Redmi Note 11 Pro unlock failed though every process was successful

[burg1ar]

Device model

Redmi Note 11 Pro

Codename

pissarrro

SoC

MT6877

Firmware version

HyperOS 1.0.18.TKTCNXM

Unlock result

FAILED — still locked after procedure

fastboot oem lks output

% fastboot oem lks
(bootloader) lks = 1
OKAY [  0.004s]
Finished. Total time: 0.004s

% fastboot getvar unlocked
unlocked: no
Finished. Total time: 0.000s

Commands used

% mtk da rpmb e --sector 57344 --sectors 4
% mtk da rpmb e --sector 122880 --sectors 4
% mtk da seccfg unlock

RPMB sector used

57344 and 122880

Persistent after reboot?

Yes — still unlocked after reboot

Additional notes

% python3 scan_lk.py lk_a.bin
[] Reading lk_a.bin...
[] Size: 8,388,608 bytes
[*] Scanning...
══════════════════════════════════════════════════════════
LK BINARY SCAN REPORT — MTKClient Unlock Analyzer
══════════════════════════════════════════════════════════

File size : 8,388,608 bytes (8.0 MB)
MD5 : a8e4516a303b77f925b1d938c227f518
SHA256 : c33b821983cca1f036d077e74226371e...

┌─────────────────────────────────────────┐
│ VERDICT: COMPATIBLE │
│ Score : 100/100 (100%) │
│ Method: RPMB erase (sector 57344) + sec│
└─────────────────────────────────────────┘

[MAGIC] Jz8PNRUF : ✓ FOUND
@ 0x000B32C8

[RPMB] Type : UFS_Samsung_0x400000
magic : 0x3FE0
lock_state_len : 0x40E0
signature_data : 0x41E0

[RSA] Modulus : ✓ FOUND
@ 0x000B3648
Key size: 2048 bits

[SECCFG] Version : generic

[FUNCTIONS] 7 detected:
✓ mi_check_magic: Checks RPMB magic — returns 0 (present) or 3 (absent)
✓ get_lock_state: Main lock state function — reads seccfg + RPMB
✓ seccfg_set_lock_state: Writes lock state to seccfg partition
✓ rpmb_read: Reads N bytes from RPMB
✓ rpmb_write: Writes N bytes to RPMB
✓ fastboot_oem_lks: Hidden fastboot OEM lock state commands
✓ verify_unlock_sig: RSA signature verification for unlock token

[FASTBOOT] 6 OEM commands:
✓ oem lks @ 0x000AB9A4
✓ flashing get_unlock_ability @ 0x000AB9E4
✓ flashing unlock @ 0x000AB9C4
✓ flashing lock @ 0x000AB9D4
✓ oem unlock @ 0x000AB9AC
✓ oem lock @ 0x000AB9B8

══════════════════════════════════════════════════════════
This device is compatible with the RPMB erase + seccfg unlock method. WARNING: sector 57344 is the default for MT6781 (Helio G96). On other SoCs (e.g. MT6833 Dimensity 6080 = sector 65504) the sector differs. Confirm your sector first: dump RPMB and run: grep -boa "Jz8PNRUF" rpmb_dump.bin
══════════════════════════════════════════════════════════
% python3 scan_lk.py lk_b.bin
[] Reading lk_b.bin...
[] Size: 8,388,608 bytes
[*] Scanning...
══════════════════════════════════════════════════════════
LK BINARY SCAN REPORT — MTKClient Unlock Analyzer
══════════════════════════════════════════════════════════

File size : 8,388,608 bytes (8.0 MB)
MD5 : 38e9bb71eb138d195fc3a31590bc5836
SHA256 : 6bcfa2eb9d24e50db0ea0b9b7f50168c...

