Seriously how can I lock this thing down to keep it from sneaking updates? I was on a July Version Day 1.
Day 3 it Patched to an August Version.
Day 7 it's patched itself to 2022-09-05 Android 11 and I'm considering throwing it back to best buy lol.
Every time I have disabled automatic updates and it still sneaks this in. I'm thinking it's OTA updates.
I really need to cripple this phone before it takes me past the point of no return to mod it.
is your bootl;oader unlocked?
Yes, according to this. Am I misunderstanding this? Should it not be unlocked?
Also, here is where I am tonight. I started off being trapped with Android 11 2022-09-05.
Then I got DSU Sideloader from here.
Then I installed it.
Then I downloaded this on pc and dumped it into a folder on my phone.
Then I ran the installation with DSU Sideloader leaving Userdata and Image Size as default.
Now I am here. I think this is where I open ADB because I am not rooted yet and issue commands?
Actually I think thats exactly it. The next page even gives the complete copy paste based on my storage path.
Ok going to run this command now from adb on pc.
adb shell ' sh "/storage/emulated/0/Mod ****/DSU Application Storage Folder/workspace_dsuhelper/install" '
Phone is connected to usb c cable.
Dang it.
It cried about service not running but now it looks like its up. When I type adb devices I see my device just fine.
What have I done wrong?
The only method to disable automatic updates on oneplus phones is not allowing google play services to access internet.
If you use any google services, then practically there is no way to disable automatic ota updates.
Flash a custom rom if it exists or buy a new phone from a different manufacturer.
Hey man.. you require a lengthy response so I'm writing this as a prelude but as a sign of good things to come.. do you have telegram or any particular messaging service we could talk on so we can communicate quicker than just days in between at a time.
ScarletWizard said:
Run the adb commands from the platform I linked..
Did you unlock your bootloader using fastboot oem unlock?
Click to expand...
Click to collapse
I think all he has done is toggle the oem unlock in developer options.. from wha the's described, he hasn't made it to that point.. or maybe he has? but i don't think he has so i'm glad you mentioned that, actually.
Yeah all I have done is toggle the oem unlock in developer options. I've done similar things like this but on older phones and android versions. (Android 8.1 and before) And a little bit of Android 9 but that was one a Note 9 and Samsung always makes everything more annoying these days so it was mixed success.
DrScrad said:
Hey man.. you require a lengthy response so I'm writing this as a prelude but as a sign of good things to come.. do you have telegram or any particular messaging service we could talk on so we can communicate quicker than just days in between at a time.
Click to expand...
Click to collapse
I just got setup on telegram after reading this and speaking with ScarletWizard. My telegram is https://t.me/JonathanDeath or @jonathandeath
ScarletWizard said:
Run the adb commands from the platform I linked..
Did you unlock your bootloader using fastboot oem unlock?
Click to expand...
Click to collapse
Just did this.
Also I came across this but I don't know what you all think about it.
unofficial twrp 3.7.0 Root OnePlus Nord N20 5G - unofficial twrp
Dwnload unofficial twrp 3.7.0 root OnePlus Nord N20 5G, user who own OnePlus Nord N20 5G can root it by following below instructions
unofficialtwrp.com
Related
Hi all!
Today my Oppo Reno 5G 10x Zoom arrived. As my previous phones I would like to root my new phone too to use e.g. Titanium Backup.
I have currently installed Color OS V7.1, Android 10, Model CPH1921, Build CPH1921EX_11_C.35.
I did the following:
Enable the Developer Options on your device. To do this, go to Settings>>About Phone>>tap on the Build Number 7 times till you see a toast message “You are now a developer”.
Under the Developer Options, you need to enable the OEM Unlock option as well. To do that again head to the Settings>>Developer Options>>enable OEM Unlock.
Download and set-up the ADB and Fastboot tools on our PC.
Now, head to the Platform-tools folder and open the CMD or command prompt.
Now, in the command prompt, enter the below command and press the Enter button on your keyboard;
adb devices
You will get a pop-up on your smartphone with a message “Always allow from this computer”. You need to press OK
Type the below command to enter the bootloader mode, and press Enter;
adb reboot bootloader
After rebooting the fastboot window (this window) appears for about 1s an the phone immediatelly reboots.
So I am unable to finnish the steps from this guide.
What am I doing wrong or what is the problem causing this?
Thanks for any help in advance!
Try to see if your device supports bootloader unlock.
You'll need an app (deep testing) to apply for permission before you can unlock it.
