Do you want to earn 6,000 USD? .. -Help me Obtain my Data!!!

[SuperHopeful]

I'm reaching out for help with a serious issue on my Xiaomi Mi 11 Ultra (512 GB), purchased in December 2021. The phone came with the Xiaomi.eu ROM preinstalled and an unlocked bootloader. Below, I’ll detail the problem, what I’ve done, and where I’m stuck. Any advice would be greatly appreciated!

Background​

• Device: Xiaomi Mi 11 Ultra (512 GB), codename "star."
• ROM: Came with Xiaomi.eu ROM preinstalled.
• Purchase: December 2021.
• Modifications:
  • Installed Magisk to use root-required apps.
  • Added modules like EdXposed Manager, Riru, Shamiko, Zygisk, and others.
  • Used Magisk’s hide feature to bypass root detection.
• Issue Trigger: Three days ago, a banking app detected root, despite the hide setup working fine for years.

.

What Happened​

.
I opened the Magisk app (running version 24.x, unsure of the exact minor version) and noticed an option to update to Magisk v28. Here’s what I did, step by step:
.

1. Attempted Magisk v28 Update:
   • Clicked the "Install" button for Magisk v28 ~3-4 times, possibly installing it multiple times.
   • No visible changes or errors occurred.
     |
2. Uninstalled Magisk:
   • In the Magisk app, selected "Uninstall" for the current version (24.x).
   • The app confirmed uninstallation and prompted a reboot.
   • Result: Phone entered a bootloop, stuck on the Xiaomi logo with the Android logo and "android" text at the bottom.
     |
3. Recovery Mode Failure:
   • Tried booting into recovery with Power + Volume Up, but it returned to the bootloop (Xiaomi logo).
   • Researched and learned that the Mi 11 Ultra has no separate recovery partition; it’s part of the boot partition. Is that true?
     |
4. Fastboot Success:
   • Booted into Fastboot mode using Power + Volume Down.
     |
5. TWRP Boot:
   • Downloaded twrp-3.7.0_11-0-star.img from the TWRP website.
   • Booted TWRP temporarily using fastboot boot twrp-3.7.0_11-0-star.img.
   • In TWRP, entered my MIUI pattern lock, which decrypted the user 0 data (main user).
   • My PC (via USB) could access files like DCIM photos, PDFs, and app data.
   • Note: Could not decrypt user 999 (possibly related to MIUI’s "Dual Apps" or "xspace").
     |
6. TWRP Attempts to Fix Bootloop:
   • Ran Magisk uninstall.zip via TWRP → Still bootlooped.
   • Manually deleted the Shamiko module folder via TWRP’s file manager → Still bootlooped.
   • Reinstalled Magisk v24 via TWRP → Still bootlooped.
   • Uninstalled Magisk again (via uninstall.zip) and installed Magisk v24.1 → Still bootlooped.
   • Attempted to boot into recovery via TWRP → Bootlooped.
     |
7. Data Backup:
   • Used TWRP to decrypt user 0 and backed up DCIM photos to an external USB flash drive via PC (drag-and-drop).
     |
8. Locksettings Deletion:
   • Suspected the inability to decrypt user 999 was causing the bootloop.
   • Followed some random online guides and deleted:
     • /data/system/locksettings.db and
     • Either gatekeeper.password.key or gatekeeper.pattern.key (unsure which).
   • Rebooted into TWRP, and user 0 still was easily decrypted with my pattern, but user 999 remained inaccessible.
   • Conclusion: Deleting these files didn’t change much, as user 0 decryption still worked.
     |
9. ROM Investigation:
   • Found a bugreport-2022-02-08-181256.zip on the data drive, assuming it reflected my ROM.
   • Extracted info:
     Code:

