diyism/解锁小米redmi k30安装pixel expericence plus, 解锁mi pad 5安装PixelExperience_Plus_nabu

## 解锁小米redmi k30安装pixel expericence plus, 解锁mi pad 5安装PixelExperience_Plus_nabu
1.买来手机进入miui设置里把OEM unlocking和Mi unlock status都解开(需要绑定小米帐号, 可能需要在Settings下第一行退出小米帐号再登录一次),
然后linux下用xiaomitool解锁(https://www.xiaomitool.com/V2/#download):
用usb线连接手机, developer里enable debug
(先my device/all specs/miui version点7次, 而mi pad 5先升级miui 14再my device/detailed info/miui version点7次),
允许该电脑debug, 选择File Transfer模式
sudo ./XMT2_Linux_20.7.28.run
按提示需要等待7天后再试

似乎xiaomitoolv2也失效了, 报missing token cookie, 使用github最新代码:
git clone https://github.com/francescotescari/XiaoMiToolV2
添加一行进入gradle.properties:
org.gradle.jvmargs=-Xmx4096m --add-exports=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED
运行: ./gradlew run

//还有一个miunlock:
//git clone --depth 1 https://github.com/Canny1913/miunlock.git
//cd miunlock
//sudo apt install swig
//pip3 install -r requirements.txt
//python3 main.py

//miunlock也不行了, 只能搞win虚拟机: https://adryanreis.medium.com/how-to-unlock-bootloader-xiaomi-in-linux-857d2f01128e
virtualbox, network settings, adapter 1, attached to bridged adapter
search box, cmd, run as administrator
$ netsh interface ipv4 show config
$ netsh interface ipv4 set address name="Ethernet" static 192.168.0.173 255.255.255.0 192.168.0.101
$ netsh interface ipv4 set dns name="Ethernet" static 192.168.0.101
$ netsh interface ipv4 set dns name="Ethernet" static 192.168.0.101 both

#$ curl https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.1.0.0p1-Beta/OpenSSH-Win64-v9.1.0.0.msi -o OpenSSH-Win64-v9.1.0.0.msi
cd drive / virutalbox guest additions / vboxwindowsadditions-amd64
download OpenSSH-Win64-v9.1.0.0.msi in host linux and install it in vbox shared folder

search box, powershell, run as administrator:
$ Set-Service -Name sshd -StartupType 'Automatic'
$ Start-Service sshd

# we can ssh from host:
$ ssh <windows user name>@192.168.0.173
$ curl https://miuirom.xiaomi.com/rom/u1106245679/6.5.224.28/miflash_unlock-en-6.5.224.28.zip -o miflash_unlock.zip
$ powershell -command "Expand-Archive -Force 'C:\Users\malcolm\Downloads\miflash_unlock.zip' 'C:\Users\malcolm\Downloads\miflash'"

# install fastboot driver:
https://www.qasimtricks.com/2021/03/download-fastboot-fix-driver.html

2.刷recovery(mi pad 5参考: https://en.lurenapp.uk/2023/05/10/nabuinstall/)
刷TWRP-3.5.1_10.0.2-HRAJ_X2.zip(md5sum: 9408cce1603e915948d21728955b6924):
解压zip(有34MB)出来recovery.img(有128MB)
adb reboot bootloader
sudo fastboot devices
sudo fastboot flash recovery recovery.img   # if "waiting for any device", plug to a faster usb port
sudo fastboot oem reboot-recovery           #刷入新系统前不要直接重启进入miui系统, 否则twrp recovery会被miui recovery覆盖

不能采用最新 twrp-3.7.1, 无法正常启动3.7.1, 试了twrp-3.7.0 可以启动但输入密码无法解密/data 分区,
3.7.0 倒是可以第二次adb sideload PixelExperience_Plus_phoenix-10.0-20201205-1849-OFFICIAL.zip 而不像twrp-3.5.1报错:
assert failed: update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")) Updater process ended with ERROR: 7

adb backup --twrp
adb restore backup.ab
定期备份一个系统能正常启动的所有应用的data分区到电脑

//或者刷pixel experience的recovery image(Redmi K30 pixelexp 12 plus):
//https://wiki.pixelexperience.org/devices/phoenix/install/