I'm also looking for a way to unlock my bootloader... Same model cph1921. Mine unfortunately says it's a carrier phone so I can't go ahead with the unlock. I'll tinker around to change region and unlock if that be possible.
Let me know how you get along @htcdesire-hd
Hnk1 said:
Try to see if your device supports bootloader unlock.
You'll need an app (deep testing) to apply for permission before you can unlock it.
I'm also looking for a way to unlock my bootloader... Same model cph1921. Mine unfortunately says it's a carrier phone so I can't go ahead with the unlock. I'll tinker around to change region and unlock if that be possible.
Let me know how you get along @htcdesire-hd
Click to expand...
Click to collapse
Hi,
thanks for the suggestion with this app, that might be useful for me in the future!
That the Oppo Reno was not unlockable (or at least I did not find a way) was a dealbreaker for me! So I sent it back to the retailer a few days after writing the post above.
That means I am not able to test the app you suggested with the Oppo Reno 5G anymore.
Now I have a Xiaomi Poco F2 Pro 256GB and I am very happy with my device. Unlocking and rooting was even supported by the manufacturer (after 1 week mandatory waiting time) and the Hardware is also very good. So I am glad I sent back the Oppo Reno...
htcdesire-hd said:
Hi,
thanks for the suggestion with this app, that might be useful for me in the future!
That the Oppo Reno was not unlockable (or at least I did not find a way) was a dealbreaker for me! So I sent it back to the retailer a few days after writing the post above.
That means I am not able to test the app you suggested with the Oppo Reno 5G anymore.
Now I have a Xiaomi Poco F2 Pro 256GB and I am very happy with my device. Unlocking and rooting was even supported by the manufacturer (after 1 week mandatory waiting time) and the Hardware is also very good. So I am glad I sent back the Oppo Reno...
Click to expand...
Click to collapse
I hadn't have an oppo before so was unaware they are so strict with the bootloader. I ordered a OnePlus as well but still have the oppo. I'll try sometime and let you know.
For me, not having ad free experience and unable to change dpi is a deal breaker
Hnk1 said:
I hadn't have an oppo before so was unaware they are so strict with the bootloader. I ordered a OnePlus as well but still have the oppo. I'll try sometime and let you know.
For me, not having ad free experience and unable to change dpi is a deal breaker
Click to expand...
Click to collapse
Yes same for me, I also thought that Oppo is not that restricted! Ok, thanks, I will look forward to that.
Everyone has their own preferences. For me the adds in the system apps are barely annoying and I don't have any reason to change my DPI (battery performance is enough at my point of view). At most not having a 10x zoom is a little bit annoying but there are versions of my phone which have a 10x zoom instead of a macro camera.
I wonder if it would be possible to install the "update" with the modified Magisk boot.img to gain root access. Unpacking boot.img is hassle-free, but despite the "codecs" for 7zip, I can't repack the archive with the modified file. There is also the issue of bricking the oppo .. Has anyone tried something? Any other ideas?
Did anyone come to a solution for this , its such a great phone
Hello everyone,
I recently got the Realme 7 5G and I'm looking for a way to root or unlock the bootloader. I've tried the post here:
https://forum.xda-developers.com/t/realme-7-5g-eu-version-guide-for-unlock-bootloader.4272495/
But it doesn't work now.
Phone info:
Realme 7 5g
Realme UI 2.0
Android 11
800U 8GB ram
Model: RMX2111
AUSTRALIAN VARIANT
If there is a way please let me know, im sure tons of people will appreciate it aswell!
Maybe if you would tell us what you mean by "it doesn't work" we can be more helpful.
How far did you get in the process? What error messages do you get?
pochutkova.smotana said:
Maybe if you would tell us what you mean by "it doesn't work" we can be more helpful.
How far did you get in the process? What error messages do you get?
Click to expand...
Click to collapse
I was doing the steps to get the unlocker working, changing mac, running the oppo tool and i tried to change the region but the code just didnt work
. Also is it impossible to get fastboot on the realme 7 5g? I tried 'adb reboot bootloader' and it just didnt work.
andyboi123 said:
I was doing the steps to get the unlocker working, changing mac, running the oppo tool and i tried to change the region but the code just didnt work
. Also is it impossible to get fastboot on the realme 7 5g? I tried 'adb reboot bootloader' and it just didnt work.
Click to expand...
Click to collapse
How old is the guide? Pretty sure I read somewhere that OPPO did some patching that stopped a certain tool from working.
OrthodoxOxygen said:
How old is the guide? Pretty sure I read somewhere that OPPO did some patching that stopped a certain tool from working.
Click to expand...
