vrr/bootloader-unlock-wall-of-shame
2
0
Fork 0
mirror of https://github.com/zenfyrdev/bootloader-unlock-wall-of-shame.git synced 2026-10-15 00:33:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
bootloader-unlock-wall-of-s.../brands/xiaomi/README.md
TheEnby 4d2872a52b
Doesn't *Officially Support*
2026-09-23 23:21:07 -04:00

10 KiB
Raw Permalink Blame History

Xiaomi/Redmi/POCO

  • Verdict: 🍅 Just terrible!
  • Verdict: ⛔ Avoid at all costs! (Unisoc)

In the past, Xiaomi allowed most of its devices to be unlocked after a period of 7+ days (depending on how new the device is).

With the launch of Xiaomi's new Android fork, HyperOS, they have introduced a number of changes to the unlock process, with new device limits and Mi Account requirements.

Unisoc devices will never be officially bootloader unlockable, this is not Xiaomi's fault, Unisoc doesn't officially allow bootloader unlocking.

Android One

Devices shipping with Android One do NOT have any unlock requirements listed below. They follow the standard Android unlock process.

Device unlock requirements

Devices shipping with MIUI or HyperOS require activating your phone with Xiaomi servers before allowing unlocking. You can only unlock one phone in 30 days and four phones in a year.

After enabling Developer options, go to Settings > Additional settings > Developer options, enable OEM Unlock and go to Device Unlock Status page, and if it shows "Locked" then you can proceed pressing "Add account and device" button to initiate the process.

Doing this won't unlock your device immediately, but will grant you permission to unlock in the end. So, to be eligible for unlocking, you will be asked to perform these steps.

Xiaomi will let you know what is required right now when you press "Add account and device", but to explain fully in order, it tells you to do:

  • Your device linked with a Xiaomi Account that is in a good standing (even better if it is not a recently created account)
  • A SIM card inserted in with an active data plan (if device has SIM slot)
  • Wi-Fi is disabled and mobile data is enabled (if device has SIM slot)
  • If running HyperOS:

When you complete all above steps, pressing "Add account and device" button now should say "Added successfully" message.

To actually perform the unlocking, you will need to use Mi Unlock tool for Windows and follow prompts to enter fastboot mode and connect your device. If you cannot or don't want to use official tool, you can also use alternative tools such as offici5l's MiUnlockTool made in Python.

The unique key to unlock the bootloader of your device is retrieved from Xiaomi servers, but there is a server-side (thus no tool can bypass server time) countdown that will start running only after completing all steps above. In most cases, the countdown is 3 days (= 72 hours) for HyperOS and 7 days (= 168 hours) for MIUI, but there are some reports of people being forced to wait even longer, such as 14 or 30 days instead.

You can continue using your device as usual and check with the unlock tool anytime to see how much time is left. Meanwhile, DON'T remove your Xiaomi account or factory reset your phone, doing these may result in the countdown being reset to what it was initially.

Note

For MIUI devices (not HyperOS), some channels on Bilibili claim that that Xiaomi verification server has been shutdown.

HyperOS specific

It is currently impossible to officially unlock Xiaomi phones from the China region, especially if the device was imported and you are outside China. They have removed the unlocking function in their community app.

With HyperOS, Xiaomi introduced an additional step to the unlock process. You can make the request for unlocking the device inside Developer Options, only after you have made another separate successful request inside the Xiaomi Community App.

For the international version you can request unlocking in their Community App at 00:00 Beijing (Chinese) GMT+8 time.

The requirements for the Community App request are as follows:

  • Your Mi Account has been active for more than 30 days.
  • Xiaomi Community App version 5.3.31 or above.
  • As of January 1st, 2025, Xiaomi only let you unlock 1 device per year. This requirement has also been extended to MIUI 14.
  • Make sure to select "Global" region in Xiaomi Community app to see "Unlock bootloader" section under "Me" tab.

Additionally, on XDA forums people have found that there is a cap on the number of people (believed to be around 50 people) who can request per day inside the Community App, and it gets filled pretty much instantly, so your only chance to make a successful request there is if you get lucky spamming the request at midnight, Beijing time (GMT+8).

There is a AQLR (abbreviation of "application quota limit reached") script to do that automatically, so it would send a request to Xiaomi just before entering a new day in China, and you can have your computer running that script 7/24.

Warning

Even if it appears like you missed today's quota, Xiaomi may report "application quota limit reached" by mistake even though you actually placed in the quota. So the only way to be sure about that is by pressing "Add account and device" on the Device Unlock Status page in Settings.

Workarounds & Exploits

Snapdragon 8 Elite/8Gen3/8Gen2/8Gen1

All of those methods chain the QCOM SELinux bypass, and the Xiaomi MQSAS service privilege escalation vulnerabilities.

  • Xiaomi 17 series, POCO F8 Ultra, Redmi K90 Pro Max with Security Patch before February 2026, see here
  • Xiaomi 13, 14, 15 series, MIX Flip 2, Pad 8 Pro, Pad 6S Pro, Redmi K90/K80/K70/K60 Pro with Security Patch before January 2026, see here

It's theoretically possible to downgrade and unlock non Kioxia UFS devices using an EDL programmer and an engineering ABL too.

MSM89xx

EDLUnlock, an EDL unlock tool for Xiaomi Mi A1 and maybe all MSM89xx manufactured before 2018.

Others

  • MlgmXyysd - MlgmXyysd, the developer of the original bootloader bypass script, has discovered a new vulnerability in Qualcomm devices that enables bootloader unlocking on most HyperOS 2 and 3 phones. You may contact her on CoolAPK; according to some sources.
  • Some users claim that visiting a Xiaomi store and asking a technician to downgrade the system version results in a temporary unlocked state. A few reported flashing their own system during this process.
  • HyperSploit is the newer option. This is a simple to use program with no external dependencies. Confirmed as patched as of HyperOS version 2.0.203.0. Still works on old versions.
  • Xiaomi-HyperOS-BootLoader-Bypass is the original proof of concept, but it's written in PHP and it's cumbersome to set up. Same as above.

Further reading

And, Xiaomi's "reasoning" on why they do this:

Isn't locking the bootloader against Xiaomi's 'geek' spirit?

Locking the bootloader is aimed to provide a better user experience, which we've been trying to do the whole time. In the meantime, we've provided an unlocking tool for senior users who know their ways around flashing and tweaking their devices.

The unlocking procedure will need internet access to get the unlocking password. Also, the Xiaomi Account logged in on the Xiaomi phone and the unlocking tool needs to be the same. Otherwise, the unlocking request will be denied. This will ensure that ill-intentioned people will not get access to your personal data.

Updated info provided by n1ses & Crimson Fork/🌌🏳️‍⚧️&ΘΔ & Mluo2011 & ysfchn
Authored by zenfyr.