Share 
## https://sploitus.com/exploit?id=05ADAF2B-430D-5899-B96F-A17BB512497E
# UnlockPOCOX6Pro β€” duchamp (POCO X6 Pro 5G) recovery research

Research workspace for recovering a soft-bricked **Xiaomi POCO X6 Pro 5G**
(**codename `duchamp`**, MediaTek **MT6897**, BROM hardware code **`0x1203`**)
after a bad **modem** flash left **Little Kernel (LK)** panicking.

**Fastboot may flash on screen for a few seconds but does not enumerate over USB.**  
The reliable entry is **MediaTek BootROM**: power off β†’ hold **Vol Up + Vol Down** β†’ plug USB β†’ `VID_0E8D` / `PID_0003`.

> **Canonical status document:** [`MASTERPROGRESS.md`](MASTERPROGRESS.md)  
> This README is a human-readable summary of progress, architecture, and discoveries.  
> For session resume rules and dead ends, see [`INSTRUCTIONS_FOR_AI.md`](INSTRUCTIONS_FOR_AI.md).

---

## Goal

| Item | Detail |
|------|--------|
| **Problem** | Edited modem β†’ LK panic β†’ no usable fastboot USB |
| **Entry** | BootROM only (volume-key combo) |
| **Target** | Reflash stock modem (then full OS if needed) through an **authorized Download Agent (DA)** path |
| **Constraint** | Device enables **SBC + SLA + DAA** β€” free/generic DA upload is blocked |

Stock India fastboot firmware for duchamp was prepared under `firmware/stock/`
(large images are **not** in git; see `.gitignore`).

---

## Progress at a glance

```
GOAL:     BROM β†’ authorized SLA β†’ DA β†’ flash stock modem/OS
DONE:     BROM, correct duchamp DA/PL, Xiaomi identity+STS, full V6 auth RE,
          live native SLA challenge capture path, public path analysis
STUCK:    Xiaomi authorized-flash cloud admission (HTTP 401 / offline SLA response)
NEXT:     Admitted MiFlash/service context OR licensed commercial BROM exploit path
AVOID:    DA brute-force, re-SMS identity, signing spray, generic auth_sv5 as β€œSLA fix”
```

| Phase | What | Status |
|-------|------|--------|
| **0** | Kit, mtkclient, UsbDk/BROM handshake | **Done** |
| **1** | Xiaomi `unlockApi` identity (SIM/2FA) + STS session | **Done** |
| **2** | Cloud `/api/v2/nonce` β†’ bind β†’ `ahaFlash` | **Blocked** (upstream gate) |
| **3** | Live BROM SLA answer β†’ DA `printgpt` / GPT | **Blocked** by 2 (or needs alternate entry) |
| **4** | Flash modem / OS | **Not started** (needs DA open + explicit OK) |

---

## How the recovery stack works

### 1. Device security layers (MediaTek + Xiaomi)

When the phone is in BootROM, `gettargetconfig` reports security config **`0xE7`**:

| Layer | Meaning on this device |
|-------|-------------------------|
| **SBC** | Secure Boot Chain β€” signed software path |
| **SLA** | **Serial Link Auth** β€” BROM demands a challenge/response **before** DA bytes are accepted |
| **DAA** | Download-Agent authentication β€” tool/auth material tied to the flash session |

Practical effect for free tooling (e.g. stock mtkclient DA upload):

1. BROM handshake succeeds.
2. Correct **duchamp DA** is selected for hwcode `0x1203`.
3. BROM returns **`0x1D0D` (SLA required)** before `upload_data()`.
4. Without a valid **challenge-specific** SLA response, **no DA runs** β†’ no partition access β†’ no reflash.

Public β€œHeapBait / exploit after DA1” paths do **not** help here: they assume DA1 is already loaded. This phone never gets that far.

### 2. What the 48-byte SLA token is

Live native V6 work proved `flash.dll` builds a **48-byte** object for Xiaomi’s signer:

```text
bytes 00..31  β†’ device-bound identity material
bytes 32..47  β†’ fresh BROM nonce
```

Personal captures are stored only as placeholders:

```text

```

**Not** a miIO token: the ASCII-looking prefix is identity material, not a
32-character miIO secret. MD5/AES β€œmiIO” derivations are the wrong crypto model.