Click to collapse
I guess they did, I just don't get why realme restricts the unlock tool to india.
andyboi123 said:
I guess they did, I just don't get why realme restricts the unlock tool to india.
Click to expand...
Click to collapse
There is a way around it. I'm a bit busy at the moment, but I'll try and scrape around my history tomorrow to try and find what I'm talking about. Feel free to do some digging of your own, of course. No guarantees that it'll fix the issue, however, so be wary of that.
`
OrthodoxOxygen said:
There is a way around it. I'm a bit busy at the moment, but I'll try and scrape around my history tomorrow to try and find what I'm talking about. Feel free to do some digging of your own, of course. No guarantees that it'll fix the issue, however, so be wary of that.
Click to expand...
Click to collapse
If you do have a method, this will undoubtedly help a lot of people (including me)!
I did it few weeks ago on Android 10 Realme 7 5G and it worked smoothly.
After I got the OK in the right window of Sec5 tool the code worked for me. If I wanted to run the code again though, I had to use Sec5 again.
Maybe retry the Sec5? Are you running Android 10 or 11 on your Realme?
'adb reboot bootloader' doesn't work, the idea of the whole process is to be able to boot into the bootloader (which is enabled by "in-depth testing app") where you can unlock the bootloader and subsequently boot into bootloader any time you want to.
pochutkova.smotana said:
I did it few weeks ago on Android 10 Realme 7 5G and it worked smoothly.
After I got the OK in the right window of Sec5 tool the code worked for me. If I wanted to run the code again though, I had to use Sec5 again.
Maybe retry the Sec5? Are you running Android 10 or 11 on your Realme?
'adb reboot bootloader' doesn't work, the idea of the whole process is to be able to boot into the bootloader (which is enabled by "in-depth testing app") where you can unlock the bootloader and subsequently boot into bootloader any time you want to.
Click to expand...
Click to collapse
Oh, I'm running Realme UI 2.0 (Android 11). Maybe they patched it in the update?
Also, I've run Sec5 multiple times, it says 'ok' and when I put the code in, it just won't do it. Really frustrating how realme locked the in-depth test to India phones only.
Hello group I interested in rooting my Oneplus n 10. Now I've been doing research for the past week and a half but it's very confusing. First off my oem is greyed out in developers my mode, and second I don't own a computer. I did DL LADB app but for some reason I can't find the code to do so. Can someone give me a guide or a easy way to do so? Thanks I appreciate it.
Hoosier-daddy? said:
Hello group I interested in rooting my Oneplus n 10. Now I've been doing research for the past week and a half but it's very confusing. First off my oem is greyed out in developers my mode, and second I don't own a computer. I did DL LADB app but for some reason I can't find the code to do so. Can someone give me a guide or a easy way to do so? Thanks I appreciate it.
Click to expand...
Click to collapse
Need PC
What @VovaHouse said... I know of no way without a PC.
If you have the global model (e.g. carrier indifferent) the phone still needs to connect to the Google Spyware server once before the OEM switch is ungreyed out. There is another thread where it is claimed this can be bypassed, but it was never worth it for me to do.
If you have a carrier model, you need to get it unlocked, which, like the rooting, requires a PC AFAIK. Maybe buy a cheap used one or something? Once you are freed, it is no longer required.
Just a quick heads-up.
unlock token - OnePlus (United States)
www.oneplus.com
By the way, to root without readily available stock firmware, first unlock bootloader, then boot a pre-rooted GSI with DSU Sideloader, pull stock boot partition from there, and finally patch/flash it. This applies to the Open variant as well.
AndyYan said:
Just a quick heads-up.
unlock token - OnePlus (United States)
www.oneplus.com
By the way, to root without readily available stock firmware, first unlock bootloader, then boot a pre-rooted GSI with DSU Sideloader, pull stock boot partition from there, and finally patch/flash it. This applies to the Open variant as well.
Click to expand...
Click to collapse
Tried to unlock but apparentpy my device only has 7 digits in the serial number which keeps me from being able to use the website to request the unlock code.
I used the debloat script I found on n200 threads to get oem unlock on option. T-Mobile variant
PsYk0n4uT said:
Tried to unlock but apparentpy my device only has 7 digits in the serial number which keeps me from being able to use the website to request the unlock code.
I used the debloat script I found on n200 threads to get oem unlock on option. T-Mobile variant
Click to expand...
Click to collapse
Try prepending 0s?
Well. I was thinking that doing that would make the unlock token they give me different from what the phone would be expecting
PsYk0n4uT said:
Well. I was thinking that doing that would make the unlock token they give me different from what the phone would be expecting
Click to expand...
