yashsingh1/xdaforums huggingface dataset:
[Xiaomi Redmi Note 4 Questions & Answers] mirfatif:
Encryption is different than lock screen. I'm asking this because if your device is encrypted and the password is changed/corrupted/not working, it's almost certain that your data is not recoverable, even if you manage somehow to flash TWRP and/or unlock bootloader without wiping data.

---------- Post added at 06:25 PM ---------- Previous post was at 06:17 PM ----------

Data wipe on unlocking bootloader is the expected behavior and Google strongly recommends this behavior to OEMs. However bootloader is not a part of Android (AOSP), so not all OEMs fulfill all requirements. And therefore there are very rare chances that unlocking may not erase data.

Secondly, as mentioned earlier, many Qualcomm devices (including a long list from Xiaomi) have an exploit in Emergency Download mode. EDL is a bootloader mode which operates even below the usually called bootloader (ABOOT; the one which provides "fastboot" protocol). It can be hacked to get a dump of whole storage chip or flash a partition e.g. recovery (TWRP) without going through proper channel of bootloader unlocking. Note that a locked botloader won't boot a custom "boot" or "recovery" partition which is not signed by OEM's private key (like TWRP is). It's part of Chain of Trust on Android devices.

However (somehow achieved) access to "userdata" partition will be of no use if the partition is encrypted as I explained. TWRP won't be able to decrypt it without correct PIN/password (if it was set). However if it wasn't encrypted or "default_password" was used for encryption (and not the one you set), data recovery is very probable.

I hope it clarifies the basic scenario for you.
[Xiaomi Redmi Note 4 Questions & Answers] saurabh6377:
There are few things that must be known:

1. Which soc? qcom or mtk, if mtk go to service centre and don't waste time here.

2. Do you have permission to unlock bootloader? If you have permission to unlock then you can easily just unlock, note that unlocking itself doesn't wipe data, it is wiped after it. There are some tricks you can do so that data is not wiped after unlock and you must search them on your own.

3. Is your device encrypted? If it is then which encryption FBE or FDE? If it is encrypted then most likely data can't be recovered.

If you have qcom soc, don't have permission to unlock bootloader then you can do this...

From what you said it looks like recovery is corrupted, you could try flashing stock recovery from *edl but stock recoveries are useless but you can still backup your important data maybe, I am not sure because I have not been into recoveries for past 4 years.

The following method is not tested for your device but might work since the bootloader bug might be present in your device too. Improving alecxs answer you can do this:

1. Grab twrp for your device

2. Append 4k blocks using this command on any Linux based distro or termux (Android app) or BusyBox 1.31.

printf '\x30\x83\x19\x89\x64' | dd of=/path/to/twrp.img ibs=4096 oflag=append conv=sync,notrunc

3. Flash the recovery using edl

4. Directly boot into recovery and see if it boots.

5. If it boots then delete password file of Android and boot into OS.

6. Password should be removed now.

*edl: you must learn to use edl
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
[MENTION=7805402]mirfatif[/MENTION] [MENTION=8273918]saurabh6377[/MENTION] thanks to both of you! I was reading up to understand the steps suggested by [MENTION=4646731]Alecxs[/MENTION]

let me try out the different options suggested by you and I will let you know how it goes.

[MENTION=7805402]mirfatif[/MENTION] no I did not use any extra encryption apart from setting the regular lock screen

[MENTION=8273918]saurabh6377[/MENTION] 1. qcom

2. I dont think I have the permission. Never needed to check it until now and never needed to ask for the permission so guessing I don't have it by default

3. I didn't have any extra layer of encryption apart from the lock screen
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
so your device is most likely encrypted with FDE and default_password as a lot of older xiaomi devices. lets hope the issue is just with screen lock - however there is not really a good explanation (why unlocking screen fails) other than broken encryption. in such case your data is not recoverable.

please note xiaomi removed the fastboot edl command since oreo 8.1 and there might be downgrade protections, so do not update to later version than 8.0

