Also brother, I just tried to hit readback button while on bootloop, I also loaded mi auth bypass stuff normally, only steps that required volup press I skipped, but this gave NO results (it didn't pull any .img file or anything at all, so I had to click stop button)
So I'd have to find a way to have the download method available to me in the first place and I'm worried even the removing battery idea won't allow me to do that
ANOTHER THING TO NOTICE is that after looking inside the scatter file for miui "18.104.22.168" , I found my userdata string on the same position as you did and with the exact same values.... Then I looked for the same lines within a "22.214.171.124" one, guess what, still had the same values of:
"physical_start_addr: 0x1d2800000" & "partition_size: 0x300000000"
Maybe these lines are the same for all begonia. However, even if I manage to pull an .img file as you said, we don't even know how to make it readable or accesible, or better yet, restorable again to a begonia. You gave me that tutorial because you actually pulled an .img file right? And you assume it has all your data encrypted in some way