Mastodon

TheMasterArchiver

Xiaomi Redmi 9 IMEI restoration

This guide requires Microsoft Windows to follow
This procedure will wipe all data on the device
This guide requires disassembling the device
This guide requires modifying the device's hardware

This guide is based on this guide on 4pda

Downloads
  1. Download the engineering firmware
  2. Download MIUI v12.0.1
  3. Download the restoration tools

Removing write-protection
  1. Remove the SIM tray
  2. Remove the back panel (You can insert a plastic card like this to go around corners)
  3. Write down the IMEI written on the sticker
  4. Unscrew all the screws from the top plastic panel
  5. Unplug this ribbon cable
  6. Remove the top plastic panel
  7. Remove the motherboard from the casing by carefully lifting it with a flat-head screwdriver
  8. Turn the motherboard around and remove this metal lid. Be careful not to bend it too much
  9. Bend the metal casing upwards. Try to not crease it like I did
  10. Remove this component using something sharp. (For me it was more destroyed than removed)
  11. Bend the metal casing back into place and put everything back together

How to use MTKSecBypass

 Every time I ask you to do something "with bypass", you should do the following:
  1. Run MTK-Auth-Bypass-Tool-V13.rar/mtksecbypass_v13.exe
  2. Press "Disable Auth"
  3. Plug in the device while it's powered off holding both volume buttons
  4. If the device is not detected try installing MTKClient from mtkclient-2.0-beta.exe

Flashing the ENGROM
  1. Unpack SP_Flash_Tool v5.20020.rar
  2. Run SP Flash Tool (flash_tool.exe, with bypass)
    • Tab: "Format"
    • Auto format Flash: On
    • Format whole flash except bootloader: On
    • Start
  3. Run SP Flash Tool (with bypass)
    • Tab: "Download"
    • Download-agent: SP_Flash_Tool/DA_6765_6785...
    • Scatter-loading File: ENGROM.rar/images/MT6768_Android_scatter.txt
    • Authentication File: empty
    • Mode: Download Only

Cracking the vbmeta
  1. Install MTK Client from mtkclient-2.0-beta.exe
  2. Open MTK Client
    • Juggle with it a bit until the phone connects. I found that opening a second instance of MTK Client helps it connect. Reconnection the phone on the "Preloader VCOM" step also helps
  3. Flash Tools > Unlock bootloader
    • MTKClient Log should contain messages from sej. If it does not, you must repeat this section
  4. Reboot into fastboot (power+volume down)
  5. Run fastboot flash --disable-verity --disable-verification vbmeta ENGROM/images/vbmeta.img

Fixing NVRAM WARNING
  1. Boot into the system
  2. Open the dialer app
    • Dial *#06# (no IMEIs should be present)
    • Dial *#*#3646633#*#*
  3. In the special menu
    • Connectivity (swipe left) > CDS Information > Wi-Fi Information > UPDATE MAC

Flashing the IMEIs
  1. Install MAUI Meta from MauiMETA<...>.zip/MauiMETA<...>.exe
  2. Open MAUIMeta and press Connect
  3. Power off the phone (while plugged in)
  4. Wait for MAUIMeta to connect
  5. In MAUIMeta
    1. Load DB > From Target
    2. Search > "IMEI Download"
      • IMEI1: Your IMEI without the last digit (it is the "checksum")
      • IMEI2: IMEI1 + 1
    3. Disconnect. The phone should boot automatically
  6. Confirm that the IMEIs are there by dialing *#06#
  7. Confirm that you can make phone calls
  8. Power off

Flashing MIUI
  1. Run SP Flash Tool (don't connect the phone yet)
    1. Go to tab: "Download"
    2. Scatter-loading File: lancelot_global_images<...>/images/MT6768_Android_scatter.txt
    3. Go to tab: "Readback"
    4. Press: "Add"
    5. Double-click on the value in the "File" column
    6. Name the file "dump.img"
    7. Enter the following values:
      • Address: 0x0
      • Length: 0x50400000
    8. Press "Read Back"
    9. Connect the (powered off) phone
  2. Extract the dump.img file with 7-Zip (it will raise errors)
  3. Extract NV.zip into NV/
  4. Copy the files with ids 10,11,14,15,16,17,18,21,35,36 from dump/ to NV/
  5. Remove the numbers (and the dot after the numbers) from all filenames in NV/
  6. Run SP Flash Tool (with bypass)
    • Tab: "Format"
    • Auto format Flash: On
    • Format whole flash except bootloader: On
    • Start
  7. Run SP Flash Tool (with bypass)
    • Tab: "Download"
    • Download-agent: SP_Flash_Tool/DA_6765_6785...
    • Scatter-loading File: NV/MT6768_Android_scatter.txt
    • Authentication File: empty
    • Mode: Download Only
  8. Run SP Flash Tool (with bypass)
    • Tab: "Download"
    • Download-agent: SP_Flash_Tool/DA_6765_6785...
    • Scatter-loading File: lancelot_global_images<...>/MT6768_Android_scatter.txt
    • Authentication File: empty
    • Mode: Download Only
  9. Be sure to remove the SIM card or it will try to update
  10. Reboot
  11. You can now unlock the bootloader as shown before