3.刷PixelExperience_Plus_phoenix-10.0-20201205-1849-OFFICIAL.zip(md5sum 6234d44376163586aea55ec63d5d738e):
电脑上 sudo fastboot oem reboot-recovery        #或者关机后 长按 Volume Up + Power
手机recovery: Wipe, Swipe to factory reset, Back    #只是reset似乎还不行, 需要format data分区, 否则重启后到G图标页面20秒就循环重启
手机recovery: Advanced, Adb sideload, Swipe to sideload
电脑上 sudo adb sideload PixelExperience_Plus_phoenix-10.0-20201205-1849-OFFICIAL.zip     #报没权限的话就先adb kill-server
电脑上 显示 Total xfer: 1.00x                                                              #也可能stop at 47% and report adb: failed to read command: Success. 就是成功了
手机recovery: script succeeded: result was 1.0000 就是系统成功了
手机recovery: Reboot System


boot.img 从Pixel...zip里提取, 供给Magisk应用打补丁(更新Magisk可以直接从应用内打补丁, 第一次需要手动), 然后重启到bootloader用sudo fastboot flash boot magisk_boot.img刷入手机
Magisk v23 has "magisk hide" to cheat bank apps and 1inch app to boot,
Magisk v24 hasn't this function(since the author employed by google), don't upgrade Magisk above v23

进入系统看到pixel experience 指纹解锁/面部识别等都正常,
pixel experience是把自己模拟成pixel 4 xl, photos应用提示可以无限存储照片, 不知道以后会不会被google根据出厂序列号封锁

另外xiaomi k30的屏幕拖影严重, 跟系统或显卡之类无关, 系统已经设置到120Hz了, 拖影的表现就是 白底黑字 的google搜索结果页面每次滚动时黑字会被白背景冲淡,
眼睛很难受, 还不如5年前的nexus 6p的屏幕 黑字滚动时仍是黑字

还需要到google play市场安装Android System Webview Beta,
并在settings/system/developer options/webview implementation里从旧的Android System Webview 74切换到Android System WebView Beta 123,
否则一些依赖webview的应用比如 1inch钱包 会因为XMLHttpRequest blocked by CORS policy: No 'Access-Control-Allow-Origin' header而崩溃

==========================Install AOSP ROM on Xiaomi Mi Pad 5==========================
====Files:
recovery boot: boot_nabu_w-skippkgverification-13-arrow-beta.img                    md5sum:a3d2b1ccaccd1b557e1c67811818984e
recovery vendor boot: vendor_boot_nabu_w-skippkgverification-13-arrow-beta.img      md5sum:a4db68cfd8b3239fc6f19f0ed8498f35

//system image: crDroidAndroid-13.0-20230807-nabu-v9.7.zip                            md5sum:07322472158eb21ce7742d2b56472922
//gapps: NikGapps-core-arm64-13-20230716-signed.zip                                   md5sum:00ce13a63018bb606a6a111a96060e68

system and gapps: PixelExperience_Plus_nabu-13.0-20230717-1238-UNOFFICIAL.zip       md5sum:41a78c1ec1f9d990b934663d32d8fff5

download recovery boot and vendor boot from:
    https://sourceforge.net/projects/kubersharma001/files/nabu/ArrowOS-Recovery/
//download system image from:
//    https://sourceforge.net/projects/crdroid/files/nabu/9.x/
//download gapps from:
//    https://sourceforge.net/projects/nikgapps/files/Releases/NikGapps-T/16-Jul-2023/
download PixelExperience_Plus_nabu from:
    https://t.me/s/MiPad_5?q=pixelexperience

ref: https://forum.xda-developers.com/t/rom-android13-crdroid-official-xiaomi-pad-5-nabu-23th-july-2023.4608397/
ref: https://webcache.googleusercontent.com/search?q=cache:EGWfTp_kwrwJ:https://en.lurenapp.uk/2023/05/10/nabuinstall/
ref: https://archive.li/JpdkG

====Prerequisites:
MIUI 14 firmware or MIUI 14 ROM
Latest platform-tools
Unlocked bootloader(miflash and wait for 7 days)

