[Xiaomi Mi 9 Guides, News, & Discussion] eseub:
Hello there, this is my first post here

I bought this phone like 10 days ago and waited 168 hours to unlock the bootloader

Everything went fine and now I have the bootloader unlocked

During the process of unlocking I sniffed the usb and internet connection and I found some very interesting things

I have had lg, motorola and nexus phones before so I'm used to multiple methods of unlocking the bootloader and I wish every phone was like the nexus in this regard(fastboot oem unlock), but as this is not the case this is what I found:

miflash obtains a code from the device with:

fastboot getvar token

the device responds with (in my case):

token: VQEBIQEQ69vxY17MOJnHQZD5Z0e9EwMHY2VwaGV1cwIEWgN-kQ
Finished. Total time: 0.000s

miflash uses this code in their api:

https:// unlock update intl miui com(ip: 161.117.108.114)

their api responds with(in my case):

sign result:{
"code" : 0,
"description" : "私钥签名成功", //Private key signature succeeded
"encryptData" : "5934D848743BECCFE6C895C128D62E66F9B5300617D53CC89C601E325153898CBA09D9D8849A5E62BB5EBFDF9788D958F307E676D84AACB2236F979FC9286FC91B1135D4E4AE40F8B7DD2FF3365D7D9B648B8D9556D0B1A4CBB1DDF459CD8109253F2E6131BD358A74D2159145BE18BD1CEB7D58B7236083D22BD865DB4EBBE64585F7E31656A5F807294B807981CF20C2E3D4E22E3543B9E24CA91C5F82E948636FE66A32B8E17ACF4B4828CBB67971A8B743D973A2B075505CC252F66E1DA62FCB4298483906597C926A337D5EB14EC061EB6D38A629869B6CBB572D6BAE5AE5D6C7306766870037A224E322866BFF4766A06C7CB73982152C10374976F5FD",
"uid" : "<mi account ID>"
}

This is the last application data that miflash receives:

0000 88 ae 1d 6f 3c 9f 98 97 d1 32 14 8b 08 00 45 20 ...o<....2....E
0010 05 3a 4d 70 40 00 30 06 e0 39 a1 75 6c 72 0a 00 .:Mp@.0..9.ulr..
0020 00 0d 01 bb d9 72 89 6a 29 fb 1b 57 73 a5 50 18 .....r.j)..Ws.P.
0030 00 45 74 0d 00 00 17 03 03 05 0d 20 9c 9b c9 5f .Et........ ..._
0040 63 ad 2a 3f c6 77 d7 ae 1b ff 14 82 bf 28 a4 a4 c.*?.w.......(..
0050 24 ed 83 f8 fc 0a fa 74 dd 8a b5 be 34 ca 71 ca $......t....4.q.
0060 91 5d 67 85 bf 90 9c 7e 05 b0 86 f3 b0 5a de cb .]g....~.....Z..
0070 7d 38 39 26 da 8a 81 f7 ac 92 de e1 bb c9 a6 c9 }89&............
0080 10 42 4c 0d 30 3f 01 97 c4 45 ae 83 5a 84 75 35 .BL.0?...E..Z.u5
0090 0a 1e 98 19 0a a1 53 56 d4 f8 b4 b4 bb c6 c3 84 ......SV........
00a0 9e 00 2e 6a 2d d8 47 af 79 cc 6d de 97 a4 81 bd ...j-.G.y.m.....
00b0 89 b6 94 05 cf e9 75 18 a7 2d 2d dc 5c a0 5a d6 ......u..--.\.Z.
00c0 02 0e ee dd 49 36 3c b2 af 63 28 5e 99 a3 56 cd ....I6<..c(^..V.
00d0 94 c9 e0 49 52 39 b2 ac 30 7c 31 6f bb 57 cd da ...IR9..0|1o.W..
00e0 7f bb 10 8f a1 6d b7 d7 7f 5c 0e 9f 88 e4 22 21 .....m...\...."!
00f0 9c 52 05 35 83 1a a2 c1 0b c2 f9 1f 03 dd ac f8 .R.5............
0100 4b e8 32 ae 31 5d a2 9d 60 ed e9 00 c6 18 82 a5 K.2.1]..`.......
0110 2a 84 d5 44 d9 88 a9 27 4b c0 12 79 3b 87 a2 2a *..D...'K..y;..*
0120 1c 4c 0e 70 48 ee 60 97 6e 77 46 a0 c4 38 3c ad .L.pH.`.nwF..8<.
0130 79 fe de d3 0c 4d 36 ca 2b 7a d6 4c 9a 42 36 9f y....M6.+z.L.B6.
0140 85 ab 17 12 9b 4a e9 74 17 e7 30 08 8d fc fa c2 .....J.t..0.....
0150 90 50 ed 3d 28 c1 b6 c7 ca e6 1d 5c 88 e1 bb fc .P.=(......\....
0160 0a d5 ee f3 82 b0 0f da 22 85 40 db 2a 71 fb 27 ........".@.*q.'
0170 82 6a 56 e6 e4 1c 7e d0 ce f8 67 4f 61 d9 7b d5 .jV...~...gOa.{.
0180 ca 59 ac bf 30 2f 23 eb ed 7a 31 54 80 69 26 9c .Y..0/#..z1T.i&.
0190 f7 7d 14 57 51 3d f8 cc 5f 43 23 9e 3e 2e d7 bc .}.WQ=.._C#.>...
01a0 f3 6e 47 b8 11 7a 60 a8 19 e1 a3 77 c6 59 8e 3b .nG..z`....w.Y.;
01b0 17 e4 ad 51 e1 75 78 fb af fe 72 63 b8 fd a2 20 ...Q.ux...rc...
01c0 8c d9 7c 87 f8 1c 29 74 cb 8c 62 c9 e3 22 0e 4c ..|...)t..b..".L
01d0 f6 5a bf fc 9f 2f a3 b5 3f 1f 9a 06 1b 80 78 40 .Z.../..?.....x@
01e0 c5 e8 bf 49 23 87 22 cd 60 29 2d 8f 2d 1f d6 ae ...I#.".`)-.-...
01f0 66 08 e1 3d 59 9c e6 65 70 56 16 26 bd 05 ca 55 f..=Y..epV.&...U
0200 9c 45 84 fe 3c 5b 8b 68 39 c5 4c ca ee 1d 2e 4c .E..<[.h9.L....L
0210 d1 14 9a 6a b4 57 78 1c c3 72 2a 5e 28 ab 8b c3 ...j.Wx..r*^(...
0220 4a 26 9c 2d 23 af a5 ed 66 6e 56 e5 07 10 4d ce J&.-#...fnV...M.
0230 f2 27 91 ef 6d f0 2a 36 8c ad 9a 81 d2 83 21 7c .'..m.*6......!|
0240 b9 28 b1 bc 18 87 75 c7 af 35 99 2e bd b9 b6 fe .(....u..5......
0250 e7 83 04 96 52 c7 6a f1 89 de 95 06 2e 4c 55 93 ....R.j......LU.
0260 f8 e0 16 2b f7 5b cd f1 bf 7b d5 ac d3 42 24 6d ...+.[...{...B$m
0270 f5 51 4b 90 d2 3e d9 70 e9 0e 83 a0 9f 69 8e dd .QK..>.p.....i..
0280 ee 23 a1 29 82 94 94 1a a1 c8 0a 0c 55 42 dd 40 .#.)........UB.@
0290 d3 b6 7d 46 95 d6 74 e6 18 9d 6b 62 50 7d 47 d6 ..}F..t...kbP}G.
02a0 c1 48 d8 f5 40 3a 6e a1 9c ab 23 83 1f 9d 71 a5 .H..@:n...#...q.
02b0 c8 60 27 62 74 25 2c d9 f7 95 77 d3 d0 e1 f5 8d .`'bt%,...w.....
02c0 73 d1 ec 49 26 e4 39 44 f2 2f 9a b5 17 f0 f8 f9 s..I&.9D./......
02d0 9c 25 ff 8b 2c ee bf 24 f8 3a ac 06 68 24 9c b6 .%..,..$.:..h$..
02e0 8b be b2 53 7d 49 ee 0c bb 6b 1a 4c 4a 9d 13 a9 ...S}I...k.LJ...
02f0 a3 1c c2 cf 46 69 f2 7b 43 b9 0a 3c 63 be a0 67 ....Fi.{C..<c..g
0300 00 43 60 77 16 f1 f1 72 e9 1c 3e b6 0b e8 d9 cd .C`w...r..>.....
