All about patching Xiaomi's boot

lpblackmesa

Hello everyone\devs!
Thank you for all UFI products you did!
So, I have some questions about function "Patch Boot" for Xiaomi - Qualcomm.
I need this function for change EMCP\CPU, it's very important for me, so, I wanna know as much as it possible about it.

1) What the difference between "Disable DM verity and force encrypt with Sig Overflow" and "Disable DM verity and force encrypt with oem sig"? Does it depend on model? When should I use the first one? When the second one?
2) Is it possible to unlock bootloader after patching? I can't connect Mi account with patched device in dev settings for unlocking (tried to connect several patched Redmi 4a, Redmi 5a, Redmi 4 Prime, Redmi Note 4). All patched devices got 20091 error.

3) How to disable "Firmware updating via OTA"? I would like to see "disable OTA update" function in future, it would be useful. If patched device get OTA FW update, it can't load anymore until you patch it again.

4) Which models support patching? I have no so much positive results with patching. There are models with my positive results:
- Redmi 4a - patching ok, phone load with changed EMCP\CPU, even with newest MIUI10(10.2.1.0)
- Redmi 5a - patching ok, phone load with changed EMCP\CPU, even with newest MIUI10(10.2.1.0)
- Redmi 4 Prime - patching ok, phone load with changed EMCP\CPU, but only with old FW MIUI8 (6.11.10_20161110.0000.00_6.0_cn) or (V8.0.5.0.20160805.0000.29_6.0_cn). Phone can't start with newest FW - it just falling into 900E port after patching 🙁
- Redmi Note 4 - patching ok, phone load with changed EMCP\CPU, but only with old FW MIUI9 (7.7.26_20170726.0000.00_7.0).

So , models with my negative results:
- Redmi Note 3 Pro - phone just falling into 900E port after patching
- Redmi 4x - phone just falling into 900E port after patching
- Redmi 4 (prada) - phone can't start loading and just stopped at Mi logo
- Redmi Note 5a Prime - phone just falling into 900E port after patching
How to replace memory in this devices? Is it possible?

So, I will try with other models in future and will continue sharing my results here.
Thanks for answering for advance and sorry for my poor english

madgoeslim

lpblackmesa Hello,
Thanks for joining us as UFiXers.
Will try to answer your many question as short as possible 😉
This patch boot button is specifically for xiaomi devices, will try to explain below:

Patch boot image(disable dm-verity, encryption) - oem sig

disable dm-verity and android disk encryption and re-sign then boot using engineering certificate
(requires engineering aboot, case: Redmi 3S and maybe others also)

Patch boot image(disable dm-verity, encryption) - sig overflow

disable dm-verity and android disk encryption and manipulate signature so it will bypass signature verification on some devices
(case: Redmi 5A and maybe others also)

But, if after patch, phone will boot to 900E then it means the patch is not work for that phone (aboot).

lpblackmesa

Thank you for answering.
I will wait for another answers, especially for unlocking boot. Did you unlock boot on patched devices?
I'm so disappointed that it's impossible to unlock bootloader...

lpblackmesa

So, Redmi Note 5a (2\16) doesn't start also.
Phone just falling into 900E, any patch don't help..