   • Bootloader: unknown
     Build: RKQ1.201112.002 release-keys
     Build fingerprint: Xiaomi/star/star:11/RKQ1.201112.002/V12.5.20.0.RKACNXM:user/release-keys
     Bugreport format version: 2.0
     Command line:
     androidboot.baseband=msm
     androidboot.bootdevice=1d84000.ufshc
     androidboot.boot_devices=soc/1d84000.ufshc
     androidboot.camera.config=0
     androidboot.console=ttyMSM0
     androidboot.cpuid=0x6d0a2082
     androidboot.dtb_idx=0
     androidboot.dtbo_idx=22
     androidboot.force_normal_boot=1
     androidboot.fstab_suffix=default
     androidboot.hardware=qcom
     androidboot.hardware.sku=star
     androidboot.hwc=CN
     androidboot.hwlevel=MP
     androidboot.hwversion=2.9.1
     androidboot.keymaster=1
     androidboot.memcg=1
     androidboot.oled_panel_id=K2_0A_MP
     androidboot.oled_wp=01f60bb30c50
     androidboot.product.hardware.sku=star
     androidboot.ramdump=disable
     androidboot.secureboot=1
     androidboot.serialno=[A NUMBER THAT I HAVE CENSORED FOR XDA FORUMS]
     androidboot.slot_suffix=_a
     androidboot.ufsid=0x198
     androidboot.verifiedbootstate=green
     androidboot.verifiedbootstate=orange
     block2mtd.block2mtd=/dev/block/sda15,2097152
     bootinfo.pdreason=0x2
     bootinfo.pureason=0x40011
     buildvariant=user
     cgroup.memory=nokmem,nosocket
     console=ttyMSM0,115200n8
     hwid.build_adc=56999
     hwid.hwid_value=589825
     hwid.project=2
     hwid.project_adc=29261
     init=/init
     ip6table_raw.raw_before_defrag=1
     iptable_raw.raw_before_defrag=1
     kpti=off
     log_buf_len=256K
     loop.max_part=7
     lpm_levels.sleep_disabled=1
     mtdoops.dump_oops=0
     mtdoops.mtddev=0
     mtdoops.record_size=2097152
     msm_drm.dsi_display0=qcom,mdss_dsi_k2_38_08_0a_mp_dsc_cmd
     msm_drm.dsi_display1=qcom,mdss_dsi_k1_43_06_00_sec_cmd
     msm_drm.oled_wp=01f60bb30c50
     msm_rtb.filter=0x237
     pcie_ports=compat
     printk.always_kmsg_dump=1
     ramoops_memreserve=4M
     rcupdate.rcu_expedited=1
     rcu_nocbs=0-7
     ro
     rootwait
     service_locator.enable=1
     swiotlb=0
     video=vfb:640x400,bpp=32,memsize=3072000
     Dumpstate info:
     args=/system/bin/dumpstate -S -d -z bugreport_mode=
     dry_run=0
     id=1
     pid=25092
     dumpstate: 2022-02-08 18:12:56
     Kernel: Linux version 5.4.86-qgki-g35572e50a678 (builder@m1-xm-ota-bd046.bj.idc.xiaomi.com)
     (Android (6443078 based on r383902) clang version 11.0.1
     (https://android.googlesource.com/toolchain/llvm-project b397f81060ce6d701042b782172ed13bee898b79),
     LLD 11.0.1 (/buildbot/tmp/tmp6_m7QH b397f81060ce6d701042b782172ed13bee898b79))
     #1 SMP PREEMPT Wed Oct 27 03:18:25 CST 2021
     Module Metadata version: 301610203
     Network: [TWO CARRIER NAMES THAT I HAVE CENSORED FOR XDA FORUMS]
     Radio: 4.0-c7-13.1-1439.121019_0032_ccf31e4112,4.0-c7-13.1-1439.121019_0032_ccf31e4112
     Uptime: up 2 weeks, 2 days, 6 hours, 0 minutes

   • 
     |
   • After reading through this, I genuinely believed that seeing RKACNXM , must have meant, that my phone was running a Chinese ROM (LATER I would found out, that I was totally wrong; my phone was actually running Xiaomi.eu -ROM!!)
     |
10. I Flashed Chinese Boot Image:
    • Downloaded miui_STAR_V12.5.20.0.RKACNXM_942a5712ef_11.0.zip (Chinese ROM) from xiaomirom.com.
    • Extracted boot.img using Payload Dumper.
    • Flashed via CMD: fastboot flash boot boot.img (dirty flash, no data wipe).
    • Result: Phone booted into MIUI GUI!
      • No lockscreen (likely due to deleted locksettings files?). Perhaps just can't READ the user data at all?`Who knows!
      • My Wallpaper and App Icons were present, but Apps wouldn’t open (prompt: "Wait until your device is fully rebooted before opening apps").
        
