My experience unbricking a Xiaomi Redmi Note 11 Pro 5G (China)

The Xiaomi Redmi Note 11 Pro (China) is an Android 11 device powered by the MediaTek Dimensity 920 chipset. In this case, the device was bricked due to cross-flashing then accidentally relocking the bootloader in the process. It was stuck in BROM Mode (MTK USB Port). I also suspect that the Global firmware flashed was of an older version so that’s a double whammy; Anti-rollback + Cross-flash with locked Bootloader

Setting Up

Since it was a Secure Boot device, DA (and Auth) file or SLA / DAA / SBC bypass was the way to go. I opted for MTK Client.

What didn’t work

First, I opted to:

1. Unlock the bootloader
2. Reboot to fastboot
3. Flash the firmware using Mi Flash Tool

To unlock the bootloader, I ran;

py -3 mtk da seccfg unlock

Unfortunately, this got stuck at [LIB]: ←[33mNo preloader given. Operation may fail due to missing dram setup.←[0m DAXFlash – Uploading stage 2

What took it past this stage was

py -3 mtk da seccfg unlock --preloader=preloader_pissarro.bin

where preloader_pissarro.bin was the preloader I obtained from the factory firmware and copied into the MTK Client folder

Now that bootloader was unlocked (at least I thought it was), I got it into fastboot by running the following commands (you first disconnect the phone then connect after running the command)

py -3 mtk payload

While phone was still connected to PC

py -3 mtk plstage --preloader=preloader_pissarro.bin

After the second command, I just kept holding the volume down button. This got the device into fastboot. Unfortunately, bootloader was still locked (so MTK Client hadn’t worked to unlock bootloader). I therefore couldn’t use Mi Flash tool.

I exited fastboot and re-tried a full flash in MTK Client using

py -3 mtk w vbmeta_a,vbmeta_system_a,vbmeta_vendor_a,vbmeta_b,vbmeta_system_b,vbmeta_vendor_b,md1img_a,spmfw_a,audio_dsp_a,pi_img_a,dpm_a,scp_a,sspm_a,mcupm_a,cam_vpu1_a,cam_vpu2_a,cam_vpu3_a,gz_a,lk_a,boot_a,vendor_boot_a,dtbo_a,tee_a,efuse,logo_a,logo_b,countrycode,md1img_b,spmfw_b,audio_dsp_b,pi_img_b,dpm_b,scp_b,sspm_b,mcupm_b,cam_vpu1_b,cam_vpu2_b,cam_vpu3_b,gz_b,lk_b,boot_b,vendor_boot_b,dtbo_b,tee_b,super,gsort,oem_misc1,cust,rescue,userdata vbmeta.img,vbmeta_system.img,vbmeta_vendor.img,vbmeta.img,vbmeta_system.img,vbmeta_vendor.img,md1img.img,spmfw.img,audio_dsp.img,pi_img.img,dpm.img,scp.img,sspm.img,mcupm.img,cam_vpu1.img,cam_vpu2.img,cam_vpu3.img,gz.img,lk.img,boot.img,vendor_boot.img,dtbo.img,tee.img,efuse.img,logo.bin,logo.bin,countrycode.img,md1img.img,spmfw.img,audio_dsp.img,pi_img.img,dpm.img,scp.img,sspm.img,mcupm.img,cam_vpu1.img,cam_vpu2.img,cam_vpu3.img,gz.img,lk.img,boot.img,vendor_boot.img,dtbo.img,tee.img,super.img,gsort.img,oem_misc1.img,cust.img,rescue.img,userdata.img --preloader=preloader_pissarro.bin

Same still.

What worked

Back to the drawing board. I had MTK Client and the China firmware so I opted for SP Flash tool. The first task was to bypass SLA, DAA or SBC in MTK Client using the command;

py -3 mtk payload

Next, I launched SP flash tool, loaded the scatter file, went to Options > Option > Connection, chose UART and selected the COM port which the phone was been detected on. I closed the option tab and proceeded to flash the full firmware using Download Only.

After flashing was done, I held the power button to boot up the phone, gave it some minutes to go past the MIUI screen then it entered the Setup Wizard screen; successfully unbricked.

Note

This approach should work on other (Xiaomi) Mediatek devices so far you can get the right firmware for your model.