[Guide] Unlocking the Mi4c Bootloader without verification by Xiaomi

[lordhow]

My friend bought phone from ibuygou. How do you find out if bootloader is locked?

With the command fastboot oem device-info.

 

[NoOneLt]

Hi,

If i can get into fastboot (Vol Down + PWR) turns on Fastboot (Rabbit image fixing phone) it means i have unlocked bootloader and can install TWRP via adb? On the other hand Vol Up + PWR shows white phone disconnected from cable.

Thanks. BR.

 

[Taminon]

Great!

Working on MIUI 7.2.4.0

Now running on CM 13.1

 

[NoOneLt]

Working on MIUI 7.2.4.0

Now running on CM 13.1

How would you compare to MIUI, CM is the only way to go? Are you using TS build?

 

[jna9000]

With MIUI 77.0.4.0 (LXKCNCI) I got remote command not found error trying to issue the fastboot oem edl command. After flashing miui_MI4c_6.1.21_d1d054460d_5.1.zip (download in the start post) using the upggrade utility with the 3 dots menu, every other step went fine. Seems that the bootloader is unlocked now.

Thank you very much for the guide!

 

[wolkenjaeger]

With MIUI 77.0.4.0 (LXKCNCI) I got remote command not found error trying to issue the fastboot oem edl command. After flashing miui_MI4c_6.1.21_d1d054460d_5.1.zip (download in the start post) using the upggrade utility with the 3 dots menu, every other step went fine. Seems that the bootloader is unlocked now.

Thank you very much for the guide!

MIUI 77.0.4.0 is definately not an official MIUI ROM.... good you could get rid of it (... your phone WAS hacked, but now is free)

 

[jna9000]

Sure it was hacked? Got it fresh from GearBest...

 

[antimatter.web]

Sure it was hacked? Got it fresh from GearBest...

Gearbest installs their own (unofficial) rom - I've heard reports of malware infested miui roms from resellers, though I'm not sure if gearbest is one of them.

 

[primski]

hello,

i want to unlock my bootloader and xiaomi just takes too much time if they will even send the code

currently i am running miui 7.2.4.0 (LXKCNDA), and it's offering to update to 7.3.1.0

do I upgrade first? does this matter or do i still use image in first post, Mi4c Image: libra_images_6.1.7_20151221.0000.11_5.1_cn_b09dac7 0a0.tgz - unpack until "images" directory is visible! ?

after that, i can install any rom? not just the CM12.1 as in first post?

thanks guys

 

[gcsuri]

Hi,

I was on latest devel. Went everything well, but after I flashed 6.1.7 I tried to reboot, device not started... It goes to the mode like "fastboot oem edl". Nothing in the srceen but device detected by MiFlash.
Here is the log:

[00000770]CreateManagedObject(1392): Unspecified error(0x80131604)
[00000770]GetFactoryObject(1436): Unspecified error(0x80131604)
[00000770]CreateManagedObject(1392): Unspecified error(0x80131604)
[00000770]GetFactoryObject(1436): Unspecified error(0x80131604)
[00000770]GetFactoryObject(1457): The specified service does not exist.(0x800704db)
[00000770]GetSearchPath(1512): The specified service does not exist.(0x800704db)
[00000770]StartFlash(13): The parameter is incorrect.(0x80070057)
[00000BA4]CEmergencyFlasher::IsQPSTServer(655): Not implemented(0x80004001)
[00000BA4]COM10 0.64 Load programmer "C:\Users\csucsu\Downloads\libra\images\prog_emmc_firehose_8992_ddr.mbn"
[00000BA4]DownloadFlashProgrammerDMSS(625): An attempt was made to load a program with an incorrect format.(0x8007000b)
[00000BA4]DownloadFlashProgrammer(930): An attempt was made to load a program with an incorrect format.(0x8007000b)
[00000BA4]COM10 0.64 Open programmer "C:\Users\csucsu\Downloads\libra\images\prog_emmc_firehose_8992_ddr.mbn"
[00000BA4]COM10 0.64 Open serial port "\\.\COM10"
[00000BA4]COM10 0.64 Receiving hello packet
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(209): Reached the end of the file.(0x80070026)
[00000BA4]DownloadFlashProgrammerSahara(781): Reached the end of the file.(0x80070026)
[00000BA4]COM10 2.82 Missed hello packet, try to recover
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(202): Reached the end of the file.(0x80070026)
[00000BA4]ReadRobust(209): Reached the end of the file.(0x80070026)
[00000BA4]COM10 5.01 Switch mode back
[00000BA4]COM10 5.01 Receiving hello packet
[00000BA4]COM10 5.01 Send hello response
[00000BA4]COM10 5.01 ReadDataPacket id 13, offset 00000000, length 80
[00000BA4]COM10 5.01 ReadDataPacket id 13, offset 0x000050, length 4096
[00000BA4]COM10 5.01 ReadDataPacket id 13, offset 0x001050, length 4096
[00000BA4]COM10 5.01 ReadDataPacket id 13, offset 0x002050, length 4096
[00000BA4]COM10 5.01 ReadDataPacket id 13, offset 0x003050, length 4096
[00000BA4]COM10 5.01 ReadDataPacket id 13, offset 0x004050, length 4096