┌─────────────────────────────────────────┐
│ VERDICT: COMPATIBLE │
│ Score : 100/100 (100%) │
│ Method: RPMB erase (sector 57344) + sec│
└─────────────────────────────────────────┘

[MAGIC] Jz8PNRUF : ✓ FOUND
@ 0x000B2D50

[RPMB] Type : UFS_Samsung_0x400000
magic : 0x3FE0
lock_state_len : 0x40E0
signature_data : 0x41E0

[RSA] Modulus : ✓ FOUND
@ 0x000B30D0
Key size: 2048 bits

[SECCFG] Version : generic

[FUNCTIONS] 7 detected:
✓ mi_check_magic: Checks RPMB magic — returns 0 (present) or 3 (absent)
✓ get_lock_state: Main lock state function — reads seccfg + RPMB
✓ seccfg_set_lock_state: Writes lock state to seccfg partition
✓ rpmb_read: Reads N bytes from RPMB
✓ rpmb_write: Writes N bytes to RPMB
✓ fastboot_oem_lks: Hidden fastboot OEM lock state commands
✓ verify_unlock_sig: RSA signature verification for unlock token

[FASTBOOT] 6 OEM commands:
✓ oem lks @ 0x000AB434
✓ flashing get_unlock_ability @ 0x000AB474
✓ flashing unlock @ 0x000AB454
✓ flashing lock @ 0x000AB464
✓ oem unlock @ 0x000AB43C
✓ oem lock @ 0x000AB448

══════════════════════════════════════════════════════════
This device is compatible with the RPMB erase + seccfg unlock method. WARNING: sector 57344 is the default for MT6781 (Helio G96). On other SoCs (e.g. MT6833 Dimensity 6080 = sector 65504) the sector differs. Confirm your sector first: dump RPMB and run: grep -boa "Jz8PNRUF" rpmb_dump.bin
══════════════════════════════════════════════════════════

% grep -boa "Jz8PNRUF" rpmb_dump.bin
14680064:Jz8PNRUF
31457280:Jz8PNRUF

[Jz8Root]

Sorry for the eleven day wait. Your report turned out to matter more than a single failure: you are one of four MT6877 cases, and together they led to finding the actual mechanism last night. It is documented now, and nothing about your device is at fault.

Two things went wrong, and both were my documentation's fault rather than yours.

1. The second erase was unnecessary and it hurt you

mtk da rpmb e --sector 57344 --sectors 4
mtk da rpmb e --sector 122880 --sectors 4     <- this one
mtk da seccfg unlock

Your grep returned two offsets, 14680064 and 31457280, and erasing both was the reasonable
thing to do with the information the README gave you. But they are not two copies of the magic.
They are one location seen twice: the address field in an RPMB frame is two bytes, so it wraps at
65536 sectors, and 122880 mod 65536 = 57344. The two hits are 16 MiB apart for exactly that
reason.

So the second command wrote to the same place as the first, and more importantly it added an extra
BROM re-entry cycle, which is where the real problem lives.

2. The Power button between commands, which the README told you to use

The preloader rewrites the RPMB magic on every start-up. Not LK, not HyperOS. Reaching the Mi
logo is enough. So anything that starts the phone between the erase and the unlock silently undoes
the erase, and nothing tells you.

Your run had three da commands, so at least two re-entry cycles between the erase and the
unlock. The README said to unplug and "force-off if needed" in that window, and on units that
reboot instead of powering off, that instruction is what destroys the work. By the time your
seccfg unlock ran, the magic was very likely back, so seccfg was written to UNLOCK while the
restored magic kept overriding it. Hence lks = 1.

This was established last night by @LucaCraft89 on rubypro/MT6877, same SoC as yours, with three
dumps: after the erase and a full cold BROM re-entry the magic was gone, and it only came back
after he powered the phone off with the buttons. Full detail in #13.

What to run

Two commands, not three, and no Power button at any point:

python mtk.py da rpmb e --sector 57344 --sectors 4
#   unplug, hold Vol+ and Vol-, replug. Do NOT touch the Power button.
#   No Mi logo, no vibration, no "FASTBOOT" text.
python mtk.py da seccfg unlock

fastboot getvar unlocked      # authoritative

Unplugging and re-entering BROM with the volume keys is safe, BROM runs but the preloader does
not. That part is proven.

If you want to confirm the erase held before spending the unlock, do it in a separate cold
session, never chained:

python mtk.py da rpmb r rpmb_check.bin
grep -boa "Jz8PNRUF" rpmb_check.bin

A chained da rpmb r reattaches to the live DA session and shows the magic gone whether or not
anything reached flash. That false positive is convincing and it fooled us for a while.