Tokens are **not reusable** across sessions: each BROM SLA challenge gets a new nonce.

### 3. Xiaomi cloud path (authorized flash)

Xiaomi’s official/authorized tools do roughly:

```text
Browser / LoginPro
  β†’ sid=unlockApi login
  β†’ (if needed) SIM/2FA on notificationUrl / verifyPhone
  β†’ STS on unlock.update.miui.com  β†’ unlock-domain serviceToken cookies
  β†’ ssecurity for signing
  β†’ POST /api/v2/nonce
  β†’ userStatus / applyBind
  β†’ ahaFlash(flashToken = Base64(device challenge))
  β†’ response used as SLA answer into BROM / DA
```

**Two different β€œunlock” surfaces:**

| Surface | Example | What it is |
|---------|---------|------------|
| Bootloader-style | `/v1/unlock/*` | Accepts unlock `serviceToken` cookies; fixed BL HMAC is for **this** API family only |
| Authorized flash | `/api/v2/nonce`, `/api/v1/mtk/flash/ahaFlash`, … | Separate gate; needs admitted service context, not only a consumer login |

We fully reverse-engineered and reimplemented the **request crypto/layout** of
`account_auth.exe` (empty-key path-bound HMAC-SHA1 `sign`, AES-128-CBC field
encryption with `ssecurity`, raw SHA1 transport `signature`, JsonCpp payloads,
`clientId=mtkFlash`, exact cookies). The request is no longer the unknown.

**What still fails:** even that exact envelope gets:

```text
HTTP 401
empty body
WWW-Authenticate: Basic realm="default"
```

So the block is **upstream admission** (account / workstation / network /
service entitlement), not β€œwe signed the JSON wrong.”

### 4. Local native V6 path (proven end-to-end until remote)

A purpose-built connect/auth host exercises only safe exports:

- `tools/xiaomi_mtk_auth/NativeV6ConnectOnly.cs`
- `tools/xiaomi_mtk_auth/run_native_v6_connect_only.ps1`

Live chain that completed:

1. MediaTek CDC ACM opens as COM (e.g. COM6).
2. BROM handshake OK; hwcode `0x1203`; security `0xE7`.
3. Bundled `auth_sv5.auth` transfer accepted by BROM (tool-auth transfer β‰  solved SLA).
4. SLA command `0xE3` β†’ 48-byte challenge assembled.
5. `SLA_Challenge1.dll` β†’ pipe `misignserver` β†’ `account_auth.exe`.

**Result on a clean authenticated retry:** signer returned **zero-length**
response β†’ BROM **`0x701E`**. That proves local plumbing works and leaves
**Xiaomi remote authorization** as the remaining gate.

No DA upload, no partition I/O was performed in that connect-only host.

### 5. Identity / session (done once)

Working recipe after SIM identity for `sid=unlockApi`:

1. Account cookies **without** web `account.xiaomi.com` `serviceToken`.
2. `serviceLogin` β†’ real **`ssecurity`** when `securityStatus=0`.
3. Follow STS `location` with a browser User-Agent β†’ unlock-domain **`serviceToken`**.
4. Store under `tools/xiaomi_mtk_auth/sessions/` (values are **redacted placeholders** in this public tree).

Control: `/v1/unlock/applyBind` can return HTTP **200** JSON (proof the unlock
token is real). Flash `/api/*` still **401**.

---

## Major discoveries

### Device / tooling

- Live chip is **MT6897 / `0x1203`** (duchamp family). Folder names lie; trust structure + BROM.
- Stock mtkclient DA packs historically lacked a usable `0x1203` loader entry β†’ fixed with **Xiaomi duchamp DA + preloader** under `tools/duchamp_kit/`.
- **UsbDk** (or a working MediaTek CDC stack) is required for reliable BROM; COM-only without a working driver path fails.
- Generic `auth_sv5.auth` is **not** a free SLA bypass for this ME_ID; DA brute-force does not clear SLA.

### Protocol / reverse engineering

- Full RE of **LoginPro / account_auth / flash.dll / SLA_Challenge*** in Ghidra projects under `AAA-NEWFILES/Mediatek V6/REVERSE/`.
- Cloud flash API signing and envelope are **known and implemented** in `tools/xiaomi_mtk_auth/`.
- Bootloader fixed HMAC key used by some HyperOS/bootloader unlock tooling is a **different API** and does not unlock `/api/v2/nonce`.
- SLA object structure (identity || nonce) confirmed from live native captures (bytes redacted).

