Dear Forum Members, I will be slowly saying goodbye to this forum, as professional and personal obligations (I have a large group of children of my own) have made contributing from time to time more difficult. Finally, I'd like to share some information about the bootloader structure in Xiaomi phones that I managed to acquire, and as a happy owner of a Xiaomi 17 Pro with an unlocked bootloader.
In general, I'll cover a few issues:
- the unusual structure of the Xiaomi bootloader
- how paid services work and why they can unlock the bootloader
- why they can unlock the global version and not the Chinese version
- how it was possible to unlock my xiaomi 17 pro
- why dont flash fake global rom!!!
The Xiaomi bootloader is a heavily modified Qualcomm bootloader. Obviously, it doesn't have an open-source equivalent, but it can be viewed in: /dev/block/by-name/xbl and /dev/block/by-name/abl. These are two of the three parts of the Xiaomi bootloader. The first is the so-called PBL (Primary Boot Loader), the second is the XBL Extensible Boot Loader, and the third is the ABL (Android Bootloader).
It is possible to decrypt blobs/abl/LinuxLoader from ABL and retrieve the fastboot getvar token and fastboot oem unlock in EDL mode. The token consists of 36 bytes, in hexadecimal format.
Bytes 6-26 are generated by the UEFI random number generator. Starting at the 29th byte, I think, is the device codename, followed by the serial number – but ultimately, this information is irrelevant at this point.
You might wonder how paid services like XXunlock or others manage to unlock the bootloader, and only globally.
Because Xiaomi built the bootloader from these three components, and it can be completely extracted from the phone via EDL, you can use a fake firehose to generate a stage token and unlock the phone even offline.
People who do this don't have any copies of the Xiaomi server, their keys, etc. Up to and including HyperOS 3.0, it's possible to generate a get token via EDL that will respond correctly.
However, to flash in EDL mode, you must have an EDL account with Xiaomi's blessing (and pay Xiaomi for a token for each EDL tamper).
Companies outside of China have not been able to authorize EDL for Chinese phones since this year (this was also disabled when updating older models). Therefore, for example, XXunlock cannot unlock Chinese phones.
But technically, anyone with an EDL script similar to XXunlock and EDL authorization for Chinese models can unlock the bootloader with it.
Xiaomi has made sure not to throw EDL tokens at Chinese models, so currently, it's impossible to unlock the Chinese bootloader on a mass scale. However, technically, it's possible with EDL, just like with Global models.
Why are Xiaomi bootloader unlocking prices so high? Firstly, they can gouge the price, and secondly, EDL tokens are expensive.
So, the unlocked bootloader was mine through EDL by someone who had EDL tokens for the Chinese market and somehow didn't get fired for using them. Yes, it can be done remotely, and I know of a case where it was done remotely to someone in Poland.
And here's another issue. Since flashing a fake Global ROM on a Chinese phone after EDL effectively uses EDL authorization for the global market, it will never be possible to revert to a Chinese ROM without the help of someone who has EDL authorization for the Chinese market.
From what I understand, people working on unlocking Chinese models are focusing on two things:
- perhaps cracking their Get Token response algorithm, but it's difficult to get the keys without access to their keys
- cracking the ability to put the phone into EDL mode and use it without Xiaomi authorization
The current status is that models with MTK (e.g., the Redmi K60) can be physically accessed and used in EDL mode without Xiaomi authorization, so unlocking the bootloader on a Chinese model is possible without authorization.
However, there's currently no chance of doing so on Snapdragon phones.
I hope this forum doesn't disappear in a few years,
and if I hear anything, I'll let you know about the progress. Regards, Paweł
In general, I'll cover a few issues:
- the unusual structure of the Xiaomi bootloader
- how paid services work and why they can unlock the bootloader
- why they can unlock the global version and not the Chinese version
- how it was possible to unlock my xiaomi 17 pro
- why dont flash fake global rom!!!
The Xiaomi bootloader is a heavily modified Qualcomm bootloader. Obviously, it doesn't have an open-source equivalent, but it can be viewed in: /dev/block/by-name/xbl and /dev/block/by-name/abl. These are two of the three parts of the Xiaomi bootloader. The first is the so-called PBL (Primary Boot Loader), the second is the XBL Extensible Boot Loader, and the third is the ABL (Android Bootloader).
It is possible to decrypt blobs/abl/LinuxLoader from ABL and retrieve the fastboot getvar token and fastboot oem unlock in EDL mode. The token consists of 36 bytes, in hexadecimal format.
Bytes 6-26 are generated by the UEFI random number generator. Starting at the 29th byte, I think, is the device codename, followed by the serial number – but ultimately, this information is irrelevant at this point.
You might wonder how paid services like XXunlock or others manage to unlock the bootloader, and only globally.
Because Xiaomi built the bootloader from these three components, and it can be completely extracted from the phone via EDL, you can use a fake firehose to generate a stage token and unlock the phone even offline.
People who do this don't have any copies of the Xiaomi server, their keys, etc. Up to and including HyperOS 3.0, it's possible to generate a get token via EDL that will respond correctly.
However, to flash in EDL mode, you must have an EDL account with Xiaomi's blessing (and pay Xiaomi for a token for each EDL tamper).
Companies outside of China have not been able to authorize EDL for Chinese phones since this year (this was also disabled when updating older models). Therefore, for example, XXunlock cannot unlock Chinese phones.
But technically, anyone with an EDL script similar to XXunlock and EDL authorization for Chinese models can unlock the bootloader with it.
Xiaomi has made sure not to throw EDL tokens at Chinese models, so currently, it's impossible to unlock the Chinese bootloader on a mass scale. However, technically, it's possible with EDL, just like with Global models.
Why are Xiaomi bootloader unlocking prices so high? Firstly, they can gouge the price, and secondly, EDL tokens are expensive.
So, the unlocked bootloader was mine through EDL by someone who had EDL tokens for the Chinese market and somehow didn't get fired for using them. Yes, it can be done remotely, and I know of a case where it was done remotely to someone in Poland.
And here's another issue. Since flashing a fake Global ROM on a Chinese phone after EDL effectively uses EDL authorization for the global market, it will never be possible to revert to a Chinese ROM without the help of someone who has EDL authorization for the Chinese market.
From what I understand, people working on unlocking Chinese models are focusing on two things:
- perhaps cracking their Get Token response algorithm, but it's difficult to get the keys without access to their keys
- cracking the ability to put the phone into EDL mode and use it without Xiaomi authorization
The current status is that models with MTK (e.g., the Redmi K60) can be physically accessed and used in EDL mode without Xiaomi authorization, so unlocking the bootloader on a Chinese model is possible without authorization.
However, there's currently no chance of doing so on Snapdragon phones.
I hope this forum doesn't disappear in a few years,
and if I hear anything, I'll let you know about the progress. Regards, Paweł
