[Xiaomi Redmi Note 7 Questions & Answers] hoax2005:
Hello!

I've recently got a problem with my Redmi Note 7. Rebooted the phone after network not being available and suddenly got greeted by "The system has been destroyed" screen.

Last time i updated it was in 2020 (found update logs), ROM version is V11.0.6.0.PFGMIXM, never tried to flash anything on my own before, so bootloader locked.

I want it to boot and hopefully backup my unencrypted data. I remember my graphic key and etc.

Stock recovery doesn't boot, fastboot mode working, but it's no use since bootloader is locked.

I made full backup in EDL mode

.\fh_loader.exe --port=\\.\COM9 --convertprogram2read --sendimage=LUN0_complete.bin --start_sector=0 --num_sectors=61071360 --sectorsizeinbytes=512 --lun=0 --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc

compared vbmeta and vbmetabak partitions from downloaded image with stock vbmeta.img from lavender_global_images_V11.0.6.0.PFGMIXM_20200514.0000.00_9.0_global_861a3f2950, they are identical (SHA512 hash 67 76 5b 11 13 c6 5a 85 c9 5b 0a f5 f5 7c 8d 6f 63 90 23 15 09 0f c3 3c 55 ea 24 52 c9 63 23 bc 80 13 50 a5 15 f6 ca 1b 29 9d d7 6d c9 0b 3f 14 36 12 13 4c fb 57 a7 31 5e 1a c7 fb 33 fe 0e dc).

boot partition also identical to stock boot.img

compared GPT structure of it with gpt_main0.bin from said lavender_global image and it's also the same.

Problem seems to lie here (boot messages from UART testpoint):

UEFI Total : 2929 ms
POST Time [ 3812] OS Loader
Loader Build Info: May 13 2020 23:00:59
VB: RWDeviceState: Succeed using rpmb!
KeyPressed = (0x9CE64000)
Reboot reason: 0
LAVENDER Platform version : 0x20000
Booting Into Mission Mode
avb_slot_verify.c:432: DEBUG: Loading vbmeta struct from partition 'vbmeta'.
Partition found: vbmeta
avb_slot_verify.c:653: ERROR: vbmeta: Image rollback index is less than the stored rollback index.
Non Multi-slot: Unbootable entering fastboot mode
VB2: boot state: red(3)
Display menu is not enabled!
Your device is corrupt. It can't be trusted and will not boot.
Your device will shutdown in 30s

fastboot getvar anti giving me answer: anti: 4

This stock ROM also have antirollback version 4 (set CURRENT_ANTI_VER=4 in flash_all.bat), so i don't get it why rollback protection trips, especially considering vbmeta partitions are exactly the same as stock.

I've tried flashing empty vbmeta in EDL mode and empty vbmeta signed with a random private key and it reacts to it in a correct way:

avb_slot_verify.c:432: DEBUG: Loading vbmeta struct from partition 'vbmeta'.
Partition found: vbmeta
avb_slot_verify.c:544: ERROR: vbmeta: Error verifying vbmeta image: OK_NOT_SIGNED

avb_slot_verify.c:432: DEBUG: Loading vbmeta struct from partition 'vbmeta'.
Partition found: vbmeta
avb_slot_verify.c:627: ERROR: vbmeta: Public key used to sign data rejected.

So, currently i hit the wall and don't know what else to try. Can't find exact avb_slot_verify.c source file with debug messages on correct lines, so i have no idea what's going on in here. And searching in internet seems like nobody really encountered this exact situation.

If only there was signed empty vbmeta or private key with sha fingerprint of b2a02f1e56e366d727a1a8e089762fe0b91bbc84, so i can bypass verified boot but it's very unlikely.

Can anybody help or provide informed advice on what to try?