Please just try to boot your device in EDL mode and report back
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
Hi all, just wanted to update you that I don't have any result yet. Reading up on each of the steps so I can execute as suggested. I will get back to you when I have some results. Thanks again
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
follow the link behind fastboot_edl.7z and try to boot into EDL mode with modified fastboot.exe
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
[MENTION=4646731]Alecxs[/MENTION] Just to double check, I am directly following the steps mentioned here: https://xdaforums.com/redmi-note-3/how-to/guide-reboot-to-edl-mode-fastboot-test-t3398718

Is that ok? Doing this first before anything else?
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
yes. if it works, you can proceed with installing Qualcomm HS-USB QDLoader 9008 Driver (and tell us the COM port from windows device manager)

if fastboot_edl not working, you must find another way to boot into EDL aka shortcircuiting data pins on usb-connector (deep flash cable) or find a test point on the physical motherboard on youtube
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
found offsets and sizes for partitions in rawprogram0.xml

i have copied all required files from Xiaomi_Redmi_Note_4_V9.0.5.0.NCFMIEI_20171113.0000.00_Global_7.0_XFT and tried to patch the files. in the modified splash.img string SPLASH!! is replaced with HACKED!! hopefully this works. also i have patched default.prop to make adb insecure in case twrp does not work.

there are differences in files when appending manually or with Appender-v4-rec.zip, so actually i have flashed twrp-3.3.1-0-mido.img to another device (Redmi 5), patched with Appender-v4-rec.zip and created a copy of recovery partition afterwards. the result you can find in twrp-hack.zip (this is the only zip file you need)

for debugging purposes i have uploaded boot-insecure.zip and twrp-3.3.1-0-mido.zip which contains all three files: original, manually patched, patched with appender (you don't need this)
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
[MENTION=4646731]Alecxs[/MENTION] I am trying. Sorry I don't have any result yet :( :( This is so out of my depth, league, width etc. etc. :confused:

Buttttt I am committed to save the data so I will keep going over the steps you suggested until I feel confident to execute them. Really sorry for how slow I am being about it.

I really, really, really appreciate all your help. THANK YOU SO MUCH!
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
no worry we will guide you. for the moment, only try out first step (try to boot in EDL mode)
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
[MENTION=4646731]Alecxs[/MENTION] it worked!!!! "your device is rebooted to EDL succesfully" what do I do next?
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
And after rebooting the device restarts and goes back to being locked as it has been last few days. What do I do next?
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
To install qualcomm driver one of the steps mentioned here [ https://www.xiaomigeek.com/download-qualcomm-qdloader-usb-driver.html ] is enabling USB debugging. Which I can't do in this locked phone. I tried working on step 3 onwards without being able to work on step 2 and it of course didnt work.
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
[MENTION=4646731]Alecxs[/MENTION] let me know please when you may have some free time to be online. Mention the time in GMT please if possible. I can then give you real time update on what's happening after I execute the steps.
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
skip step 6) adb reboot edl because this is just another command to enter edl mode. the command we use is from fastboot, because adb is not enabled. the message "your device is rebooted to EDL succesfully" is just info that you tried to boot into EDL mode, but it does NOT tell you if it works.. if device does a normal reboot - it doesn't :(

check in device manager there must be a QHSUSB_BULK 9008 device (or something). install drivers and check which COM port it is connected. it is important that you see 9008 otherwise we have to find another method to reboot into EDL mode

[IMG="Qualcomm HS-USB QDLoader 9008 Driver"]https://www.xiaomigeek.com/wp-content/uploads/2017/06/QHD-Loader-Device.png[/IMG]

next week i have time 5-9 pm GMT (daily) but i will answer from mobile while at work
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
[MENTION=4646731]Alecxs[/MENTION] thank you so much again. So I have downloaded the driver zip file from here ( https://www.xiaomigeek.com/download-qualcomm-qdloader-usb-driver.html ) but after unzipping don't find any install option. Am I not suppose to install it first, and then attach the driver with the device from device manager?
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
when I connect the device when it's on, I see Portable Devices-Redmi Note 4

when I connect it in recovery mode, I see Universal Serial Bus Devices- ADB Interface

when I connect in fastboot mode, I see Android Phone- Android Bootloader Interface
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
5pm GMT works perfect for me. I will be online then and am also online till I fall asleep now