and this is the end of the log:

[00000BA4]COM10 137.56 WriteFile position 0x000000144bb800, size 8192
[00000BA4]COM10 137.56 Writing file "C:\Users\csucsu\Downloads\libra\images\userdata.img" to partition at 22413312
[00000BA4]COM10 137.56 WriteFile position 0x000000144bd800, size 8192
[00000BA4]COM10 137.56 Writing file "C:\Users\csucsu\Downloads\libra\images\userdata.img" to partition at 22675456
[00000BA4]COM10 137.56 WriteFile position 0x000000144bf800, size 8192
[00000BA4]COM10 137.56 Writing file "C:\Users\csucsu\Downloads\libra\images\userdata.img" to partition at 22937600
[00000BA4]COM10 137.58 WriteFile position 0x000000144c1800, size 8192
[00000BA4]COM10 137.66 Writing file "C:\Users\csucsu\Downloads\libra\images\gpt_main0.bin" to partition at 0
[00000BA4]COM10 137.67 WriteFile position 0000000000000000, size 17408
[00000BA4]COM10 137.69 Writing file "C:\Users\csucsu\Downloads\libra\images\gpt_backup0.bin" to partition at NUM_DISK_SECTORS-33.
[00000BA4]COM10 137.69 WriteFile position 0000000000000000, size 16896
[00000BA4]COM10 137.69 Open patch file "C:\Users\csucsu\Downloads\libra\images\patch0.xml"
[00000BA4]COM10 137.70 ApplyPatch sector 12, offset 424, value NUM_DISK_SECTORS-34., size 8
[00000BA4]COM10 137.70 ApplyPatch sector NUM_DISK_SECTORS-23., offset 424, value NUM_DISK_SECTORS-34., size 8
[00000BA4]COM10 137.70 ApplyPatch sector 1, offset 48, value NUM_DISK_SECTORS-34., size 8
[00000BA4]COM10 137.70 ApplyPatch sector NUM_DISK_SECTORS-1., offset 48, value NUM_DISK_SECTORS-34., size 8
[00000BA4]COM10 137.72 ApplyPatch sector 1, offset 32, value NUM_DISK_SECTORS-1., size 8
[00000BA4]COM10 137.72 ApplyPatch sector NUM_DISK_SECTORS-1., offset 24, value NUM_DISK_SECTORS-1., size 8
[00000BA4]COM10 137.72 ApplyPatch sector NUM_DISK_SECTORS-1, offset 72, value NUM_DISK_SECTORS-33., size 8
[00000BA4]COM10 137.72 ApplyPatch sector 1, offset 88, value CRC32(2,5632), size 4
[00000BA4]COM10 137.72 ApplyPatch sector NUM_DISK_SECTORS-1., offset 88, value CRC32(NUM_DISK_SECTORS-33.,5632), size 4
[00000BA4]COM10 137.73 ApplyPatch sector 1, offset 16, value 0, size 4
[00000BA4]COM10 137.73 ApplyPatch sector 1, offset 16, value CRC32(1,92), size 4
[00000BA4]COM10 137.75 ApplyPatch sector NUM_DISK_SECTORS-1., offset 16, value 0, size 4
[00000BA4]COM10 137.75 ApplyPatch sector NUM_DISK_SECTORS-1., offset 16, value CRC32(NUM_DISK_SECTORS-1.,92), size 4
[00000BA4]GetFactoryObject(1457): The specified service does not exist.(0x800704db)
[00000BA4]SaveFlashResult(1478): The specified service does not exist.(0x800704db)

