MlgmXyysd / Xiaomi-HyperOS-BootLoader-Bypass

A PoC that exploits a vulnerability to bypass the Xiaomi HyperOS community restrictions of BootLoader unlocked account bindings.
https://www.neko.ink/
2.57k stars 295 forks source link

adb-darwin: invalid transport id #30

Open ekanshsinghal opened 8 months ago

ekanshsinghal commented 8 months ago
[2024-01-17] [10:59:37] [INFO] - * Xiaomi HyperOS BootLoader Bypass *
[2024-01-17] [10:59:37] [INFO] - * By NekoYuzu          Version 1.0 *
[2024-01-17] [10:59:37] [INFO] - ************************************
[2024-01-17] [10:59:37] [INFO] - GitHub: https://github.com/MlgmXyysd
[2024-01-17] [10:59:37] [INFO] - XDA: https://xdaforums.com/m/mlgmxyysd.8430637
[2024-01-17] [10:59:37] [INFO] - X (Twitter): https://x.com/realMlgmXyysd
[2024-01-17] [10:59:37] [INFO] - PayPal: https://paypal.me/MlgmXyysd
[2024-01-17] [10:59:37] [INFO] - My Blog: https://www.neko.ink/
[2024-01-17] [10:59:37] [INFO] - ************************************
[2024-01-17] [10:59:37] [INFO] - Starting ADB server...
[2024-01-17] [10:59:38] [INFO] - Processing device 85986346(device:liuqin)...
[2024-01-17] [10:59:38] [INFO] - Finding BootLoader unlock bind request...
[2024-01-17] [10:59:38] [INFO] * Now you can bind account in the developer options.
adb-darwin: invalid transport id
[2024-01-17] [10:59:38] [INFO] - Refactoring parameters...
PHP Fatal error:  Uncaught TypeError: decryptData(): Argument #1 ($data) must be of type string, null given, called in /Users/ekansh/bypass.php on line 330 and defined in /Users/ekansh/bypass.php:228
Stack trace:
#0 /Users/ekansh/bypass.php(330): decryptData(NULL)
#1 {main}
  thrown in /Users/ekansh/bypass.php on line 228

Fatal error: Uncaught TypeError: decryptData(): Argument #1 ($data) must be of type string, null given, called in /Users/ekansh/bypass.php on line 330 and defined in /Users/ekansh/bypass.php:228
Stack trace:
#0 /Users/ekansh/bypass.php(330): decryptData(NULL)
#1 {main}
  thrown in /Users/ekansh/bypass.php on line 228
dex2oat commented 8 months ago
[2024-01-17] [10:59:37] [INFO] - * Xiaomi HyperOS BootLoader Bypass *
[2024-01-17] [10:59:37] [INFO] - * By NekoYuzu          Version 1.0 *
[2024-01-17] [10:59:37] [INFO] - ************************************
[2024-01-17] [10:59:37] [INFO] - GitHub: https://github.com/MlgmXyysd
[2024-01-17] [10:59:37] [INFO] - XDA: https://xdaforums.com/m/mlgmxyysd.8430637
[2024-01-17] [10:59:37] [INFO] - X (Twitter): https://x.com/realMlgmXyysd
[2024-01-17] [10:59:37] [INFO] - PayPal: https://paypal.me/MlgmXyysd
[2024-01-17] [10:59:37] [INFO] - My Blog: https://www.neko.ink/
[2024-01-17] [10:59:37] [INFO] - ************************************
[2024-01-17] [10:59:37] [INFO] - Starting ADB server...
[2024-01-17] [10:59:38] [INFO] - Processing device 85986346(device:liuqin)...
[2024-01-17] [10:59:38] [INFO] - Finding BootLoader unlock bind request...
[2024-01-17] [10:59:38] [INFO] * Now you can bind account in the developer options.
adb-darwin: invalid transport id
[2024-01-17] [10:59:38] [INFO] - Refactoring parameters...
PHP Fatal error:  Uncaught TypeError: decryptData(): Argument #1 ($data) must be of type string, null given, called in /Users/ekansh/bypass.php on line 330 and defined in /Users/ekansh/bypass.php:228
Stack trace:
#0 /Users/ekansh/bypass.php(330): decryptData(NULL)
#1 {main}
  thrown in /Users/ekansh/bypass.php on line 228

Fatal error: Uncaught TypeError: decryptData(): Argument #1 ($data) must be of type string, null given, called in /Users/ekansh/bypass.php on line 330 and defined in /Users/ekansh/bypass.php:228
Stack trace:
#0 /Users/ekansh/bypass.php(330): decryptData(NULL)
#1 {main}
  thrown in /Users/ekansh/bypass.php on line 228

change it in the code. In line 279 of bypass.php, change true to false, which means that instead of adb's -t, use -s. It is written in another adb.php.

ekanshsinghal commented 7 months ago
[2024-01-18] [13:52:55] [INFO] - Starting ADB server...
[2024-01-18] [13:52:55] [INFO] - Processing device 85986346(device:liuqin)...
[2024-01-18] [13:52:55] [INFO] - Finding BootLoader unlock bind request...
[2024-01-18] [13:52:55] [INFO] * Now you can bind account in the developer options.
[2024-01-18] [13:53:24] [INFO] - Account bind request found! Let's block it.
[2024-01-18] [13:53:24] [INFO] - Refactoring parameters...
[2024-01-18] [13:53:24] [INFO] - Sending POST request...
[2024-01-18] [13:53:26] [INFO] - Target account: 6702717840
[2024-01-18] [13:53:26] [INFO] - Account bound successfully, wait time can be viewed in the unlock tool.

After this, still not able to add account - WhatsApp Image 2024-01-18 at 07 49 28_39a26b78

dex2oat commented 7 months ago

wait time can be viewed in the unlock tool.

unlock tool,"https://en.miui.com/unlock/index.html",It shows waiting for 168 hours, which means it is successful. It can be unlocked after 168 hours

MlgmXyysd commented 7 months ago

It is normal to show binding failure in the device, please use the unlocking tool to check

tux-86 commented 7 months ago

Same bug is also in linux, but with a code change suggested by dex2oat, I finally got the script working.