        To understand this condition, see the first minute of this video:
        
        
      • Settings app worked.
      • Recovery mode would boot into a "Chinese-language TWRP 3.5.1_10-0." ( so Yeah, Chinese Letters!)
        |
11. Checked MIUI Version:
    • In Settings > About Phone, saw:
      MIUI by xiaomi.eu
      12.5.20 Stable
      12.5.20.0(RKACNXM)
    • This is when I realized the phone was running a Xiaomi.eu ROM, not Chinese.
      |
12. Flashed?Installed? Xiaomi.eu ROM:
    • Downloaded xiaomi.eu_multi_MI11Pro_MI11Ultra_V12.5.20.0.RKACNXM_v12-11.zip.
    • Booted into TWRP (fastboot boot twrp-3.7.0_11-0-star.img)`via CMD-commands.
    • Installed the ROM via TWRP’s Install ZIP-functionality (dirty install, no wipe).
    • Result: No change in behavior:
      • Apps still inaccessible (same "wait" prompt).
      • Booting into Recovery mode still boots to a Chinese-LANGUAGED TWRP 3.5.1_10-0. [which presumably means that my boot-image is not actually European?????]
      • Question: Was installing the EU ROM via TWRP’s ZIP function the correct? Did the Chinese boot.img cause issues?

|
|

Current State​

|​

• Boot-Up: Boots into MIUI GUI, but apps (except Settings) are inaccessible. Prompts an error when trying to open Apps. Prompts a DIFFERENT error when trying to launch "Dual Apps"-Apps; something related to "System launcher".
• Recovery "Partition": Boots into Chinese-LANGUAGE TWRP 3.5.1_10-0, not the expected Xiaomi.eu recovery or TWRP 3.7.0.
• Data: No data is available to view via TWRP File Manager; it all looks scrambled (encrypted).
  
  
• Goal #1: RESTORE ALL USER DATA (PHOTOS, PDF-FILES,. CONTACTS,. SMS, NOTES, ETC)
• Goal #2: Restore full functionality without losing data; or simply restore the data.

Questions​

|​

1. Did I use the wrong method to install the Xiaomi.eu ROM via TWRP’s ZIP function?
   |
2. Is the Chinese-Languaged TWRP 3.5.1_10-0 in recovery a sign that the EU ROM didn’t install correctly?
   |
3. Could the Chinese boot.img be causing the "Apps" & "pesonal-data" access issue?
   |
4. How can I fix the user 0 decryption issue?
   |
5. What’s the best way to restore my phone to a working Xiaomi.eu ROM without wiping data?

|

What I’ve Done (Summary)​

1. Updated Magisk to v28 multiple times.
2. Uninstalled Magisk v24.x, leading to a bootloop.
3. Booted TWRP (twrp-3.7.0_11-0-star.img) via fastboot.
4. Attempted Magisk uninstall/reinstall (v24, v24.1) via TWRP.
5. Deleted Shamiko module manually.
6. Backed up DCIM photos to USB.
7. Deleted /data/system/locksettings.db and a gatekeeper key.
8. Flashed Chinese ROM’s boot.img via fastboot.
9. Installed Xiaomi.eu ROM (xiaomi.eu_multi_MI11Pro_MI11Ultra_V12.5.20.0.RKACNXM_v12-11.zip) via TWRP.

|
I’m at a loss here. I need to recover my data, for an importan upcoming COURT CASE!.
|
Any guidance on next steps or mistakes I made would be a lifesaver!
|
Thanks,


Btw. I am willing to pay or donate at least 6,000 USD to anyone who can successfully lead me to a recovery of my data!
There is around 10-11 thousand USD in Tether- and DogeCoin on a cold wallet on this phone!

 

[Igor Eisberg]

The TWRP was included in the ROM back then, it was a Chinese TWRP with default language set to Chinese, and can be easily changed within TWRP.
It has nothing to do with the region of boot.img.
Sounds like uninstalling Magisk corrupted the boot.img. All you had to do to fix the boot failure was to flash the original boot.img
(either from our ROM, which has an older TWRP included, or from the official ROM, which comes with Mi Recovery).
The moment where you messed up was when you touched files in /data/system.
Try accessing Settings app and setting a new PIN/Password for the lock screen.

 

[SuperHopeful]

The TWRP was included in the ROM back then, it was a Chinese TWRP with default language set to Chinese, and can be easily changed within TWRP.
It has nothing to do with the region of boot.img.
Sounds like uninstalling Magisk corrupted the boot.img. All you had to do to fix the boot failure was to flash the original boot.img
(either from our ROM, which has an older TWRP included, or from the official ROM, which comes with Mi Recovery).
The moment where you messed up was when you touched files in /data/system.
Try accessing Settings app and setting a new PIN/Password for the lock screen.

