Help unlock Mediatek Xiaomi Redmi Note 4 without wiping data - Xiaomi Redmi Note 4 Questions & Answers

I am trying to unlock an Android phone that has stopped taking the correct password after a auto-restart. I know the PIN, I have not changed it in a long while. The phone stopped accepting the PIN after the sudden auto-restart so I am just clueless what may work. Hard reset is not an option for this device without backing up the data so willing to try anything that may help.
Additional information:
1. The phone does not have USB debugging enabled.
2. It is recognized by ADB only in sideload mode.
3. When I try to get into Recovery mode pressing volume up and power button, it goes directly to the black screen that shows image of a phone and USB cable.
4. I have not been able to get to the stock recovery screen where different options like mounting can be chosen.
Any suggestion or guidance would be hugely appreciated. Thanks a ton for your time.
Thank you.

---

first install MediaTek MT67xx USB VCOM Preloader USB Drivers. the preloader is the important mode for flashing via COM port. it works best with battery removed. here is a video how it looks like when preloader is visible in device manager
next download stock ROM and SP Flash Tool. in the firmware folder you will find the scatter file for this ROM. With this do a readback of boot and recovery partition. Do not flash (download) anything, just dump current partitions from phone. now modify boot against dm-verity (magisk manager can do this). if it works, you know the scatter file is matching your device. if it fails, you must create your own scatter file and repeat readback. there is a tutorial for creating scatter file with WwR MTK (skip this)
How to flash custom recovery, by-pass screen lock, root with Magisk (with locked bootloader)
requirements
- adb and fastboot platform-tools
- MediaTek SP Flash Tool
- MediaTek PreLoader USB VCOM driver
- stock ROM
- magisk manager
- TWRP
- MT6797_Android_scatter.txt (specific for ROM)
- MTK_AllInOne_DA.bin
- auth_sv5.auth (optional)
steps
- install MediaTek MT67xx VCOM Preloader USB Drivers
power off phone
open device manager
connect usb cable with PC (preloader appears for ~ 1 second only)
click on the unknown device (be fast)
manually assign the driver usb2ser_Win764.inf
- readback boot and recovery partition
run flash_tool.exe, on the Download tab,
choose Download-Agent "MTK_AllInOne_DA.bin"
choose Scatter-loading File "MT6797_Android_scatter.txt"
on the Readback tab, Add new entry
click on filename "ROM_0" and rename to boot.img
select Region EMMC_USER
Start Address: 0x000000000B800000
Length: 0x0000000001000000
Add new entry
click on filename "ROM_1" and rename to recovery.img
select Region EMMC_USER
Start Address: 0x0000000000008000
Length: 0x0000000001000000
when both entries okay, compare with scatter file
click on "Read back" (readback will start as soon as preloader is detected)
power off phone
connect usb cable with PC (readback start)
when finished you will see green checkmark Ok
- patch boot.img with magisk manager
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
download Latest Magisk Manager to any android device (not rooted)
enable settings - security - unknown sources
open file manager and navigate to Download folder
install MagiskManager.apk
copy boot.img from readback to the android device
open Magisk Manager, tap on Advanced Settings
select Preserve force encryption
tap on Magisk is not installed - INSTALL - INSTALL (2x times)
Select and Patch a File
grant permission to storage
navigate to boot.img from readback
tap on boot.img (patching will start)
Note: the Magisk dialog is misleading. It says Flashing... but nothing is flashed to this android device, this devices remains safe/unrooted
when finished you will see the output file name and text "All done!"
disable settings - security - unknown sources
(you can uninstall Magisk Manager from this device now)
copy the file to PC with adb command
Code:
adb pull /storage/emulated/0/Download/magisk_patched.img
- flash patched boot and twrp
run flash_tool.exe, on the Download tab,
choose Download-Agent "MTK_AllInOne_DA.bin"
choose Scatter-loading File "MT6797_Android_scatter.txt"
choose Authentication File "auth_sv5.auth" (optional)
choose Method "Download only"
WARNING: Make sure not to "Format All + Download" (devices with secure boot) or flash using "Firmware Upgrade" option. This will damage/hard brick your device
Important: always de-select the check box "preloader" (EMMC_BOOT)
de-select all check boxes
click on recovery, select cofface_twrp_nikel_recovery1121.img
click on boot, select magisk_patched.img
click on "Download" (flashing will start as soon as preloader is detected)
power off phone
connect usb cable with PC (flashing start)
when finished you will see green checkmark Download Ok
press and hold Volume Up Button
disconnect the usb cable (still holding Volume Up)
reconnect the usb cable (still holding)
Note: you may hear multiple connecting sounds - don't release the Volume Up Button yet
when TWRP Team Win recovery appears, release Volume Up Button
- check if twrp is able to decrypt userdata (without credentials)
- create a backup of data partition, copy to PC
- delete /data/system/locksettings.db* files (only if backup successful)
- reboot device, check if screen lock is removed
- install Magisk Manager
Note: everything untested - may not work! If flashing boot or recovery fails, it is most likely denied by secure boot. In this case it may work only with proper Download-Agent (and auth_sv5.auth file)