0310 6a 4f f0 40 f6 cb bd 9b 99 ee ef b5 6b 9e 77 1d jO.@........k.w.
0320 47 51 da 22 57 81 be 39 b4 b9 8a f0 e0 5a d7 37 GQ."W..9.....Z.7
0330 7c aa 06 0d 29 83 9a 97 57 76 9f 72 87 aa d7 e4 |...)...Wv.r....
0340 1a 3e e7 e6 ad 97 9d 91 ce b3 64 96 b8 7e e3 86 .>........d..~..
0350 52 f1 21 1b 45 c6 47 45 28 bc 12 e3 91 2e 03 44 R.!.E.GE(......D
0360 91 1a 75 09 0a 6f 98 ad 38 30 e2 29 b6 07 00 dd ..u..o..80.)....
0370 a4 60 b2 65 dd 09 df 2b 3d 45 a8 21 06 e2 47 bf .`.e...+=E.!..G.
0380 34 c7 2f 36 67 03 40 05 26 75 ef 21 b2 25 ba 35 4./6g.@.&u.!.%.5
0390 04 22 2a e4 7c d2 a9 cf 93 eb a7 3b 26 26 bf 1b ."*.|......;&&..
03a0 6b b7 53 f4 24 66 56 43 86 1b f7 b1 7d 2b 58 db k.S.$fVC....}+X.
03b0 da 3c 67 9d ba b1 fd dc c7 b3 50 10 e3 e3 6f aa .<g.......P...o.
03c0 40 0f 96 fa a4 d0 05 3e 5d d0 e0 6e 80 50 f7 e1 @......>]..n.P..
03d0 ce 8d 25 11 d3 57 20 29 ef 1b a0 82 6c d2 03 cc ..%..W )....l...
03e0 59 19 48 91 13 f5 53 fc e1 b7 4e 3a 16 35 ed 57 Y.H...S...N:.5.W
03f0 25 cf 4e d1 69 13 b5 3b e2 ec 6c 2c b4 ab 0e 97 %.N.i..;..l,....
0400 26 50 2c a8 f7 23 63 85 1c 5c e5 67 17 b8 c5 f4 &P,..#c..\.g....
0410 08 93 3e 3e 5d ef 76 f3 e3 5f fb 9e b7 75 b9 3a ..>>].v.._...u.:
0420 7f 4a fd ee 37 f4 0c 8d 0f ed 93 76 91 d4 67 6a .J..7......v..gj
0430 a4 9d 9b bf ef c9 f5 78 dd ba 21 5c b8 05 8f 25 .......x..!\...%
0440 56 b1 95 48 9e 0d 6d e4 fb ee 7d 3a 98 7d 06 c8 V..H..m...}:.}..
0450 bd a1 20 41 56 30 f9 a1 75 f6 6b 0a 46 3a 5b 33 .. AV0..u.k.F:[3
0460 e2 14 52 c5 45 0c ab 30 c3 08 13 c1 d2 d2 1f 0e ..R.E..0........
0470 76 92 fd 95 5d 33 68 bc 30 23 85 ca 62 95 37 77 v...]3h.0#..b.7w
0480 aa 30 09 18 20 7b ea a4 89 d1 d6 f4 c0 93 04 7c .0.. {.........|
0490 4e 81 63 fc 4c 14 c4 c8 b5 bf ea fe 31 9f b1 10 N.c.L.......1...
04a0 72 70 28 2b d6 9c 0c 67 38 c2 06 be 68 6d 2f 3a rp(+...g8...hm/:
04b0 20 70 d1 2b 12 a6 db 4f 68 e7 84 5f 93 d6 2d c0 p.+...Oh.._..-.
04c0 b4 61 cf 4e fb 81 d2 10 be f9 0a f9 4d 9e 27 a7 .a.N........M.'.
04d0 f9 85 e1 76 c8 6b e4 70 2a 2d 22 d8 43 7b 67 35 ...v.k.p*-".C{g5
04e0 13 a3 2f 62 0b 55 b7 15 7c 1e 83 58 ed 04 17 49 ../b.U..|..X...I
04f0 f8 e2 c5 92 f5 c9 1c 73 0c a4 19 89 bc 84 ff 23 .......s.......#
0500 75 37 bf 4e 51 8a 9e 62 9e 22 92 b8 a7 fa 01 ec u7.NQ..b."......
0510 10 7c 21 c9 e8 b8 a6 23 61 7d 75 c8 30 66 b9 67 .|!....#a}u.0f.g
0520 6f d6 51 4d f4 cd 81 49 50 70 e4 80 97 a1 02 11 o.QM...IPp......
0530 49 44 1d e6 f6 24 55 b8 16 df b2 c6 84 05 da 7f ID...$U.........
0540 c7 54 af cb 6b 9a 35 63 .T..k.5c

With "encryptData", miflash executes the following:

fastboot oem unlock "1f2ebb62_sig.data"

something similar to LG approach with unlock.bin

I suspect that this file is temporarily created inside the miflash folder then deleted once the command is executed

So I think if we can save this file or the code inside it, it will be possible to unlock the bootloader without miflash the next time we want to unlock the bootloader.

I searched "1f2ebb62_sig" in google and didn't found any results, so I hope that we can found something.

All this information is present inside of the file "C:\Users\%USERNAME%\AppData\Roaming\Xiaomi\miflash_unlock\Log\miflash_unlock.log"

[EDIT] As pointed out by [MENTION=5030630]natinusala[/MENTION] the 1f2ebb62_sig file contains the serial number in the name

[EDIT] Token var changes every reboot

[EDIT] Progress has been made, check this github repos:

https://github.com/penn5/miunlock

https://github.com/GiorgioUghini/miunlock