Click to collapse
Tried adding zero on front and back of serial it just tells me invalid serial
PsYk0n4uT said:
Tried adding zero on front and back of serial it just tells me invalid serial
Click to expand...
Click to collapse
Chatting with OnePlus hasn't yielded anything so far
Just a tip, because in my infinite forgetfulness I wasted an hour last night trying to figure out why I was getting the error, fastboot could not open target HAL.
Remember that you must request the unlock code from fastboot, not fastbootd. Which is what you will boot into if you issue adb reboot fastboot.
So here's a quick step by step.
1.Enable usb debugging. 2. Connect your device and allow access for the computer. My device asks if I want it to charge or transfer files. Select transfer files/Android auto and then use adb start-server. May have to unplug the USB cable and reconnect. Select "always allow this device/PC".
3. Issue "adb devices" to make sure your connected.it should list your device by it's serial number. If not then try unplugging the device and revoke adb authorizations in dev options and toggle USB debugging off and back on, may even need to reboot the device to get it to connect after doing this.
4. If your device is listed under devices go ahead and issue "adb reboot fastboot"
5. Once rebooted issue "fastboot devices" and make sure the device is listed again.(If not listed make sure you have your driver's installed correctly and fastboot is installed correctly, may need to install Android SDK into same folder as fastboot)
6.You can select English or whatever language if you want but it doesn't seem necessary.You are in fastbootd mode you will see if you DO select a language.
So from here issue"fastboot reboot bootloader" device will reboot and you will have scrollable option at the top beginning with a big green START at the top. This is regular fastboot And where you wanna be to get your unlock code for submitting to Oppo for your unlock token.
7. Issue "fastboot oem get_unlock_code"
8. It should return the info you need, you will also need your IMEI number when submitting so be sure to copy that down.
you can copy and paste the unlock code into notepad or Word and delete out the extra stuff so your left with just the two lines of your unlock code as one single contiguous string of numbers.
8. Go to the link listed by OP and submit the required info. And wait for what seems like forever.
ADB/Fastboot commands-quick recap.
1. adb reboot fastboot
2. fastboot reboot bootloader
3. fastboot oem get_unlock_code
PsYk0n4uT said:
ADB/Fastboot commands-quick recap.
1. adb reboot fastboot
2. fastboot reboot bootloader
3. fastboot oem get_unlock_code
Click to expand...
Click to collapse
Simply "adb reboot bootloader". You won't need fastbootd until GSIs (which I already did ofc).
Thanks, definitely a quicker way to get to fastboot. I guess I wasn't sure if you could reboot directly. Seems maybe I was confusing an older device where you had to reboot to fastboot then "fastboot reboot fastboot" to get to fastbootd for a whole different reason.
This one goes directly to fastbootd when you "adb reboot fastboot"
Nice catch.
with this particular model in scope, what do either of you guys suggest I do if I have gottne the age old bricked message "destroyed boot/recovery image"".. I've tried the MSMTool route and cna't get it to register under Device Manager with the Qualcomm drivers.. It's highly upsetting..
I'm not really sure to be honest, this is my first OnePlus device and just trying to contribute anything I can to get the N20 section up and going as I make progress with the device.
Just a quick search though turns up this and maybe it could be of use if you can still access the bootloader.
the current image(boot/recovery) have been destroyed
I updated my oneplus 8t to KB2005_11.C.11 (OOS 12 ) by first booting to twrp-3.6.1_11-0-kebab.img and then flashed the KB2005_11_C_OTA_1100_all_362b9b_10100001.zip. After the upgrade I had no mobile data on t-mobile and had Volte instead of 5g...
forum.xda-developers.com
Someone mentions extracting the boot.img from stock image and flashing it. I would imagine it should work for you if the stock firmware can be found and circumstances are similar. Maybe at least a start. Wish I could be of more help, maybe someone else can chime in that knows more.
Try Linux, maybe a live dist. if your on a windows machine that won't recognize it just to get it into a state that you can work with it again.
Just an idea, I don't want to steer you wrong as i still have a lot to learn
DrScrad said:
with this particular model in scope, what do either of you guys suggest I do if I have gottne the age old bricked message "destroyed boot/recovery image"".. I've tried the MSMTool route and cna't get it to register under Device Manager with the Qualcomm drivers.. It's highly upsettinghav
Click to expand...