PS. I have mentioned above what I see in device manager when phone is connected in different modes. Not sure why screenshots wouldn't attach
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
the EDL mode is 4th mode along with the 3 modes listed above

first you must enter EDL mode, then assign the driver to the unknown device. just follow the steps 7-11. navigate to the folder where qcser.inf is located, and manually select qcser.inf - i am sure you will handle it ;)

another method to boot into EDL mode is disassembly. remove the sim tray and back cover with a guitar pick. watch the first minute of this or this (i know, not the best method, be careful)

- disconnect the battery, it's the connector aside the 5 points on the right

- connect usb cable to pc

- short circuit the 1st + 4th point with a paper-clip (from left to right)

- connect the battery

- install 9008 drivers

for more details watch this video
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
:):o:D;):p

where is the "I am feeling so dumb I wanna hide my face" emoji :D:D
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
it's learning by doing.. everyone who follow this thread, we all still learning.. even now we are learning with you..

i wish i could understand alephsecurity tool "firehorse" because it supports mido, but i didn't find time yet
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
Thank you :) Any other alternatives we can try without dissembling the phone? Let's go there as the last option?

I would have tried dissembling if that's all that was required but the short-circuiting part is making me uncomfortable about it
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
yes, you can short circuit pin 3+5 on your micro usb connector with an electrical pushbutton. easiest way is to cut a cable and unravel wires. you can buy such a cable, too

[IMG="deep flash cable"]http://xiaomitips.com/media/2016/08/Deep-FLash-Cable-Architecture-680x318.jpg[/IMG]
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
Before this, anyway to check to be sure if my device in QComm or MTK? Because what we are attempting won't work on MTK right?
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
try 'fastboot getvar all' maybe this gives enough information. otherwise check for mtk preloader VCOM in windows device manager, which comes up for only a second when connecting usb cable while completely powered off
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
Here, this is what I get from fastboot getvar all
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
this is Mediatek. forget this thread. you can open new one, i will find your user name
[Xiaomi Redmi Note 4 Questions & Answers] BushraXiaomi:
Opened a new thread adding the word 'Mediatek' in title
[Xiaomi Redmi Note 4 Questions & Answers] darkmaster566:
Hey [MENTION=4646731]Alecxs[/MENTION],

I have a Redmi Note 4, Qcom with exact same issue.

My phone doesn't boot into EDL mode. I will disassemble the phone and try the pins you mentioned. What after having the device in EDL mode?

What's the next step?

---------- Post added at 03:13 AM ---------- Previous post was at 03:13 AM ----------

Hey [MENTION=4646731]Alecxs[/MENTION],

I have a Redmi Note 4, Qcom with exact same issue.

My phone doesn't boot into EDL mode. I will disassemble the phone and try the pins you mentioned. What after having the device in EDL mode?

What's the next step?
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
steps on 1st page with all it's warnings, everything untested

even the test point seems to be wrong according to this answer

https://android.stackexchange.com/a/224700
[Xiaomi Redmi Note 4 Questions & Answers] darkmaster566:
[MENTION=4646731]Alecxs[/MENTION]

Can you please help me with the initial steps?

- prepare twrp.img (you must patch twrp manually)

- prepare splash.img

- prepare hack_splash.xml (tricky/dangerous)

- prepare twrp.xml (tricky/dangerous)
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
you can download files post #19
[Xiaomi Redmi Note 4 Questions & Answers] darkmaster566:
[MENTION=4646731]Alecxs[/MENTION]

Thanks for the file. I am now stuck on the below steps:

- initialize firehose connection with QSaharaServer.exe

- flash splash.img with fh_loader.exe

- flash twrp.img with fh_loader.exe

Apologies for the noob questions but how do I initialize firehose connection with QSaharaServer.exe. If I double click on QSaharaServer.exe file from twrp-hack zip file, nothing happens.
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
i am a noob, you have to figure out yourself
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
sounds like Xiaomi has fixed this vulnerability or it does not work for this device. or i made mistake when PATCHING files. or the splash.img used is not matching your ROM version. you need test point for exit HS-USB Diagnostics 900E and switch into QDLOADER 9008 mode. you need original spash.img and recovery.img for getting previous state.