### Public path analysis

- Current public mtkclient has MT6897 config but **no** free BROM-SLA bypass payload for this Xiaomi fused path.
- Independent public tool logs for POCO X6 Pro show the same pattern: auth accepted β†’ challenge β†’ **offline/fail** without admitted remote signing.
- Official **Chimera** changelog claims a **BROM/preloader MT6897** exploit path that lists **POCO X6 Pro** as a tested model β€” the first clearly documented commercial claim at this exact gate (licensing/use is separate; not automated here).

### Environment

- MediaTek **`usb2ser.sys` 3.0.1504.0** is incompatible with **HVCI / Memory Integrity** and blocked COM enumeration until drivers/isolation are managed carefully.
- Stock **India OS3.0.7.0 WNLINXM** package was verified (MD5) and staged for modem_a/modem_b-first recovery once DA access exists.

---

## What is explicitly *not* solved

- No free offline SLA key for this unit.
- No successful DA session / GPT / partition write from this research path alone.
- No consumer Xiaomi account proven to pass `/api/v2/nonce` with the exact client.
- Preloader PID `2000`/`2001` was **not** observed on normal cable plug; only BROM `0003` in watched cycles.

---

## Repository layout

| Path | Role |
|------|------|
| [`MASTERPROGRESS.md`](MASTERPROGRESS.md) | **Source of truth** β€” status, stuck point, resume checklist |
| [`INSTRUCTIONS_FOR_AI.md`](INSTRUCTIONS_FOR_AI.md) | Standing rules / dead ends for agents |
| [`HOPE_AND_FULL_STORY.md`](HOPE_AND_FULL_STORY.md) | Narrative history |
| [`tools/xiaomi_mtk_auth/`](tools/xiaomi_mtk_auth/) | Python + native auth clients, probes, redacted session/out |
| [`tools/duchamp_kit/`](tools/duchamp_kit/) | Correct duchamp DA + preloader |
| [`tools/usb_watch/`](tools/usb_watch/) | Read-only USB enumeration watcher |
| [`AAA-NEWFILES/Mediatek V6/`](AAA-NEWFILES/Mediatek%20V6/) | Official V6 binaries + Ghidra RE exports |
| [`security/`](security/) | Layered notes: `BROM` / `SLA` / `DAA` / `SBC` Γ— `working` / `not_working` |
| Dated `*-DD-MM-YYYY-*.md` | Session findings (timestamp prefix convention) |
| `firmware/` | Stock images **local only** (gitignored) |

---

## Privacy / redaction

This tree was sanitized before publish:

- Device **SOC_ID / ME_ID**, Xiaomi **userId**, session tokens (**ssecurity**, **serviceToken**, **passToken**, cookies), and live **SLA token bytes** are placeholders (``, ``, ``, …).
- Live challenge `.bin` dumps were removed; only redaction stubs remain.
- Do **not** commit real `passport.json` tokens or challenge captures.

---

## Next legitimate options (ordered)

1. **Compare service context** with a known-admitted MiFlash / authorized environment (not more signing variants).
2. **Commercial admitted path** that claims BROM entry on MT6897 / POCO X6 Pro (e.g. Chimera-style tooling with a valid licence), then modem-only restore first.
3. **Authorized Xiaomi/POCO service centre** if consumer tooling never clears the cloud gate.
4. Optional parallel: 32-bit Python + original `SLA_Challenge1.dll` against a live challenge **only** if a real remote answer channel exists.

**Do not re-loop:** identity SMS (if session valid), DA filename brute force, emerald/wrong-codename ROMs, generic `auth_sv5` as SLA solution, or bootloader fixed-key as flash `/api` sign.

---

## License / use

Research and recovery notes for a device the owner is authorized to repair.
Respect Xiaomi/MediaTek licensing for binaries and any commercial tools.
Unauthorized bypass of security controls on devices you do not own is out of scope.

---

*For the full checklist and evidence pointers, open [`MASTERPROGRESS.md`](MASTERPROGRESS.md).*