Click to collapse
DrScrad said:
with this particular model in scope, what do either of you guys suggest I do if I have gottne the age old bricked message "destroyed boot/recovery image"".. I've tried the MSMTool route and cna't get it to register under Device Manager with the Qualcomm drivers.. It's highly upsetting..
Click to expand...
Click to collapse
I want to try and help but I'm so new it's sketchy I don't want to say something and get bashed
Please feel free to comment. Don't worry about the trolls. We would love to have you to be part of this conversation. If you have suggestions just post them, and if your unsure about anything just mention that you are. It's a great way to learn. Don't worry about negative feedback, take it as constructive criticism. You may find that the feedback can clear up many questions and/or misconceptions. You never know how your dialogue with other members could help someone else in the future. These forums are here to document all of it just for that purpose. We are all here to learn or help others who want to learn. Though this account is only a year old I have been around these forums on and off for many years and I learn something each and every time I come in search of wisdom. I'm by no means an expert but I find that others benefit from my questions and answer just as much as I have over the years.
Fyi according to a recently made friend who also had the 7 digit serial issue, they were told by OnePlus their dev team is working on an OTA update that will resolve the serial number issues. I'm not sure how that's going to work but I saw the email between them and Oppo support
I guess this must be a widespread issue that they feel is cheaper to invest the amount of money it takes for r&d to come up with a fix than it was to replace a few devices or attempt to do remote repairs.
But this also makes me wonder what avenue they will take to correct the issue.
Also I wonder if someone with the right skillset could gather enough bootloader unlock codes along with the unlock tokens, serial, IMEI, pcba etc.. maybe the algorithm their using to generate the codes could be broken. I'm no crypto expert or math genius either, but if we have the variables to the equation minus one but have the answer, isn't this pretty simple almost pre-algebra?
I mean I guess their not worried about enough people being brave enough to give out sensitive info like that. But maybe Im just ignorant of the complexity of these algorithms.
64 digit key on one end
T-Mobile bought sprint and they have T-Mobile sims no. But I understand that sprint is still a somewhat seperate company (tried to buy a T-Mobile phone and it would not activate on my sprint account. So I bought this from the sprint side of the T-Mobile site so I knew it would work but I assume this is a sprint phone and not a T-Mobile phone so this method would not work.
Can anyone confirm this?
PsYk0n4uT said:
Please feel free to comment. Don't worry about the trolls. We would love to have you to be part of this conversation. If you have suggestions just post them, and if your unsure about anything just mention that you are. It's a great way to learn. Don't worry about negative feedback, take it as constructive criticism. You may find that the feedback can clear up many questions and/or misconceptions. You never know how your dialogue with other members could help someone else in the future. These forums are here to document all of it just for that purpose. We are all here to learn or help others who want to learn. Though this account is only a year old I have been around these forums on and off for many years and I learn something each and every time I come in search of wisdom. I'm by no means an expert but I find that others benefit from my questions and answer just as much as I have over the years.
Click to expand...
Click to collapse
okay peep theres a way i put my oneplus into efu mode, hold both vol up and down then put usb c in continue to hold u should hear PC recognize it
So, before i do it, would deleting the modemst1/modemst2 partitions still let me bypass the t-mobile sim lock and let me unlock the phone like it did on the old oneplus phones?
Flashed a patched boot.img and lost modems. Anyone willing to post the modems? Are they device specific like a device partition?
Sim locked and trying to recover. No radios are working
Hello Fellows,
I've got a Redmi 9 Pro for Linux purposes, but the phone came with FRP triggered and of course, I couldn't get access to the sellers
account. I spare you the details, because I am sure, every one knows a story like that.
I checked xda and the web about guides for quite some time, and actually found a lot of them, but none of them worked. At the end I could combine
some of these guides to actually make it happened. I've created a little screen recording to show all the steps that worked for my device.
Yes you can actually install and open almost every apk even with a triggered FRP. Almost means, you can even enable the developer options, but
they don't show anything for that user.
Initial situation:
Xiaomi Redmi 9 Pro EEA (joyeuse)
Bootloader Locked
triggered FRP Lock
find my device - OFF
No MI-Account
Software Variant 1:
Firmware: MIUI V12.0.2.0.QJZEUXM Stable Official Update for Redmi Note 9 Pro EEA (joyeuse)
Android 10 - Miui 12
Android Security Patch Date: 2021-01-21
Software Variant 2:
Firmware: MIUI V12.5.8.0.RJZEUXM Stable Official Update for Redmi Note 9 Pro EEA (joyeuse)
Android 11 - Miui 12.5
Android Security Patch Date: 2022-03-01
FRP Bypass start conditions:
Wifi is connected
The basic idea and steps:
Get into System Settings via the Help & Feedback from Gmail to disable and stop certain apps.