---

So my phone was locked out of the blue and now suddenly my laptop lid is malfunctioning
Give me some time to get back to you with updates, I am so annoyed with state of affairs now

---

Thank you again @Alecxs I will start working on all the steps in exactly 14 hours

---

@Alecxs Just got to start working from a desktop. I am doing all you suggested step by step. Will update as I see results

---

Update one: I could see different driver options while installing manually including-
MediaTek DA USB VCOM Port
MediaTek Preloader USB VCOM port
I installed the Preloader one. Is that ok? "MT65xx" this was not visible anywhere.
I followed the instructions here: https://techprolonged.com/2015/03/i...oquYcROCvEfkBBbeTyyo1BE5NT97sxjNvss3_nMJOFfpU
And downloaded the driver from here: https://www.getdroidtips.com/install-mediatek-mt65xx-usb-vcom-drivers/

---

I see MediaTek Preloader USB VCOM port (COM4) installed under Ports but there is yellow triangle warning sign

---

the yellow triangle is not okay
MT65xx is just example.. your chipset is MT6797 you probably need MT67xx (check the download link in requirements if not working)
unfortunately there is no official download source, i don't know which drivers will work... you must try different drivers until it is detected successful

---

There seems to be different version of Magisk, I downloaded Magisk Manager v7.5.1

---

for twrp, do I need to download just a 15.9MB image file? Getting this cofface_twrp_nikel_recovery1121.img from here https://androidfilehost.com/?w=file...34b1787be6b45be9e946dafde2bd335ce75d72ca4e9a9

---

yes this should be the right twrp for nikel, but i haven't had a look inside fstab (maybe it needs some fixes for decryption)

---

Seeing this as I am trying to get the stock ROM:
"Too many users have viewed or downloaded this file recently. Please try accessing the file again later. If the file you are trying to access is particularly large or is shared with many people, it may take up to 24 hours to be able to view or download the file. If you still can't access a file after 24 hours, contact your domain administrator."

---

I have everything you asked to download except stock ROM,
it downloaded for a bit then seeing this:
"Access to doc-0c-7g-docs.googleusercontent.com was denied
You don't have authorization to view this page.
HTTP ERROR 403"

---

Could not download the stock ROM from here: https://firmwarefile.com/xiaomi-redmi-note-4
Getting it from Mirror 1 of this link: https://spflashtools.com/windows/sp-flash-tool-v5-1952
Would this be ok?
Correction: Ok now I got the difference between Stock ROM and flash tool. I have the flash tool but cant download the stock rom. see the above two messages please

---

you just need the scatter file from stock ROM. can't upload because i am not at home anymore

---

@Alecxs would getting the "download recovery ROM" from this link be ok? https://www.getdroidtips.com/miui-8-2-10-0-global-stable-rom-redmi-note-4-4x/
I can download it, not sure if this is the same thing as Stock ROM that I could not download earlier.

---

nope... miui_HMNote4XGlobal_V8.2.10.0.MCFMIDL_ee189ea231_6.0.zip is for qualcomm (mido)
edit: i have uploaded now for MTK (nikel)
- Generic Xiaomi Secure Boot Download Agent, and (hovatek)
- Sec-Auth file from Xiaomi_MTK_DA_Auth.7z
- MT6797_Android_scatter.txt file from (xiaomistockrom)
Xiaomi_Redmi_Note_4_MT6797_V8.0.4.0.MBFMIDG_20160805_Global_6.0.zip
credits to xiaomistockrom and hovatek (i have already posted link on first page). they also say "note that this model requires an authorized account to flash so having DA & auth alone won't help much" - hope this is enough for flashing TWRP

---

Thanks a lot again @Alecxs I will try again today and follow these steps
aIecxs said:
nope... miui_HMNote4XGlobal_V8.2.10.0.MCFMIDL_ee189ea231_6.0.zip is for qualcomm (mido)
edit: i have uploaded now for MTK (nikel)
- Generic Xiaomi Secure Boot Download Agent, and (hovatek)
- Sec-Auth file from Xiaomi_MTK_DA_Auth.7z
- MT6797_Android_scatter.txt file from (xiaomistockrom)
Xiaomi_Redmi_Note_4_MT6797_V8.0.4.0.MBFMIDG_20160805_Global_6.0.zip
credits to xiaomistockrom and hovatek (i have already posted link on first page). they also say "note that this model requires an authorized account to flash so having DA & auth alone won't help much" - hope this is enough for flashing TWRP
Click to expand...
Click to collapse