====Flashing Arrow Recovery
Ensure that you have booted into Fastboot mode
Power off first, then power button + volume down
Verify Connection
"adb devices" for recovery and sideload, "fastboot devices" for fastboot
$ fastboot devices
$ fastboot -w # This will wipe and restore all data partitions on the device, ignore error "Cannot generate image for userdata"
$ fastboot flash boot boot_nabu_w-skippkgverification-13-arrow-beta.img
$ fastboot flash vendor_boot vendor_boot_nabu_w-skippkgverification-13-arrow-beta.img

Reboot into Arrow Recovery and Verify Proper Connection to Recovery
Note: There is an issue with the recovery of Xiaomi Pad 5 not being able to present the UI panel, but recovery works normally.
$ fastboot reboot recovery
wait for 10 seconds to reboot to recovery mode, use "adb devices" to check if done

====Flashing system
ADB Sideload ROM
Support KernelSU so you needn't to install magisk.
$ adb reboot sideload #if multiple android devices connetcted to linux, should specify device: adb -s 64907d7d reboot sideload
//$ adb sideload crDroidAndroid-13.0-20230807-nabu-v9.7.zip #specify device: adb -s 64907d7d sideload crDroidAndroid-13.0-20230807-nabu-v9.7.zip
//if successful: Total xfer: 1.00x

//$ adb reboot sideload  #specify device: adb -s 64907d7d reboot sideload
//$ adb sideload NikGapps-core-arm64-13-20230716-signed.zip #specify device: adb -s 64907d7d sideload NikGapps-core-arm64-13-20230716-signed.zip
//if successful: Total xfer: 1.00x (maybe stop at 47%, it's a bug but in fact it's successful)

It seems crDroid has bug for some apps, so use PixelExperience_Plus_nabu UNOFFICIAL
If have sideload the crDroid, need to redo "fastboot -w , fastboot flash boot and fastboot flash vendor_boot"
$ adb sideload PixelExperience_Plus_nabu-13.0-20230717-1238-UNOFFICIAL.zip

Now "adb devices" can see the device is in recovery mode
Wipe Data and Reboot, then Enjoy
$ adb shell recovery --wipe_data # Wipes data in shell mode
$ adb reboot # Reboots to system
	1.买来手机进入miui设置里把OEM unlocking和Mi unlock status都解开(需要绑定小米帐号, 可能需要在Settings下第一行退出小米帐号再登录一次),
	然后linux下用xiaomitool解锁(https://www.xiaomitool.com/V2/#download):
	用usb线连接手机, developer里enable debug
	(先my device/all specs/miui version点7次, 而mi pad 5先升级miui 14再my device/detailed info/miui version点7次),
	允许该电脑debug, 选择File Transfer模式
	sudo ./XMT2_Linux_20.7.28.run
	按提示需要等待7天后再试

	似乎xiaomitoolv2也失效了, 报missing token cookie, 使用github最新代码:
	git clone https://github.com/francescotescari/XiaoMiToolV2
	添加一行进入gradle.properties:
	org.gradle.jvmargs=-Xmx4096m --add-exports=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED
	运行: ./gradlew run

	//还有一个miunlock:
	//git clone --depth 1 https://github.com/Canny1913/miunlock.git
	//cd miunlock
	//sudo apt install swig
	//pip3 install -r requirements.txt
	//python3 main.py

	//miunlock也不行了, 只能搞win虚拟机: https://adryanreis.medium.com/how-to-unlock-bootloader-xiaomi-in-linux-857d2f01128e
	virtualbox, network settings, adapter 1, attached to bridged adapter
	search box, cmd, run as administrator
	$ netsh interface ipv4 show config
	$ netsh interface ipv4 set address name="Ethernet" static 192.168.0.173 255.255.255.0 192.168.0.101
	$ netsh interface ipv4 set dns name="Ethernet" static 192.168.0.101
	$ netsh interface ipv4 set dns name="Ethernet" static 192.168.0.101 both

	#$ curl https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.1.0.0p1-Beta/OpenSSH-Win64-v9.1.0.0.msi -o OpenSSH-Win64-v9.1.0.0.msi
	cd drive / virutalbox guest additions / vboxwindowsadditions-amd64
	download OpenSSH-Win64-v9.1.0.0.msi in host linux and install it in vbox shared folder

	search box, powershell, run as administrator:
	$ Set-Service -Name sshd -StartupType 'Automatic'
	$ Start-Service sshd