Only for this is the wifi needed, if you type delete, the right help topic will show up
2x Android Setup
Carrier Dafault App
Google Play Services (must be disabled at the very last)
enable the Accessibility Suite to re-enable Google Play Services at the right moment
Continue the actually process to setup the phone, the procedure will stuck at "Just a sec..." "Checking for updates..."
now try to re-enable the Google Play Services, once this is done, the FRP Bypass will take place the next step
One important note, after enabling Google Play Services, its Storage and Cache must be deleted!
This is one of the main reasons why it didn't worked for me the first 100 times i tried.
It does go through though, but right at the moment the setup is finished, the FRP Lock gets triggered and
we are back at the beginning.
Enabling the Google Play Services can be annoying, because the screen is flashing/changing so fast, that the touch
will not be accepted right away. But there is plenty of time to try until it hits.
Finish the setup process until you see the home screen
Execute the factory reset over the settings menu and the FRP is gone for good
Optional, you can enable oem unlock before you factory reset the phone
With oem unlock enabled, the phone can't get FRP Lock on.
Spoiler: FRP Bypass and Reset Android 10 - Miui 12
Spoiler: FRP Bypass and Reset Android 11 - Miui 12.5
Regarding Bootloader Unlock, which es mandatory to install Linux (Ubuntu Touch) on this phone.
I couldn't found any free way to either unlock the bootloader without Mi-Account, or reboot the phone into EDL.
They are some Apps I tried so far:
Xiaomi Sideload Tool and ROM2box from Romprovider.com
But they need MIUI Recovery 5.0, and I only have MIUI Recovery 3.0
And don't want to upgrade, because Ubuntu Touch need Android 10
Does anybody have more information about that exploit these Sideload Apps are using?
I don't get how you can read data from and adb sideload connection, where you just can upload zip files
for updates
EDL from the famous Bjoern Kerler "bkerler" (MTK-Client)
For this tool the phone must be in EDL Mode, which I can't get into it
Does anybody know a way how to do that without Test Point? I tried so many ways, but none worked.
I even compiled fastboot and adb from AOSP, but the "old" ways like reboot-edl don't work.
My last hope is a USB-C V2 Cable/Dongle from Team Hydra.
Updates will follow...
[Update 1: 2023-04-25]
The FRP Bypass Procedure also works on Android 11 MIUI 12.5
[Update 2: 2023-04-25]
I've built the EDL Cable/Dongle, but it didn't work. I've bought the official
Hydra EDL Cable V2, exact same result, it also didn't work. Hydra refuses to give me a straight answer to this issue, even as a customer. The shop I've bought it
from, asked Hydra as well, with the feedback, this could be a SPD issue.
But still, they refuse to tell me, which SPD I need to get it working. At this
time I was on SPD 2021-01-21, and they published the EDL Cable Pinouts in Dec. 2022 [Latest Security]. So this was a very false promise from Hydra or rather mobilerdx, not sure who's to blame here, perhaps myself.
[Update 3: 2023-04-25]
I've wrote an ADB and Fastboot Sniffer for Windows. Which worked
pretty well, and I was able to get the ADB commands from the Xiaomi Sideload Tool. So the Exploit is basically, that you can perform ADB PULL and ADB PUSH while your in SIDELOAD Mode, that's it. And that it uses a built-in command to gather the partition structure while you are in the
normal ADB Mode.
With that knowledge now, I've also wrote a Bash pendant from the Xiaomi Sideload Tool -> Xiaomi SideLoad Terminal Tool (xsltt). Which inherits all its functions plus a bit more user comfort.
With this tool, I was able to delete my xloader, and the device now boots
straight into EDL Mode. Which is great, you can call this a Software Testpoint.
But, there is always a but, it seems that there is still no proper firehose file out there, that bypasses this annoying EDL authentication. And no, I will not even try to bypass that myself, this is way over my head.
So I would very much appriciate it, if someone can point me to a working firehose file that bypasses the EDL authentication for the Redmi Note 9 Pro (joyeuse).
I am facing the same problem, can not find the right firehose tool.
And all the apps that claim they have proper firehose file are all paid service.
since you have hydra tool, did they work for the edl? since they said they have the right firehose file.
ccaye said:
I am facing the same problem, can not find the right firehose tool.
And all the apps that claim they have proper firehose file are all paid service.
since you have hydra tool, did they work for the edl? since they said they have the right firehose file.
Click to expand...
