Unlock boot.img - Pre-root device & add MTP service



Mar 4, 2015
Scope of this thread

Most of the users try to user root software like Kingo Root/iroot/vroot etc. but theese software sometimes install a custom permission manager (that can create conflict with SuperSU) and install also malicious software inside the system.

My personal suggestion if you have a boot.img file of your ROM try to unlock it


- A PC with Windows operating system

- boot.img file of your ROM (ROM in falshtool format)

- Carliv image Kitchen (download - http://forum.xda-developers.com/android/development/tool-cika-carliv-image-kitchen-android-t3013658

- Text editor compatible with Unix text format (ex. Notepad++)

How to unlock boot.img

Step 1 - File preparation

- Download and decompress Carliv Image Kitchen

- Copy boot,img into [boot-resources] sub-folder where you decompressed Carliv Image Kitchen

Step 2 - Decompress boot.img

- Run Carliv Image Kitchen

- Select C (Clenup folder) to cleanup previous activities and confirm,

- Select B (boot) and select 1. for boot.img

Note: now you can now have two option based on boot.img structure/device age.

With the oldest device the typical choice is option 3 (unlock boot with Mediartek header).

With the newest device the typical choice is option 1 (unlock boot with standard Android header)..

Suggestion: try option 3 then if you see an error select option 1.

Step 3 - Modify default.prop

Open in [boot-resources]/[ramdisk] fodler the default.prop file
Check the lines


To pre-root the device change it in


Suggest to change




or add the rpevious line if is not included and add this line (if is not available)


Please check if in persist.sys.usb.config is used mtp. Ex. if the line is


change it into


In this way you enable MTP mode for this device (MTP mode is used iN Windows system to see the device under Explorer)

I suggest you to use always mtp.adb.

When you made all changes save default.prop.

Step 4- Recompress boot.img

If you select 3 to unpack the boot.img now select 4 to repack boot.img with default.prop modified

If you select 1 to unpack the boot.img now select 2 to repack boot.img with default.prop modified

The new boot image file will be saved in [output] folder of Carliv Image Kitchen. Rename it as boot.img

Step 5- Flash new boot.img

Reflash new boot.img using standard scatter and Flashtool in DOWNLOAD ONLY mode.

Now the device is pre-rooted.

Step 6 - Flash custpom recovery

If you have a custom recovery for it now flash with Flashtool in DOWNLOAD ONLY mode (using scatter file as for boot.img)

If you not have a custom recover and the device is based on MT6582/89/92 you can use MTKDroid to create CWM for it.

Step 7 - Flash SuperSU & busybox

One time that you flashed boot.img and custom recovery.img (you can flash both in the same time), you can install via recovery

- SuperSU v. 2.46

- Busybox 1.24.1 SELinux (for KK and up) or Busybox v.124.1 (for 4.3 and lower).

Now reboot, and you will have a device clean rooted and with fully busybox.

Last edited by a moderator:


New Member
May 3, 2018
epic guide! will try to make a custom boot.img so i can enable +rw on /system hopefully :-)
  • Like
Reactions: mrsim