Why TWRP is coming to Xiaomi: a full analysis of the problem

The situation when after a successful installation of a custom recavator, Xiaomi device spontaneously returns to the drain state is familiar to many enthusiasts of the Android modification. The user performs all the actions according to the instructions, receives superuser rights, but after the first reboot finds that the TWRP has disappeared, and with it access to advanced system functions. This phenomenon causes natural bewilderment, since in theory the recavery should remain in place until forced replacement.

The fundamental reason lies in the security architecture of modern mobile processors and the logic of the Bootloader. Electronics manufacturers, including Xiaomi, implement mechanisms for automatic verification of the integrity of system partitions at each start of the device, if the system detects changes in critical areas that were not authorized by the digital signature of the manufacturer, it can initiate a self-healing procedure.

In this article, we will discuss the technical aspects of the problem, the difference between sections A and B, and offer proven methods of bypassing locks. Understanding the processes under the hood of your operating system will avoid repeating errors and preserve the installed modifications. The key factor is often not a mistake in the user’s actions, but an automatic security mechanism that needs to be properly circumvented.

Automatic recovery mechanism for stock recovery

The main culprit behind the disappearance of the custom recavator is the built-in protection of the Android operating system, which checks the hash sums of system files. When you load the device, a special script compares the current state of the recovery partition with the reference value sewn into the bootloader. If a discrepancy is found, the system considers this a violation of integrity and replaces the modified file with the original version from the protected /vendor or /system partition.

This process is often called self-repair or auto-reb, and it activates not only when you fully reboot, but sometimes when you exit deep sleep, if the energy saving settings trigger a recheck of checksums, and it works particularly aggressively on devices with Verity Boot enabled, which requires digital signatures for all partitions that are being changed.

It’s worth noting that on some Redmi and Poco models with MediaTek processors or new Snapdragon chips, the logic may be different, where the replacement may not be through a direct overwrite file, but through switching the active download slot to one where the factory configuration is stored, which is why standard installation via fastboot often only gives a temporary result.

⚠️ Warning: Attempts to disable the integrity check mechanism without unlocking the bootloader can lead to complete inoperability of the device (brick.

The problem of A/B sections on modern smartphones

Modern flagships and many mid-range Xiaomi models have moved to a seamless update scheme known as the A/B Partition Scheme, meaning system data is duplicated into two independent sets of partitions: Slot A and Slot B. At any given time, only one of them is active, while the second is in sleep mode and awaits an update.

When you flash TWRP through the fastboot flash recovery command twrp.img, you often only write the image to an active slot (like A). However, the next time you reboot, the bootloader can switch to a B slot where the stock recap is still standing, creating the illusion that the custom firmware has “flyed off,” when in fact you’re just booting from a backup.

To solve this problem, you need to stitch the image of the recovery into both slots simultaneously or forcefully switch between them for verification, and ignoring this feature of the architecture leads to a cyclical reboot or a constant return to factory settings after each turn on cycle.

Impact of MIUI and HyperOS updates on custom software

Receipt OTA-Over-The-Air is one of the most common causes of loss of rights to superusers and custom recavers. MIUI If you find a modified boot or recovery partition, the updater may either refuse to install the update or, worse, force the modified files to be replaced with stock ones to ensure stability.

In addition, some shell versions contain scripts that run immediately after the updated system is first turned on. These scripts scan for non-standard downloaders and can initiate a quiet reinstallation of the stock recovery image in the background, which the user notices only when he tries to log into the receptacles to install a patch or backup.

To avoid this, experienced users recommend disabling automatic system updates and downloading full firmware manually, and there is a practice of installing patches that hide the presence of modifications from the system updates, but this requires a deep knowledge of editing system files.

💡

Always make a full backup of the EFS and Persist section before any manipulation of the recovery, as their loss can lead to the disappearance of the IMEI and sensors.

Blocking the bootloader and checking signatures

The Locked Bootloader is the main barrier that prevents TWRP from gaining a foothold in the system. Until the bootloader status is changed to Unlocked, any attempts to write to the recovery section will either be blocked at the fastboot level or rolled back by the system at start. Xiaomi's digital signature requires that any executable code in critical sections be signed with an official key.

Even if you manage to install the modified image on the locked bootloader in some way (which is extremely difficult and rarely possible on new models), the system will check the signature when downloading. A signature mismatch will cause a verification error, and the device will either not boot or automatically restore the original file from the hidden recovery partition that cannot be deleted by conventional methods.

The process of unlocking through the official Mi Unlock Tool app drops all data from the device, but this is a necessary sacrifice to gain full control of the device. Without this step, any further steps to install custom software are doomed to failure due to the security mechanisms of Secure Boot.

Installation errors and version incompatibility

A common cause of instability is the use of a TWRP image that is not specifically designed for your device model. Even small differences in hardware (for example, different screens or memory modules in the Global and China versions) can lead to malfunctioning of the recovery, in which case the system may perceive this as a critical error and initiate a rollback.

Older versions of TWRP may not work properly with the f2fs file system used in newer versions of Android on Xiaomi devices. If the recovery can’t properly mount data partitions, it may not retain its status or cause errors when trying to write, which leads to resetting.

Incorrect firmware sequences also play a role, for example, if you don’t execute fastboot boot twrp.img before the final installation, the old recovery may have time to start and overwrite the new file before the user can pin the result through the installation menu.

Instructions: how to permanently fix TWRP on Xiaomi

To make the custom recavator stop flying, you need to install the installation taking into account all the features of the A/B partitions and protection mechanisms. Below is an algorithm of actions that minimizes the risk of rollback. First, make sure that the loader is unlocked and the phone is in Fastboot mode.

The first step is to load the temporary receptacles with the command fastboot boot twrp.img. This will allow you to run TWRP without writing to disk. After downloading to the recaptamer menu, go to Advanced and select Flash Current TWRP (or use the adb sideload command to install the zip archive with the installer). This step is critical, since it prescribes the receptacles to permanent memory from inside the recovery environment itself.

If you have an A/B partitioned device, you need to switch the active slot after installation. At the TWRP terminal or through the ADB, command the slot to switch, then repeat the installation procedure for the second slot to ensure that any boot scenario is safe.

fastboot flash recovery twrp.img


fastboot boot twrp.img



Next Next post: TWRP Advanced -> Flash Current TWRP

⚠️ Note: If after all the manipulations TWRP Continues to fly, check if the “Find Device” function is activated in the Mi Account. It can block changing system partitions even on the unlocked bootloader.

Additional factors and rare cases

There are less obvious reasons why custom software may go missing, such as installing some root rights management or deep-access antiviruses that may conflict with a modified bootloader, who may view changes to the recovery section as a security threat and try to “cure” the system by returning stock files.

Also worth mentioning is physical memory wear, where if a device's flash memory has damaged blocks in the area where the recovery partition is stored, the recording can be successful, but the data will quickly corrupt, in which case the device may behave unstable, and firmware attempts will have a temporary effect.

In rare cases, devices with MediaTek processors have SLA/DA Auth protection, which requires specific tools to bypass each flash. Unless the correct method of bypassing authorization is used, writing to secure areas may not physically occur, despite a report of successful completion of the operation in the logs.