Click to collapse
Haha, no they don't. They even recommended me the hydra dongle in their own telegram support channel. Now i have this dongle since a day, they say it is not supported in EDL Mode, only Sideload mode. And now i have to find someone who can fix the phone remotely with a auth service account. Isn't it great?
I'
newbit said:
Hello Fellows,
I've got a Redmi 9 Pro for Linux purposes, but the phone came with FRP triggered and of course, I couldn't get access to the sellers
account. I spare you the details, because I am sure, every one knows a story like that.
I checked xda and the web about guides for quite some time, and actually found a lot of them, but none of them worked. At the end I could combine
some of these guides to actually make it happened. I've created a little screen recording to show all the steps that worked for my device.
Yes you can actually install and open almost every apk even with a triggered FRP. Almost means, you can even enable the developer options, but
they don't show anything for that user.
Initial situation:
Xiaomi Redmi 9 Pro EEA (joyeuse)
Bootloader Locked
triggered FRP Lock
find my device - OFF
No MI-Account
Software Variant 1:
Firmware: MIUI V12.0.2.0.QJZEUXM Stable Official Update for Redmi Note 9 Pro EEA (joyeuse)
Android 10 - Miui 12
Android Security Patch Date: 2021-01-21
Software Variant 2:
Firmware: MIUI V12.5.8.0.RJZEUXM Stable Official Update for Redmi Note 9 Pro EEA (joyeuse)
Android 11 - Miui 12.5
Android Security Patch Date: 2022-03-01
FRP Bypass start conditions:
Wifi is connected
The basic idea and steps:
Get into System Settings via the Help & Feedback from Gmail to disable and stop certain apps.
Only for this is the wifi needed, if you type delete, the right help topic will show up
2x Android Setup
Carrier Dafault App
Google Play Services (must be disabled at the very last)
enable the Accessibility Suite to re-enable Google Play Services at the right moment
Continue the actually process to setup the phone, the procedure will stuck at "Just a sec..." "Checking for updates..."
now try to re-enable the Google Play Services, once this is done, the FRP Bypass will take place the next step
One important note, after enabling Google Play Services, its Storage and Cache must be deleted!
This is one of the main reasons why it didn't worked for me the first 100 times i tried.
It does go through though, but right at the moment the setup is finished, the FRP Lock gets triggered and
we are back at the beginning.
Enabling the Google Play Services can be annoying, because the screen is flashing/changing so fast, that the touch
will not be accepted right away. But there is plenty of time to try until it hits.
Finish the setup process until you see the home screen
Execute the factory reset over the settings menu and the FRP is gone for good
Optional, you can enable oem unlock before you factory reset the phone
With oem unlock enabled, the phone can't get FRP Lock on.
Spoiler: FRP Bypass and Reset Android 10 - Miui 12
Spoiler: FRP Bypass and Reset Android 11 - Miui 12.5
Regarding Bootloader Unlock, which es mandatory to install Linux (Ubuntu Touch) on this phone.
I couldn't found any free way to either unlock the bootloader without Mi-Account, or reboot the phone into EDL.
They are some Apps I tried so far:
Xiaomi Sideload Tool and ROM2box from Romprovider.com
But they need MIUI Recovery 5.0, and I only have MIUI Recovery 3.0
And don't want to upgrade, because Ubuntu Touch need Android 10
Does anybody have more information about that exploit these Sideload Apps are using?
I don't get how you can read data from and adb sideload connection, where you just can upload zip files
for updates
EDL from the famous Bjoern Kerler "bkerler" (MTK-Client)
For this tool the phone must be in EDL Mode, which I can't get into it
Does anybody know a way how to do that without Test Point? I tried so many ways, but none worked.
I even compiled fastboot and adb from AOSP, but the "old" ways like reboot-edl don't work.
My last hope is a USB-C V2 Cable/Dongle from Team Hydra.
Updates will follow...
[Update 1: 2023-04-25]
The FRP Bypass Procedure also works on Android 11 MIUI 12.5
[Update 2: 2023-04-25]
I've built the EDL Cable/Dongle, but it didn't work. I've bought the official
Hydra EDL Cable V2, exact same result, it also didn't work. Hydra refuses to give me a straight answer to this issue, even as a customer. The shop I've bought it
from, asked Hydra as well, with the feedback, this could be a SPD issue.
But still, they refuse to tell me, which SPD I need to get it working. At this
time I was on SPD 2021-01-21, and they published the EDL Cable Pinouts in Dec. 2022 [Latest Security]. So this was a very false promise from Hydra or rather mobilerdx, not sure who's to blame here, perhaps myself.