	# we can ssh from host:
	$ ssh <windows user name>@192.168.0.173
	$ curl https://miuirom.xiaomi.com/rom/u1106245679/6.5.224.28/miflash_unlock-en-6.5.224.28.zip -o miflash_unlock.zip
	$ powershell -command "Expand-Archive -Force 'C:\Users\malcolm\Downloads\miflash_unlock.zip' 'C:\Users\malcolm\Downloads\miflash'"

	# install fastboot driver:
	https://www.qasimtricks.com/2021/03/download-fastboot-fix-driver.html

	2.刷recovery(mi pad 5参考: https://en.lurenapp.uk/2023/05/10/nabuinstall/)
	刷TWRP-3.5.1_10.0.2-HRAJ_X2.zip(md5sum: 9408cce1603e915948d21728955b6924):
	解压zip(有34MB)出来recovery.img(有128MB)
	adb reboot bootloader
	sudo fastboot devices
	sudo fastboot flash recovery recovery.img # if "waiting for any device", plug to a faster usb port
	sudo fastboot oem reboot-recovery #刷入新系统前不要直接重启进入miui系统, 否则twrp recovery会被miui recovery覆盖

	不能采用最新 twrp-3.7.1, 无法正常启动3.7.1, 试了twrp-3.7.0 可以启动但输入密码无法解密/data 分区,
	3.7.0 倒是可以第二次adb sideload PixelExperience_Plus_phoenix-10.0-20201205-1849-OFFICIAL.zip 而不像twrp-3.5.1报错:
	assert failed: update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")) Updater process ended with ERROR: 7

	adb backup --twrp
	adb restore backup.ab
	定期备份一个系统能正常启动的所有应用的data分区到电脑

	//或者刷pixel experience的recovery image(Redmi K30 pixelexp 12 plus):
	//https://wiki.pixelexperience.org/devices/phoenix/install/

	3.刷PixelExperience_Plus_phoenix-10.0-20201205-1849-OFFICIAL.zip(md5sum 6234d44376163586aea55ec63d5d738e):
	电脑上 sudo fastboot oem reboot-recovery #或者关机后长按 Volume Up + Power
	手机recovery: Wipe, Swipe to factory reset, Back #只是reset似乎还不行, 需要format data分区, 否则重启后到G图标页面20秒就循环重启
	手机recovery: Advanced, Adb sideload, Swipe to sideload
	电脑上 sudo adb sideload PixelExperience_Plus_phoenix-10.0-20201205-1849-OFFICIAL.zip #报没权限的话就先adb kill-server
	电脑上显示 Total xfer: 1.00x #也可能stop at 47% and report adb: failed to read command: Success. 就是成功了
	手机recovery: script succeeded: result was 1.0000 就是系统成功了
	手机recovery: Reboot System


	boot.img 从Pixel...zip里提取, 供给Magisk应用打补丁(更新Magisk可以直接从应用内打补丁, 第一次需要手动), 然后重启到bootloader用sudo fastboot flash boot magisk_boot.img刷入手机
	Magisk v23 has "magisk hide" to cheat bank apps and 1inch app to boot,
	Magisk v24 hasn't this function(since the author employed by google), don't upgrade Magisk above v23

	进入系统看到pixel experience 指纹解锁/面部识别等都正常,
	pixel experience是把自己模拟成pixel 4 xl, photos应用提示可以无限存储照片, 不知道以后会不会被google根据出厂序列号封锁

	另外xiaomi k30的屏幕拖影严重, 跟系统或显卡之类无关, 系统已经设置到120Hz了, 拖影的表现就是白底黑字的google搜索结果页面每次滚动时黑字会被白背景冲淡,
	眼睛很难受, 还不如5年前的nexus 6p的屏幕黑字滚动时仍是黑字

	还需要到google play市场安装Android System Webview Beta,
	并在settings/system/developer options/webview implementation里从旧的Android System Webview 74切换到Android System WebView Beta 123,
	否则一些依赖webview的应用比如 1inch钱包会因为XMLHttpRequest blocked by CORS policy: No 'Access-Control-Allow-Origin' header而崩溃