here is a list of different versions (you need the fastboot variant)

https://xiaomifirmwareupdater.com/archive/miui/mido

another method

try to dump the full userdata partition with edl.py. after this you can reset your device and unlock bootloader with official method. after device is unlocked you should have no problems with twrp and can restore the partition dump
[Xiaomi Redmi Note 4 Questions & Answers] darkmaster566:
Would backup of userdata partition also backup the pattern lock? And restoring the partition restore the pattern lock? Then it will bring me back to square one. There are available guides to remove patterns from unlocked phones but again, none have any success reports.

Also, would backup and restore of userdata partition save the media files like images? That's the whole point in going through the whole process, to save images.. ?
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
yes it will restore pattern. if your device is encrypted with login credentials you must not delete locksettings.db, your only chance is bruteforce pattern. on the other hand most xiaomi devices simply encrypted with FDE default_password. TWRP or OrangeFox or Redwolf can decrypt userdata without asking for pattern and you can backup pictures /data/media

the hack probably fails because splash.img cheat doesn't break splash_screen_mmc, or verify_image_with_sig is called because wrong offset for 0x30 0x83 0x19 0x89 0x64, therefore (unsigned) twrp recovery can not pass secure boot. if your device have vbmeta partition you could flash modified vbmeta.img (at least for samsung devices this is how to disable AVB)?

another method: i wonder you can flash (avb-signed) boot-insecure that would give you full adb access. i know it works with locked bootloader on Mediatek devices even with secure boot enabled, in theory may work for you too?

(please note the files uploaded are from MIUI V9.0.5.0 if your ROM version differ you must modify for your own)
[Xiaomi Redmi Note 4 Questions & Answers] darkmaster566:
[MENTION=4646731]Alecxs[/MENTION]

Can you give me more info on bruteforce pattern?

I have no knowledge of altering img files. Modifying them on my own wont be possible. If I see a video tutorial on how it needs to be done or basic logic on editing them, i can then do it on my own.

The problem with my phone is the pattern file in the database is corrupted as I'm using the same pattern i was using since many months. One fine day, device rebooted and I'm no longer able to unlock the phone. I dont even remember which firmware version i was on. Any command to check?
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
bruteforcing pattern is just idea, i don't have any useful tutorial. you can do it "online" on the working device with usb-otg adapter and microcontroller like teensy. or you can do it "offline" (but only on the device itself) from adb with a little script while in TWRP via twrp command line

upload dump of your current boot.img i can modify it. or you do it yourself

- first you need python

- then install requirements. open cmd.exe as administrator and type

pip3 install pyusb pyserial docopt pylzma pycryptodome

- dump boot.img in EDL mode

python edl.py r boot boot.img

- set Advanced settings -> both checkboxes in magisk manager (any android device)

- tap install - install - select and patch file - select boot.img

- the resulting magisk_patched.img unpack with AIK (drag & drop)

- now you have a folder ramdisk, there do the following mods in default.prop

persist.sys.usb.config=mtp,adb
ro.secureboot.devicelock=0
ro.debuggable=1
ro.adb.secure=0
ro.secure=0

- repack the magisk_patched.img with AIK and flash into boot partition

- boot the device and check if you have adb access

adb devices
adb pull -a /sdcard

the version of your current ROM is in default.prop ro.bootimage.build.fingerprint.

to keep the right line-endings (LF instead CRLF) in linux files better use notepad++
[Xiaomi Redmi Note 4 Questions & Answers] darkmaster566:
Thanks, I'll try this and update with any success
[Xiaomi Redmi Note 4 Questions & Answers] darkmaster566:
[MENTION=4646731]Alecxs[/MENTION]

I am trying to dump userdata and boot file from the phone while in EDL mode but no luck yet.