[Update 3: 2023-04-25]
I've wrote an ADB and Fastboot Sniffer for Windows. Which worked
pretty well, and I was able to get the ADB commands from the Xiaomi Sideload Tool. So the Exploit is basically, that you can perform ADB PULL and ADB PUSH while your in SIDELOAD Mode, that's it. And that it uses a built-in command to gather the partition structure while you are in the
normal ADB Mode.
With that knowledge now, I've also wrote a Bash pendant from the Xiaomi Sideload Tool -> Xiaomi SideLoad Terminal Tool (xsltt). Which inherits all its functions plus a bit more user comfort.
With this tool, I was able to delete my xloader, and the device now boots
straight into EDL Mode. Which is great, you can call this a Software Testpoint.
But, there is always a but, it seems that there is still no proper firehose file out there, that bypasses this annoying EDL authentication. And no, I will not even try to bypass that myself, this is way over my head.
So I would very much appriciate it, if someone can point me to a working firehose file that bypasses the EDL authentication for the Redmi Note 9 Pro (joyeuse).
Click to expand...
Click to collapse
I'm ready to fund for research cause. I will invest in the tool that I know which allows EDL authentication so that we can verify if it works with your device.
Please let me know so that together we can succed in fixing your phone.
mvikrant97 said:
I'
I'm ready to fund for research cause. I will invest in the tool that I know which allows EDL authentication so that we can verify if it works with your device.
Please let me know so that together we can succed in fixing your phone.
Click to expand...
Click to collapse
Thank you for your generous offer, I am not sure If I understand you right, plus I don't have the need
for charity. To be honest, I don't even have a clue, what to believe now. They all promise you honey
flowing in rivers, but can't really deliver.
They are tools called EMT and UAT Pro. Never heard about them before. But they claim they have
auth support for this model in EDL mode. UAT even offers a pure software solution for an affordable price.
If you are willing to fund your self, please try it out, and report back.
newbit said:
Thank you for your generous offer, I am not sure If I understand you right, plus I don't have the need
for charity. To be honest, I don't even have a clue, what to believe now. They all promise you honey
flowing in rivers, but can't really deliver.
They are tools called EMT and UAT Pro. Never heard about them before. But they claim they have
auth support for this model in EDL mode. UAT even offers a pure software solution for an affordable price.
If you are willing to fund your self, please try it out, and report back.
Click to expand...
Click to collapse
I won't be investing in those tools. Both EMT and UAT allow auth flashing however I know a tool called Xiaomi Pro tool which supports auth flashing and it works and the investment is pretty low so I can invest in that tool to help you out with auth flashing.
I cannot discuss any further as XDA does not allow that.
mvikrant97 said:
I won't be investing in those tools. Both EMT and UAT allow auth flashing however I know a tool called Xiaomi Pro tool which supports auth flashing and it works and the investment is pretty low so I can invest in that tool to help you out with auth flashing.
I cannot discuss any further as XDA does not allow that.
Click to expand...
Click to collapse
Yeah that's weird, I've read this a lot, never had any issues with XDA about that.
Anyways, I can't find any manufacture website to the Xiaomi Pro Tool, so I cannot compare.
I think 15 bucks for are 3 Months time period is much cheaper compared to the 110 I've paid
for this Hydra Dongle, which brings me zero yet. So please, write me a PM with a link to a shop.
Just a little Update.
Thank your @mvikrant97, Xiaomi Fire Tool did the trick. They don't unlock bootloader,
but flash firmware with EDL auth. And now my phone is back to life. Support was very good, in fact,
they were the only ones who responded at all. Very patience and polite as well. Plus, very affordable.
Once my phone is fully charged, battery was totally drained since it was in EDL Mode for weeks, I will see
what Hydra has to offer. Btw: They've banned me from their Support Channel, without any explanation.
I guess I asked the wrong questions, pitty.
newbit said:
Just a little Update.
Thank your @mvikrant97, Xiaomi Fire Tool did the trick. They don't unlock bootloader,
but flash firmware with EDL auth. And now my phone is back to life. Support was very good, in fact,
they were the only ones who responded at all. Very patience and polite as well. Plus, very affordable.
Once my phone is fully charged, battery was totally drained since it was in EDL Mode for weeks, I will see
what Hydra has to offer. Btw: They've banned me from their Support Channel, without any explanation.
I guess I asked the wrong questions, pitty.
Click to expand...
Click to collapse
I'm very happy to learn that your phone is fixed.
While the rest we can discuss in PM!