	==========================Install AOSP ROM on Xiaomi Mi Pad 5==========================
	====Files:
	recovery boot: boot_nabu_w-skippkgverification-13-arrow-beta.img md5sum:a3d2b1ccaccd1b557e1c67811818984e
	recovery vendor boot: vendor_boot_nabu_w-skippkgverification-13-arrow-beta.img md5sum:a4db68cfd8b3239fc6f19f0ed8498f35

	//system image: crDroidAndroid-13.0-20230807-nabu-v9.7.zip md5sum:07322472158eb21ce7742d2b56472922
	//gapps: NikGapps-core-arm64-13-20230716-signed.zip md5sum:00ce13a63018bb606a6a111a96060e68

	system and gapps: PixelExperience_Plus_nabu-13.0-20230717-1238-UNOFFICIAL.zip md5sum:41a78c1ec1f9d990b934663d32d8fff5

	download recovery boot and vendor boot from:
	https://sourceforge.net/projects/kubersharma001/files/nabu/ArrowOS-Recovery/
	//download system image from:
	// https://sourceforge.net/projects/crdroid/files/nabu/9.x/
	//download gapps from:
	// https://sourceforge.net/projects/nikgapps/files/Releases/NikGapps-T/16-Jul-2023/
	download PixelExperience_Plus_nabu from:
	https://t.me/s/MiPad_5?q=pixelexperience

	ref: https://forum.xda-developers.com/t/rom-android13-crdroid-official-xiaomi-pad-5-nabu-23th-july-2023.4608397/
	ref: https://webcache.googleusercontent.com/search?q=cache:EGWfTp_kwrwJ:https://en.lurenapp.uk/2023/05/10/nabuinstall/
	ref: https://archive.li/JpdkG

	====Prerequisites:
	MIUI 14 firmware or MIUI 14 ROM
	Latest platform-tools
	Unlocked bootloader(miflash and wait for 7 days)

	====Flashing Arrow Recovery
	Ensure that you have booted into Fastboot mode
	Power off first, then power button + volume down
	Verify Connection
	"adb devices" for recovery and sideload, "fastboot devices" for fastboot
	$ fastboot devices
	$ fastboot -w # This will wipe and restore all data partitions on the device, ignore error "Cannot generate image for userdata"
	$ fastboot flash boot boot_nabu_w-skippkgverification-13-arrow-beta.img
	$ fastboot flash vendor_boot vendor_boot_nabu_w-skippkgverification-13-arrow-beta.img

	Reboot into Arrow Recovery and Verify Proper Connection to Recovery
	Note: There is an issue with the recovery of Xiaomi Pad 5 not being able to present the UI panel, but recovery works normally.
	$ fastboot reboot recovery
	wait for 10 seconds to reboot to recovery mode, use "adb devices" to check if done

	====Flashing system
	ADB Sideload ROM
	Support KernelSU so you needn't to install magisk.
	$ adb reboot sideload #if multiple android devices connetcted to linux, should specify device: adb -s 64907d7d reboot sideload
	//$ adb sideload crDroidAndroid-13.0-20230807-nabu-v9.7.zip #specify device: adb -s 64907d7d sideload crDroidAndroid-13.0-20230807-nabu-v9.7.zip
	//if successful: Total xfer: 1.00x

	//$ adb reboot sideload #specify device: adb -s 64907d7d reboot sideload
	//$ adb sideload NikGapps-core-arm64-13-20230716-signed.zip #specify device: adb -s 64907d7d sideload NikGapps-core-arm64-13-20230716-signed.zip
	//if successful: Total xfer: 1.00x (maybe stop at 47%, it's a bug but in fact it's successful)

	It seems crDroid has bug for some apps, so use PixelExperience_Plus_nabu UNOFFICIAL
	If have sideload the crDroid, need to redo "fastboot -w , fastboot flash boot and fastboot flash vendor_boot"
	$ adb sideload PixelExperience_Plus_nabu-13.0-20230717-1238-UNOFFICIAL.zip

	Now "adb devices" can see the device is in recovery mode
	Wipe Data and Reboot, then Enjoy
	$ adb shell recovery --wipe_data # Wipes data in shell mode
	$ adb reboot # Reboots to system