Thank you so much for clearing up the mystery behind the Chinese default language in TWRP! Your explanation about it being included in the ROM and not related to the boot.img region makes perfect sense, and I really appreciate you taking the time to break it down.


Unfortunately, I'm still facing issues with decrypting the data. Even after setting a new PIN/Password through the Xiaomi MIUI Settings app, the data remains inaccessible. From what I've read, this might be due to the locksettings.db file no longer correctly pointing to the appropriate 'spblob' file in the directory. Apparently, this can be resolved by understanding File-Based Encryption (FBE) on Android 11 and how these files interact to unlock the userdata.

Would you be kind enough to assist me in analyzing the encryption-related files if I use "adb pull" to retrieve them? I'm hoping we could identify which file needs modification to restore the correct linkage.

Additionally, do you know if there's a way to emulate the exact MIUI environment, perhaps through an emulator, or would purchasing an identical phone for experimentation be a better approach? I'd love to understand how these files are supposed to point to each other under normal conditions.

Here is some useful information about my system: https://pastebin.com/enwfPmK6, in fact @Igor Eisberg your name actually appears here!

 

[Igor Eisberg]

Thank you so much for clearing up the mystery behind the Chinese default language in TWRP! Your explanation about it being included in the ROM and not related to the boot.img region makes perfect sense, and I really appreciate you taking the time to break it down.


Unfortunately, I'm still facing issues with decrypting the data. Even after setting a new PIN/Password through the Xiaomi MIUI Settings app, the data remains inaccessible. From what I've read, this might be due to the locksettings.db file no longer correctly pointing to the appropriate 'spblob' file in the directory. Apparently, this can be resolved by understanding File-Based Encryption (FBE) on Android 11 and how these files interact to unlock the userdata.

Would you be kind enough to assist me in analyzing the encryption-related files if I use "adb pull" to retrieve them? I'm hoping we could identify which file needs modification to restore the correct linkage.

Additionally, do you know if there's a way to emulate the exact MIUI environment, perhaps through an emulator, or would purchasing an identical phone for experimentation be a better approach? I'd love to understand how these files are supposed to point to each other under normal conditions.

Here is some useful information about my system: https://pastebin.com/enwfPmK6, in fact @Igor Eisberg your name actually appears here!

I'm trying to understand what data you're trying to regain access to.
You said that user 0 was successfully decrypted using TWRP and you were able to backup some files.
You won't be decrypting user 999 (reserved for dual apps, as far as I remember) with TWRP, as it doesn't use your pattern and TWRP doesn't know the decryption key either, it's generated by MIUI.
By removing locksettings.db and gatekeeper files, you lost the data that was used to encrypt the files (each file is encrypted with a different key, to make things worse).
What you're asking for is help with reverse-engineering the encryption in order to decrypt the files, also known as cracking. The legality of this is questionable, and this isn't a hacking community. I assure you if there was a way to crack that key-per-file encryption, Google would have discontinued it by now.

 

[SuperHopeful]

You're mistaken about the process. Reconstructing the locksettings.db file to point to the correct spblob file isn't about breaking or cracking encryption. It's about properly configuring the file to reference the correct secure key storage outside the gatekeeper environment, enabling the decryption of the key_encrypted_key (CE). This is a legitimate recovery process, not reverse-engineering or hacking, as it uses the existing encryption framework to restore access without bypassing or cracking any keys.

Read here : https://android.stackexchange.com/q...h-key-used-to-encrypt-each-corresponding-file

And here: https://android.stackexchange.com/q...d-and-how-is-it-used-by-android/258043#258043

And here: https://android.stackexchange.com/q...es-fbes-key-derivation-work?noredirect=1&lq=1

QUESTION;:

I've successfully reconstructed the locksettings.db file and pushed it to /data/system using ADB, but after rebooting, the file disappears. I'm rooted with Magisk 24, and I can confirm that Magisk can create folders in /data/system, and setting a new PIN/pattern also generates files there, indicating that writing to this directory should theoretically be possible. However, the /data partition seems to remain mounted, and despite my efforts, the locksettings.db file I insert doesn't persist after a reboot. Could you explain why this is happening and what might be preventing the file from staying in /data/system?

 

[SuperHopeful]

Exactly WHAT is my "Stock ROM" for my system? I am still confused. Would it be:

- The Original Chinese ROM, when the device was created in China.
- The Xiaomi.EU ROM that was flashed unto it, by the European Seller, before they sold it to me.
- The "recovery upgraded level/state", which is 12.5.20 when I took ownership of the phone.