[POCO M3 Pro / Redmi Note 10 / 10T 5G] blazerface:
BY FOLLOWING THIS GUIDE, YOU RISK BRICKING YOUR DEVICE, AS WE ARE UTILIZING AN EXPLOIT - ANYTHING CAN HAPPEN

YOU WILL !!FORSURE!! LOSE YOUR USER DATAON YOUR DEVICE

THE MOMENT YOU UNLOCK THE BOOTLOADER, YOU KISS YOUR WARNITY GOODBYE!!

So you got a phone from THAT family member/friend. He forgot his password and resorted to resetting the phone, only to discover its locked by his MI account, or Google Account, which he has also forgotten his password for

Well he is in luck, because mediatek's SOCs have a download mode (BROM mode) in which we can utilise an exploit to have full control over the devices storage. We can use it to unlock the bootloader and from there we can do LOTS of stuff, including flashing a custom ROM so the phone is usable again

The following instructions assume you are using Windows (i used windows 10 iot ltsc 2019) and a phone with a mediatek chip that is susceptible to the exploit. The phone i tested was Redmi Note 10 5G and the custom rom i have linked below is for it.

The Redmi Note 10 5G isnt the only phone susceptible to the exploit, there are many others and in theory you can do all of this in linux, but it requires a kernel patch, so i just did it on a windows box because i couldnt trust running a prebuilt kernel on my main system.)

1. INSTALL PYTHON - The programs we will be using require python: https://www.python.org/downloads/ . I used version 3.12.3

The installation is pretty straight forward, you have to check "Use admin privileges when installing py.exe"(To install it for all users) and "Add python.exe to PATH"(So you can use it as a command in CMD)

You can do the automatic installation, but if you want to change where python installs, or any of the components, feel free to press on "Customize installation". The install takes 5 minutes and at the end press on "Disable path length limit".

2. USE PIP TO INSTALL:

pip is the package manager for python. You can use it in CMD.

Package Version

------------------ -----------

colorama 0.4.6

json5 0.9.25

mock 5.1.0

pip 24.0

pycryptodome 3.20.0

pycryptodomex 3.20.0

pyserial 3.5

PySide6 6.7.0

PySide6_Addons 6.7.0

PySide6_Essentials 6.7.0

pyusb 1.2.1

shiboken6 6.7.0

usb 0.0.83.dev0

wheel 0.43.0

to install, open CMD in administrator mode and type in:

pip install colorama json5 mock pycryptodome pycryptodomex pyserial PySide6 PySide6_Addons PySide6_Essentials pyusb shiboken6 usb wheel

(I am not sure if all the packages are mandatory, but they are all small so it doesnt matter

The versions you install also shouldn't matter, i type them here for your information)

INSTALL USBDk

https://github.com/daynix/UsbDk/releases . I used version 1.0.22 (I will have the file down bellow in usbdrv.zip)

You just run the installer, there isn't really any confirmation at the end.

INSTALL and UTILIZE libusb:

We will use libusb to filter the phone so it can be exploited

https://sourceforge.net/projects/li...ibusb-win32-devel-filter-1.2.6.0.exe/download - i used version 1.2.6.0 and i will also have the file below in usbdrv.zip

You install the program litterally as any other. At the end check "Launch filter installer wizard"

Connect your phone

When the filter installer opens, choose "Install a device filter" and click "Next"

Choose the phone from the list (It should be apparent) and click install. After that it should disappear from the list, that means it has been filtered

You can close the program now

Download (pull) MTKClient:

head over to https://github.com/bkerler/mtkclient and click on the green button "Code", then press download ZIP (I will have the ZIP file i used down below)

(don't use whats in the releases page, it is outdated)

Unzip it anywhere

Open CMD as an administrator and go to the mtkclient-main extracted folder by using cd, there you will find the programs "mtk" and "mtk_gui"

Run mtk_gui with python by typing in CMD "python mtk_gui" (You can use the command-line based "mtk", but the gui will suffice)

Now you have to put the phone in BROM mode (Download mode). This was a trial and error process and personally i couldn't recreate it so i don't have any pictures to show.

1. Make the phone restart by holding the power button for 10 seconds

2. When the screen goes blank, connect the phone to your PC and start holding all the buttons down (vol up + vol down + power) (You might have to get it connected prior to that. Just thinker, i did it by chance)

3. At a point it should connect, you might have to stop holding down the power button at a point

If you see anything poping up on the screen (whether it be a recovery screen(The normal one, there also is one in Chinese one i stumbled upon), fast boot, boot screen where u can choose between them) it means you failed and you need to try holding the power button again and repeat the process

You should see "Phone connected" when you have it successfully in BROM mode and from the GUI u can navigate to the "unlock bootloader" button, press it and it does exactly that

You will see the "Your device is corrupt and cant be trusted" message when u reboot. that is normal for an unlocked bootloader and its a sign we were successfull, just press the power button to get past it and from there u can hold down the volume down button to go into fastboot and flash a new recovery, then a new custom rom

!!!Dont flash a MIUI rom if the device was locked to a MI account, Xiaomi stores the serial numbers of locked devices and will lock it again on internet connection, even after reflash!!!

Use a custom rom. An officialy supported custom rom for this device i recomend is https://projectelixiros.com/home.

You can follow their guide https://github.com/ProjectElixir-Devices/Wiki/blob/UNO/camellia.md and the downloads for the ROMs are on Sourceforge (the ones on Pling are broken as im writing this)

https://sourceforge.net/projects/project-elixir/files/fourteen/camellia/. i used version 4.1 of the ROM

And thats it, enjoy your unlocked phone, and think of a way to explain to your family member why its so different now.