How to install custom firmware on Xiaomi without unlocking the bootloader: working ways 2026

Introduction: Is it even possible?

Installation of custom firmware on Xiaomi smartphones is traditionally associated with mandatory unlocking of the bootloader - a procedure that requires waiting. 7-30 days, Mi Account binding and device "bricking" risk. 2023–2026 In the past few years, enthusiasts have found loopholes to get around this limitation on some models, and it's important to understand that this isn't about a full-fledged customizable version like LineageOS or Pixel Experience, but rather a modified version. MIUI base-line AOSP, Adapted to work with a blocked bootloader.

The basic principle of such methods is the use of vulnerabilities in the update mechanism. MIUI (For example, through fastboot or EDL-mode) or operating system recovery functions, such as on Qualcomm chipset devices like the Redmi Note. 10 pro POCO X3 Pro) you can temporarily obtain rights to write to the system partition without fully unlocking, but there are critical nuances: such firmware often lacks support OTA-Updates that may conflict with Google services and require manual patching boot.img.

Which Xiaomi models support installation without unlocking?

Not all Xiaomi devices are amenable to this method, but the main compatibility criteria are:

• 🔹 Qualcomm Snapdragon chipset (series) 4xx/6xx/7xx/8xx). Devices on Mediatek (e.g. Redmi Note) 11 or POCO M4 Pro) not normally supported due to closed protocol BROM.
• 🔹 The presence of a vulnerability in fastboot or EDL (Engineering Download Mode. Current exploits are published in forums XDA Developers and 4PDA.
• 🔹 Version. MIUI not newer than 14.0.5 (in new builds Xiaomi has closed part of the spoons to bypass the bootloader).
• 🔹 Lack of hardware protection for Anti-Rollback (e.g. on Mi 11 or Redmi) K40 traversal).

Below is a table with popular models and their support status (data current as of June 2026):

Critical detail: Even if your model is on the list, success depends on the specific board revision and firmware version of EFS. For example, the Redmi Note 10 Pro revision of V13.0.8.0 may not respond to the method that runs on V12.5.3.0.

Preparation of the device: steps before firmware

Before you start installing, you need to perform a number of mandatory actions, neglecting them can lead to soft-brick (the device is turned on, but not booted) or even hard-brick (complete hardware failure).

⚠️ Note: If your device was purchased in China (suffix version) CN), There is a high risk of blocking after firmware due to Xiaomi's region-specific policy. → The phone. → Version. MIUI.

• 📱 Make a full backup of data via adb backup or Mi Cloud. Local backups (for example, via TWRP) It will not help if the device stops loading.
• 🔋 Charge the battery to 80-100%. interruption of the process due to battery discharge can damage the partition super.
• 🖥️ Install Mi Flash Tool (for fastboot method) or QFil (for fastboot method) EDL). Download tools only from official sources (for example, the site Xiaomi).
• 🔑 Unlock. OEM Unlock in Settings → For developers, without it, even the workarounds won't work.

POCO X3 NFC

MIUI

fastboot-rom

Method 1: Installation via fastboot with bypassing the check

This method is suitable for devices on Qualcomm, where you can temporarily disable signature verification. boot.img. The essence of the method - the use of a modified script flash_all.bat, which ignores the blockage errors.

Algorithm of action:

1. Download the archive with the firmware (for example, MIUI EU or Xiaomi.eu) and unpack it in the folder with the Mi Flash Tool.
2. Open up. flash_all.bat In the text editor and replace the line fastboot flash boot boot.img on: fastboot flash boot boot.img --disable-verity --disable-verification
3. Transfer the device to fastboot mode (turn off, then press Volume down + Power).
4. Connect your smartphone to your PC and launch it flash_all.bat on behalf of the administrator.

💡

If the script makes a mistake FAILED (remote:'Flashing is not allowed in Lock State', try using an alternative method with the abl.elf patch. 4PDA for your model.

⚠️ Note: On devices with Dynamic Partition (e.g. Redmi Note 11 Pro)+) This method can damage the userdata partition. Before you run the firmware, run the command: fastboot erase userdata, which will erase all data, but prevent cyclical reboot.

Method 2: Firmware via EDL (Engineering Mode)

EDL (Emergency Download Mode) is a service mode that allows you to write firmware directly to a device’s memory without checking the bootloader, a riskier method, but it works even on devices with a locked fastboot.

To enter the EDL, you need:

1. Turn off your smartphone.
2. Clip the combination Volume up + Volume down + Nutrition (on some models – only Volume up + Nutrition).
3. Connect the device to a PC. Device Manager should appear Qualcomm HS-USB QDLoader 9008.

This will be further required:

• 📂 Download firehose files for your model (e.g, prog_emmc_firehose.mbn).
• 🖥️ Use QFil or Mi Flash Tool in mode EDL.
• 📄 Download modified payload.bin (For example, from Xiaomi.eu with a patch for a blocked bootloader).

EDL

hard reset

Food + Volume up

Solving problems after installation

Even if the firmware is successful, there may be problems, and here are the most common ways to solve them:

If the device doesn’t turn on after firmware (black screen, no vibration), the xbl or abl partition is likely damaged, in which case only flashing through EDL using Xiaomi’s original payload.bin will help.

💡

Before any firmware manipulation, save the original modem, bluetooth, and dsp partitions. These can be backed up via the fastboot getvar all command and the QPST tool.

Alternative methods: TWRP without unlocking

Install TWRP (TeamWin Recovery Project) on a locked boot loader is possible only on a limited number of devices, for example, on Redmi Note 8 Pro (Mediatek) this is possible due to a vulnerability in the preloader, and on POCO F1 - through the exploit dirtycow.

Common algorithm:

1. Download modified recovery.img for your model (look for XDA marked no-verity).
2. Transfer the device to fastboot and execute: fastboot boot twrp.img (this is a temporary boot, not a permanent installation!)
3. In TWRP, scrolle Magisk to get root or install custom firmware via adb sideload.

Limitations of this method:

• 🔄 After the reboot. TWRP It will disappear (you need to reload it).
• 🔐 You can't sew. boot.img dtbo – only modify them on the fly via Magisk.
• 📱 On some devices (e.g., Mi) 10T) This method results in a discharge DRK (Data Recovery Key, which blocks access to encrypted data.

FAQ: Answers to Frequent Questions