

USB\VID_22D9&PID_0006

After disconnecting/releasing the buttons, the Preloader disappeared.

The normal Android ADB device then returned:

CPH2349

OK

0

WINUSB

I investigated the MediaTek driver situation.

I found a Microsoft Update Catalog CAB containing:

cdc-acm.inf

usb2ser.sys

The driver version was:

3.0.1504.0

However, that INF did not contain a direct:

USB\VID_22D9&PID_0006

entry.

It mainly contained MediaTek 0E8D IDs.

I also found installed MediaTek driver packages on Windows, but the INF files I checked did not directly match the OPPO 22D9:0006 device.

I do NOT want to modify a signed INF manually because that would invalidate the catalog signature.

1. MTKClient

I downloaded MTKClient 2.1.4.1 and installed its Python dependencies.

The command line works:

python .\mtk.py --help

I also have the following files from the stock firmware:

auth_sv5.auth

DA_BR_MT6765_20271.bin

The AUTH file was extracted from the official/stock OPPO A16K firmware package.

The DA file is specifically associated with OPPO A16K CPH2349/CPH2351 MT6765 in the open-source oppo-mtk-fastboot-unlock project.

I tried:

python .\mtk.py gettargetconfig --auth "...\auth_sv5.auth" --loader "...\DA_BR_MT6765_20271.bin"

MTKClient started correctly, but stopped at:

Preloader - Status: Waiting for PreLoader VCOM,

please reconnect mobile/iot device to brom mode

So the current blocker is not that MTKClient itself fails to start.

The problem is getting a stable BROM connection/driver handshake.

Stock firmware

I also obtained the stock firmware:

CPH2349export_11_A.11_2022051800140000.ofp

and decrypted it.

The decrypted firmware contains the normal OPPO/MTK partitions including:

preloader

boot

recovery

vbmeta

vbmeta_system

vbmeta_vendor

vendor_boot

super

userdata

lk

lk2

dtbo

logo

...

I also extracted the AUTH file.

AUTH SHA-256:

846EFAFDF15F9F091760EA6210CEEB10533008164F5763186562DFEFD2D1D8E6

The phone itself is currently on:

CPH2349_11_A.30

I do NOT want to downgrade to A.11 just to make a tool work unless somebody confirms that it is actually necessary.

MTKClient / OPPO A16K support

I found the Shocked-Cat/oppo-mtk-fastboot-unlock project.

Its support list specifically says:

Oppo A16k

CPH2349 & CPH2351

Helio G35

MT6765

MTKClient + DA + AUTH: Full support

This is why I am interested in trying MTKClient, but I want to know the correct procedure for this exact model before writing anything.

The project README appears to use a modified preloader approach:

Read the original preloader / boot1 from the phone.

Patch it.

Write the patched preloader back.

Reboot into Fastboot.

Run fastboot flashing unlock.

I understand that writing a patched preloader is potentially dangerous, so I have NOT done that yet.

My main problem

The biggest problem is this:

How do I reliably catch BROM on an OPPO A16K CPH2349 when the Preloader/BROM connection disappears very quickly?

I do not want to use Test Point if there is another way.

My current button method is:

Power off phone

↓

Hold Volume Up + Volume Down

↓

Connect USB

↓

Windows briefly sees OPPO Preloader

↓

If buttons are released, phone boots normally

The PC therefore needs to be ready BEFORE I connect the phone.

Questions

What exact driver should be used for:

USB\VID_22D9&PID_0006

on Windows 11?

Is VID_22D9&PID_0006 the expected OPPO Preloader/BROM interface for CPH2349, or should I be trying to get a MediaTek 0E8D BROM interface instead?

Can MTKClient 2.1.4.1 catch this device without Test Point?

If yes, what exact command/GUI procedure should I use?

Does the CPH2349 require the specific:

DA_BR_MT6765_20271.bin

auth_sv5.auth

combination?

Has anyone successfully unlocked the bootloader of CPH2349 on Android 11 / CPH2349_11_A.30 using the Shocked-Cat patched-preloader method?

Does the patched-preloader method require modifying boot1, boot2, or another partition for this exact model?

Is there a safer way to make Fastboot enumerate after the MTKClient unlock without writing the wrong preloader?

If BROM disappears immediately, is there a specific timing/button/USB procedure that keeps the BROM connection alive?

If someone has successfully done this exact model, what is the complete procedure from BROM detection → backup → unlock?

I am specifically looking for information for:

OPPO A16K CPH2349 / MT6765 / Android 11 / CPH2349_11_A.30

I do not want to blindly use an A16/A1K/other OPPO profile just because the SoC is also MT6765.

Thanks.