One more thing: if fastboot oem lks errors out afterwards, ignore it. It is a hidden OEM command
that some LK builds do not implement, and it returns EX_UNSUPPORTED_OPERATION on devices that
are genuinely unlocked. getvar unlocked is the one that counts.

Two things that would help the database

• your UFS or eMMC ID from the mtkclient log, the DAXFlash - UFS ID or EMMC ID line.
  rubypro is SK Hynix H9QT1G6DN6X132 and I want to know whether the four MT6877 reports share a
  storage part or only the SoC
• the result of the two-command run, either way

Your firmware is also useful on its own: HyperOS 1.0.18 on MT6877, while rubypro is on HyperOS
2.0.15. So the cluster spans two HyperOS generations, which rules out a firmware-specific cause.

MT6877 was listed as NOT COMPATIBLE in COMPATIBILITY.md until last night, on the incorrect reading
that "MT6789 or newer" was a numeric comparison. Your log showing Kamakiri running fine is part of
what got that fixed, so thanks for filing it even though it looked like a dead end.

[kasnria001]

This method is invalid.New xiaomi devices won't check seccfg at all.Invalid magic will not let you unlock.

[burg1ar]

% mtk da rpmb e --sector 57344 --sectors 4

...Port - Device detected :)
Preloader - Detected regular mode !
Preloader - CPU: MT6877/MT6877V/MT8791N(Dimensity 900/1080/7050)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x959
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: AEE77606535616F25993FE3CCC841755
Preloader - SOC_ID: 4B3444038797DA8FB24950602DC7C67AADAFE0596A9AAE3E00D7EE85E5E1CA71
Preloader
Preloader - [LIB]: Auth file is required. Use --auth option.
DaHandler - Device is protected.
DaHandler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt6877_payload.bin, 0x264 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: /home/albert/Temp/mtkclient/venv/lib/python3.14/site-packages/mtkclient/payloads/mt6877_payload.bin
Port - Device detected :)
DaHandler
DaHandler - [LIB]: Device is in BROM mode. No preloader given, trying to dump preloader from ram.
DAXFlash - Uploading xflash stage 1 from MTK_DA_V5.bin
XFlashExt - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
XFlashExt - Patching da2 ...
XFlashExt - Security check patched
XFlashExt - DA version anti-rollback patched
XFlashExt - SBC patched to be disabled
XFlashExt - Register read/write not allowed patched
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Boot to succeeded.
DAXFlash - Successfully uploaded stage 2
DAXFlash - DA SLA is disabled
DAXFlash - UFS Blocksize: 0x1000
DAXFlash - UFS ID: KM8F9001JM-B81
DAXFlash - UFS MID: 0xce
DAXFlash - UFS CID: ce014b4d3846393030314a4d2d423831
DAXFlash - UFS FWVer: 30313030
DAXFlash - UFS Serial: 353563616161326332663335
DAXFlash - UFS LU0 Size: 0x3b96000000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - Starting DA extensions ...
DAXFlash - Extensions were accepted. Jumping to extensions...
DAXFlash - Boot to succeeded.
DAXFlash - DA Extensions successfully added at 0x4fff0000
Main - Handling da commands ...
XFlashExt - Generating sej rpmbkey...
Sej - AES128 CBC - HACC init
Sej - AES128 CBC - HACC run
Sej - AES128 CBC - HACC terminate
XFlashExt - Setting rpmbkey: ok
XFlashExt - Derived rpmb key: 609d766bba9f42fef48d70e7b1be12fd9f7259339f1184dba097272d8ab4bed8
Done |██████████| 100.0% RPMB erase: (0x400/0x400),0.00 MB/s
XFlashExt - Done erasing rpmb

% mtk da seccfg unlock
Main - Handling da commands ...
XFlashExt - Detected V4 Lockstate
Sej - AES128 CBC - HACC init
Sej - AES128 CBC - HACC run
Sej - AES128 CBC - HACC terminate
Sej - AES128 CBC - HACC init
Sej - AES128 CBC - HACC run
Sej - AES128 CBC - HACC terminate
SecCfgV4 - hwtype found: V4
DaHandler
DaHandler - [LIB]: Device is already unlocked

% fastboot getvar unlocked
unlocked: no
Finished. Total time: 0.000s

UFS ID: KM8F9001JM-B81
result: locked still.