I have installed python with the steps you provided and initialted command

Code:

pip3 install pyusb pyserial docopt pylzma pycryptodome

Everything successfully installed but where should I initiate the command

Code:

python edl.py r boot boot.img

Do I need to initiate a connection to phone via python with some command?
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
you are right. i never used this tool and the documentation isn't noob friendly. maybe at first step you need to copy & rename firehose programmer in loaders folder. there is a helper script fhloaderparse.py you can try. second step i missed you probably must initialize connection (with edl.py server?) please try the help option -h and report back once you figured out

edit: someone posted working instructions (thx @ Filip)

https://android.stackexchange.com/q/226838
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
try edl.py from linux

edit: see chat on that question for install instructions

https://android.stackexchange.com/q/236471
[Xiaomi Redmi Note 4 Questions & Answers] thunux:
Thanks for your reply. I will try the instructions you mentioned above and report any results.
[Xiaomi Redmi Note 4 Questions & Answers] thunux:
I tried steps from https://android.stackexchange.com/q/236471 but no results, when I check "erase frp" on menu "Xiaomi", the MRT do nothing just beep sound.

Edit: I tried using menu "QC_Tool", check "erase frp", mrt run but after reboot, pattern lock is still there.

Edit 2: Still trying steps on chat to use edl.py
[Xiaomi Redmi Note 4 Questions & Answers] alecxs:
(FRP) factory reset protection means bonding mi account/ google account (after factory reset device becomes unusable and requires unlocking) - not related to pattern unlock

first thing you should do is backup userdata partition to PC. report back
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] Guyinlaca:
The S10 and Note 10 had wildly fluctuating reception compared to the Note 9. For those who've used the S20 Ultra, is reception better than the 10 series?

dBm reading comparisons or real life speeds are preferred over signal bar readings.
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] le0.br4zuc4:
I never measured reception with any of my phones but I didn't find I had a hard time sometimes at home with my S10+. On my Ultra, I have 0 issolues so far. I'm getting full bars and only got 2 bars on my S10+.

I never measured the signals so I can't really give you a better answer. My carrier is VZW btw.
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] paras:
For me my s10 plus is overall ok in terms of reception and wifi calling solves my problem anyway at home cause at home the reception is bad.

Sent from my iPhone 11 Pro Max
[Google Pixel 3 XL Questions & Answers] Daisymae:
Trying to patch boot.img with Magisk on March update. I check "select and patch..", select boot.img and it says "lets go". When I click on that Magisk closes and nothing happens. No magisk_patched.img is created. Anyone else have this problem?
[Google Pixel 3 XL Questions & Answers] Homeboy76:
What do you mean when you say you "checked

select and patch'? Do you mean you opened Magisk Manager tapped install (next to Magisk),tapped install, tapped select a boot image to patch. Selected it and tapped the check mark? If yes, try again.
[Google Pixel 3 XL Questions & Answers] Daisymae:
Tried it several times with same result. When I get to "method" I tap "select and patch". It immediately takes me to the download directory where the boot.img is. I tap that and it takes me back to the screen with the methods. I tap next and then "lets go" appears.. I tap that and it closes. Nothing happens.

Update: found the problem. It was a canary magisk manager. DL the stable one and patched image was created.
[Google Pixel 3 XL Questions & Answers] TonikJDK:
Had exactly the same thing today. I cleared cache and data on Magisk Manager, uninstalled it and then reinstalled. Worked fine after that. Might be able to skip the uninstall step, I just do things that 2ay to be complete. Make sure you get the APK from a legit source, there are fakes out there.

Ahhh, just saw the post above. Yep I was on Canary and when I reinstalled I went back to stable.
[Google Pixel 3 XL Questions & Answers] wangdaning:
Yes, it is a bug in the latest canary magisk manager. It should be fixed in next canary release.
[Google Pixel 3 XL Questions & Answers] rspkt:
Stable version roots fine so that's an option until canary builds are fixed.
[Google Pixel 3 XL Questions & Answers] parakleet:
Beta works without issue as well.
[Google Pixel 3 XL Questions & Answers] imaverik:
Where is DL for APK...
[Google Pixel 3 XL Questions & Answers] Homeboy76:
https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445/
[Google Pixel 3 XL Questions & Answers] imaverik:
thx!
[Google Pixel 3 XL Questions & Answers] Homeboy76:
You're welcome! :)