---

@Alecxs, after flashing patched boot and twrp and disconnecting and reconnecting my phone while holding the volume up button, my phone has gone to an error state. I am being shown the message "Red State. Your device has failed verification and may not work properly. Your device will boot in 5 seconds."
The phone is trying to boot again and again, but the same screen is coming up. The problem is persisting even after completely turning off the device and trying to follow the flashing step with a Xiaomi DA and auth_sv5.auth file.
Can I do anything to fix this?
aIecxs said:
first install MediaTek MT67xx USB VCOM Preloader USB Drivers. the preloader is the important mode for flashing via COM port. it works best with battery removed. here is a video how it looks like when preloader is visible in device manager
next download stock ROM and SP Flash Tool. in the firmware folder you will find the scatter file for this ROM. With this do a readback of boot and recovery partition. Do not flash (download) anything, just dump current partitions from phone. now modify boot against dm-verity (magisk manager can do this). if it works, you know the scatter file is matching your device. if it fails, you must create your own scatter file and repeat readback. there is a tutorial for creating scatter file with WwR MTK (skip this)
How to flash custom recovery, by-pass screen lock, root with Magisk (with locked bootloader)
requirements
- adb and fastboot platform-tools
- MediaTek SP Flash Tool
- MediaTek PreLoader USB VCOM driver
- stock ROM
- magisk manager
- TWRP
- MT6797_Android_scatter.txt (specific for ROM)
- MTK_AllInOne_DA.bin
- auth_sv5.auth (optional)
steps
- install MediaTek MT67xx VCOM Preloader USB Drivers
power off phone
open device manager
connect usb cable with PC (preloader appears for ~ 1 second only)
click on the unknown device (be fast)
manually assign the driver usb2ser_Win764.inf
- readback boot and recovery partition
run flash_tool.exe, on the Download tab,
choose Download-Agent "MTK_AllInOne_DA.bin"
choose Scatter-loading File "MT6797_Android_scatter.txt"
on the Readback tab, Add new entry
click on filename "ROM_0" and rename to boot.img
select Region EMMC_USER
Start Address: 0x000000000B800000
Length: 0x0000000001000000
Add new entry
click on filename "ROM_1" and rename to recovery.img
select Region EMMC_USER
Start Address: 0x0000000000008000
Length: 0x0000000001000000
when both entries okay, compare with scatter file
click on "Read back" (readback will start as soon as preloader is detected)
power off phone
connect usb cable with PC (readback start)
when finished you will see green checkmark Ok
- patch boot.img with magisk manager
download Latest Magisk Manager to any android device (not rooted)
enable settings - security - unknown sources
open file manager and navigate to Download folder
install MagiskManager.apk
copy boot.img from readback to the android device
open Magisk Manager, tap on Advanced Settings
select Preserve force encryption
tap on Magisk is not installed - INSTALL - INSTALL (2x times)
Select and Patch a File
grant permission to storage
navigate to boot.img from readback
tap on boot.img (patching will start)
Note: the Magisk dialog is misleading. It says Flashing... but nothing is flashed to this android device, this devices remains safe/unrooted
when finished you will see the output file name and text "All done!"
disable settings - security - unknown sources
(you can uninstall Magisk Manager from this device now)
copy the file to PC with adb command
Code:
adb pull /storage/emulated/0/Download/magisk_patched.img
- flash patched boot and twrp
run flash_tool.exe, on the Download tab,
choose Download-Agent "MTK_AllInOne_DA.bin"
choose Scatter-loading File "MT6797_Android_scatter.txt"
choose Authentication File "auth_sv5.auth" (optional)
choose Method "Download only"
WARNING: Make sure not to "Format All + Download" (devices with secure boot) or flash using "Firmware Upgrade" option. This will damage/hard brick your device
Important: always de-select the check box "preloader" (EMMC_BOOT)
de-select all check boxes
click on recovery, select cofface_twrp_nikel_recovery1121.img
click on boot, select magisk_patched.img
click on "Download" (flashing will start as soon as preloader is detected)
power off phone
connect usb cable with PC (flashing start)
when finished you will see green checkmark Download Ok
press and hold Volume Up Button
disconnect the usb cable (still holding Volume Up)
reconnect the usb cable (still holding)
Note: you may hear multiple connecting sounds - don't release the Volume Up Button yet
when TWRP Team Win recovery appears, release Volume Up Button
- check if twrp is able to decrypt userdata (without credentials)
- create a backup of data partition, copy to PC
- delete /data/system/locksettings.db* files (only if backup successful)
- reboot device, check if screen lock is removed
- install Magisk Manager
Note: everything untested - may not work! If flashing boot or recovery fails, it is most likely denied by secure boot. In this case it may work only with proper Download-Agent (and auth_sv5.auth file)
Click to expand...
Click to collapse

---

red state means the avb protection does not accept unsigned partition images. the Volume Up key is for booting straight into recovery. that sounds like it is not possible to boot into TWRP with locked bootloader. you can fix this by flashing original boot + recovery
you can try combination of original boot + twrp, or magisk_patched.img + original recovery, but i am afraid it is not possible to pass red state
however, magisk has option to keep avb/dm-verity. if (avb signed) magisk_patched.img passes secure boot (with stock recovery), you have following options
a) modify boot with adb enabled
b) sign twrp with avb signature
(i will upload the necessary files later, but i need the original boot + recovery from readback first)
if (avb signed) magisk_patched.img doesn't work (red state) you are left with one last option
c) create a full ROM dump, factory reset, unlock bootloader (official way), flash twrp, restore userdata + metadata and try to decrypt/recover your files