Xiaomi Redmi 9 IMEI restoration

This guide requires Microsoft Windows to follow
This procedure will wipe all data on the device
This procedure requires disassembling the device
This procedure involves modifying the device's hardware

This guide is based on this guide on 4pda

Downloads

  1. Download the engineering firmware
  2. Download MIUI v12.0.1
  3. Download the restoration tools

Removing write-protection

  • Remove the SIM tray
  • Remove the back panel (You can insert a plastic card like this to go around corners)
  • Write down the IMEI written on the sticker
  • Unscrew all the screws from the top plastic panel
  • Unplug this ribbon cable
  • Remove the top plastic panel
  • Remove the motherboard from the casing by carefully lifting it with a flat-head screwdriver
  • Turn the motherboard around and remove this metal lid. Be careful not to bend it too much
  • Bend the metal casing upwards. Try to not crease it like I did
  • Remove this component using something sharp. (For me it was more destroyed than removed)
  • Bend the metal casing back into place and put everything back together

    • How to use MTKSecBypass

    Every time I ask you to do something "with bypass", you should do the following:

    1. Run MTK-Auth-Bypass-Tool-V13.rar/mtksecbypass_v13.exe
    2. Press "Disable Auth"
    3. Plug in the device while it's powered off holding both volume buttons
    4. If the device is not detected try installing MTKClient from mtkclient-2.0-beta.exe

    Flashing the ENGROM

    1. Unpack SP_Flash_Tool v5.20020.rar
    2. Run SP Flash Tool (flash_tool.exe, with bypass)
      • Tab: "Format"
      • Auto format Flash: On
      • Format whole flash except bootloader: On
      • Start
    3. Run SP Flash Tool (with bypass)
      • Tab: "Download"
      • Download-agent: SP_Flash_Tool/DA_6765_6785...
      • Scatter-loading File: ENGROM.rar/images/MT6768_Android_scatter.txt
      • Authentication File: empty
      • Mode: Download Only

    Cracking the vbmeta

    1. Install MTK Client from mtkclient-2.0-beta.exe
    2. Open MTK Client
      • Juggle with it a bit until the phone connects. I found that opening a second instance of MTK Client helps it connect. Reconnecting the phone on the "Preloader VCOM" step also helps
    3. Flash Tools > Unlock bootloader
      • MTKClient Log should contain messages from sej. If it does not, you must repeat this section
    4. Reboot into fastboot (power+volume down)
    5. Run fastboot flash --disable-verity --disable-verification vbmeta ENGROM/images/vbmeta.img

    Fixing NVRAM WARNING

    1. Boot into the system
    2. Open the dialer app
      • Dial *#06# (no IMEIs should be present)
      • Dial *#*#3646633#*#*
    3. In the special menu
      • Connectivity (swipe left) > CDS Information > Wi-Fi Information > UPDATE MAC

    Flashing the IMEIs

    1. Install MAUI Meta from MauiMETA<...>.zip/MauiMETA<...>.exe
    2. Open MAUIMeta and press Connect
    3. Power off the phone (while plugged in)
    4. Wait for MAUIMeta to connect
    5. Load DB > From Target
    6. Search > "IMEI Download"
      • IMEI1: Your IMEI without the last digit (it is the "checksum")
      • IMEI2: IMEI1 + 1
    7. Press "Disconnect". The phone should boot automatically
    8. Confirm that the IMEIs are there by dialing *#06#
    9. Confirm that you can make phone calls
    10. Power off

    Flashing MIUI

    1. Run SP Flash Tool (don't connect the phone yet)
      1. Go to tab: "Download"
      2. Scatter-loading File: lancelot_global_images<...>/images/MT6768_Android_scatter.txt
      3. Go to tab: "Readback"
      4. Press: "Add"
      5. Double-click on the value in the "File" column
      6. Name the file "dump.img"
      7. Enter the following values:
        • Address: 0x0
        • Length: 0x50400000
      8. Press "Read Back"
      9. Connect the (powered off) phone
    2. Extract the dump.img file with 7-Zip (it will raise errors)
    3. Extract NV.zip into NV/
    4. Copy the files with ids 10,11,14,15,16,17,18,21,35,36 from dump/ to NV/
    5. Remove the numbers (and the dot after the numbers) from all filenames in NV/
    6. Run SP Flash Tool (with bypass)
      • Tab: "Format"
      • Auto format Flash: On
      • Format whole flash except bootloader: On
      • Start
    7. Run SP Flash Tool (with bypass)
      • Tab: "Download"
      • Download-agent: SP_Flash_Tool/DA_6765_6785...
      • Scatter-loading File: NV/MT6768_Android_scatter.txt
      • Authentication File: empty
      • Mode: Download Only
    8. Run SP Flash Tool (with bypass)
      • Tab: "Download"
      • Download-agent: SP_Flash_Tool/DA_6765_6785...
      • Scatter-loading File: lancelot_global_images<...>/MT6768_Android_scatter.txt
      • Authentication File: empty
      • Mode: Download Only
    9. Be sure to remove the SIM card or it will try to update
    10. Reboot
    11. You can now unlock the bootloader as shown before