What to do? Please help!

 

[gcsuri]

Ok, it's solved. I had to discharge the battery, then the phone started normally. So it works with the 6.4.21 also

regards, gcsuri

 

[primski]

I managed to unlocked the bootloader, I think, the Security app shows Root Access under Permissions, but I can't get TWRP installed ... I tried flashing the recovery image and it completes successfully but it when I reboot to recovery I always get to MI Official Recovery .... I tried flashing with WinDroid and TWRP Recovery tool kit, all of the methods complete successfully and yet when i reboot to recovery i get to the MI one ... what am I doing wrong?

 

[gcsuri]

I managed to unlocked the bootloader, I think, the Security app shows Root Access under Permissions, but I can't get TWRP installed ... I tried flashing the recovery image and it completes successfully but it when I reboot to recovery I always get to MI Official Recovery .... I tried flashing with WinDroid and TWRP Recovery tool kit, all of the methods complete successfully and yet when i reboot to recovery i get to the MI one ... what am I doing wrong?

Hi,

1. install recovery with fastboot then reboot into recovery (without starting miui)
2. install cm ROM from twrp then reboot

that's all. Miui always repair the recovery

regards, gcsuri

 

[primski]

Hi,

1. install recovery with fastboot then reboot into recovery (without starting miui)
2. install cm ROM from twrp then reboot

that's all. Miui always repair the recovery

regards, gcsuri

YES! Thank you.

I just did it, before seeing your post, but yeah after flashing TWRP you need to go directly to recovery otherwise stock ROM overwrites it ... stupid me. i dowlnloaded the rom, and gapps, and flashed everything so i am up and running now on ressurection 6.0 rom ... very cool

thanks

 

[naaiil]

is it work for other xiaomi devices?

Sent from my Mi-4c using Tapatalk

 

[bondai]

it worked.. THANKS for the great tutoriol..
i was from latest global china Version: V7.3.1.0.LXKCNDD
also skipped the first step (downgrade).. went straight to flashing 6.1.7
had a glitch on the first time, but that was becos i was using 32bit windows..
Thanks again...

 

[asalapasa]

Ok, i followed the guide, and i have install twrp 3.0.2.0. Any time i try to flash a custom rom, i get "failed error 7". I tried cm12.1 and cm13. Am i making some mistake?

 

[erioho]

I unlocked with your method, work great!

But when I update it from 6.1.7 to the latest, using the update function or use fast boot to update, it will revert to "locked" state and it removed my gapps and su.

So, the unlock only work on specify version and cannot update? If I would like to keep on update, what should I do?

 

[Brunnys]

I unlocked with your method, work great!

But when I update it from 6.1.7 to the latest, using the update function or use fast boot to update, it will revert to "locked" state and it removed my gapps and su.

So, the unlock only work on specify version and cannot update? If I would like to keep on update, what should I do?

Just flash smiui or xiaomi.eu roms .
If you update using the official rom you will have always a locked BL, no matter what .

Sent from my Mi-4c using XDA-Developers mobile app

 

[par2005]

After fastboot oem edl command the MiFlash no longer sees the device so I cannot flash it - what am I missing?

Found the issue. I was using virtualbox, and when in "EDL" mode, I had to add "new" usb device and install it's drivers. I had to also reboot my virtual machine for miflash to work after it complained that COM3 port was in use already.