Skip to content

v2.0.0 — 6 devices, 3 SoCs, full HyperOS lifecycle

Choose a tag to compare

View all tags
@Jz8Root Jz8Root released this 22 Jun 11:16
· 22 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.0.0
8965420

Community expansion release: 6 hardware unlocks confirmed across 4 SoCs, covering the full HyperOS lifecycle (1, 2, 3). New SoC-specific RPMB sector discovery, A/B slot divergence after OTA documented, and community-contributed improvements.

What's new since v1.0.0

  • 5 new Tier 1 devices proven on hardware by community testers
  • RPMB sector is SoC-specific — MT6781/MT6769Z = 57344, MT6833 = 65504. Always grep before erasing. (Discovered by KTS618)
  • lk_a ≠ lk_b after OTA — slot A and slot B can carry different LK builds. Always scan both. (Discovered by piotrurban)
  • HyperOS 1 + 2 + 3 confirmed — the RPMB lock mechanism is consistent across all HyperOS generations
  • Step 0 added — mandatory sector discovery via grep -boa "Jz8PNRUF" rpmb_dump.bin
  • Linux pre-flight documented — ModemManager kill + kernel module unload (PR #6 by miromraz)
  • scan_lk.py as decision gate — README restructured to route users through the scanner first (PR #5 by miromraz)
  • Windows struct.error FAQ — documented USB bulk driver limitation + WSL2 / Live USB workaround
  • Boot flow diagram — mi_check_magic() decision tree added to README

Tested on

Device Codename SoC Firmware RPMB Sector Result Tester
POCO M4 Pro 4G fleur MT6781 HyperOS 1.0.11.0 57344 Unlocked, persistent Jz8root
Redmi Note 11 4G fleur (2201117SY) MT6781 HyperOS 1.0 — Unlocked (Path B, seccfg only) miromraz
Redmi Note 11S Global miel MT6781 HyperOS 1.0.9.0 57344 Unlocked, persistent ITSME
Redmi Note 11S miel MT6781 HyperOS 1.0.9.0 57344 Unlocked, persistent kwhj4ff67r-crypto
Redmi Note 13 5G gold MT6833 HyperOS 3.0.9.0 / Android 15 65504 Unlocked, persistent KTS618
Redmi 12 fire MT6769Z HyperOS 2.0.207 57344 Unlocked, persistent piotrurban

Quick start

git clone https://github.com/Jz8Root/xiaomi-hyperos-bootloader-unlock
cd xiaomi-hyperos-bootloader-unlock

# Step 0: Scan your LK binary (scan BOTH slots)
python3 scan_lk.py /path/to/lk_a.bin
python3 scan_lk.py /path/to/lk_b.bin

# Step 0b: Find your RPMB sector (do NOT skip)
python3 mtk.py da rpmb r rpmb_dump.bin
grep -boa "Jz8PNRUF" rpmb_dump.bin
# sector = byte_offset / 256

# Then follow README.md → "The Method — 3 Commands"

Warnings

  • Backup RPMB and NV partitions before anything
  • This wipes your data (factory reset on first boot after unlock)
  • BROM V6 (MT6789+) is patched in hardware — this method won't work
  • RPMB sector is NOT universal — always grep the dump first. Sector 57344 is only confirmed for MT6781/MT6769Z. MT6833 uses 65504.
  • Scan both LK slots — after an OTA, lk_a and lk_b can diverge
  • Use Linux for the RPMB erase step — Windows USB drivers cause struct.error
  • Voids manufacturer warranty

Help wanted

If you successfully unlock another device, please file a Device Test Report. Each successful report expands the compatibility database for everyone.

Priority targets: Redmi 9A/9C (MT6762), Redmi 12C (MT6765/MT6769) — issue #81 has been waiting since 2021.

Links

Credits

  • bkerler/mtkclient — Xiaomi MTK BROM + DA framework
  • The Kamakiri exploit researchers
  • miromraz — PR #5 (README restructure), PR #6 (Linux pre-flight), Path B confirmation, SK Hynix RPMB layout
  • KTS618 — MT6833 sector 65504 discovery, first HyperOS 3.0 confirmation
  • piotrurban — lk_a/lk_b OTA divergence discovery, first HyperOS 2.0 confirmation
  • ITSME — first independent hardware confirmation (miel)
  • kwhj4ff67r-crypto — miel replication
  • Everyone who reported the seccfg bug on GitHub — your reports helped map the scope

Researched by Jz8root. Community tested.

Assets 3
Loading