Skip to content

v1.0.0 — Initial public release

Choose a tag to compare

View all tags
@Jz8Root Jz8Root released this 16 May 19:53
· 27 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.0.0
d906580

First public release of the HyperOS/MIUI14+ bootloader unlock method, reverse-engineered from the Little Kernel bootloader and proven with RPMB dumps.

The problem this solves

Since MIUI 14.0.3 and HyperOS, mtkclient da seccfg unlock reports success but the bootloader remains locked after reboot. This bug has been open in mtkclient for 2+ years across multiple Xiaomi MediaTek devices (#81, #764, #1219, #1405).

Root cause: Xiaomi added a second lock layer in RPMB that overrides seccfg.
The fix: erase the RPMB magic — the LK then falls back to seccfg, which mtkclient can write to UNLOCK.

What's in this release

  • Full technical writeup (README.md) — root cause analysis, dual-layer lock mechanism, the 3-command unlock method
  • Ghidra decompilation proof (proof/VERIFICATION.md) — decompiled mi_check_magic function, RPMB before/after dumps with SHA256, mtkclient source audit
  • scan_lk.py — LK binary compatibility scanner with 0-100% verdict scoring
  • Device compatibility database (COMPATIBILITY.md) — Tier 1-4 device classification
  • GitHub issue template for structured community device reports
  • AGPL-3.0 license

Tested on

Device Codename SoC Firmware Result
POCO M4 Pro 4G fleur MT6781 HyperOS OS1.0.11.0.TKEEUXM Unlocked, persistent

Quick start

git clone https://github.com/Jz8Root/xiaomi-hyperos-bootloader-unlock
cd xiaomi-hyperos-bootloader-unlock

# Scan your LK binary first
python3 scan_lk.py /path/to/lk_a.img

# Then follow README.md → "The Method — 3 Commands"

Warnings

  • Backup RPMB and NV partitions before anything
  • This wipes your data (factory reset on first boot after unlock)
  • BROM V6 (MT6789+) is patched in hardware — this method won't work
  • Only HyperOS 1 has been verified — HyperOS 2/3 untested
  • Voids manufacturer warranty

Help wanted

If you successfully unlock another device, please file a Device Test Report. Each successful report expands the compatibility database for everyone.

Links

Credits

  • bkerler/mtkclient — Xiaomi MTK BROM + DA framework
  • The Kamakiri exploit researchers
  • Everyone who reported the seccfg bug on GitHub — your reports helped map the scope

Researched & tested by Jz8root.

Assets 3
Loading