When a frightening message appears on the smartphone screen, “Device locked,” it can take anyone using Xiaomi technology by surprise, most often after resetting to factory settings or flashing the device when FRP (Factory Reset Protection) is triggered, at which point the phone requires you to enter the Google or Mi Account data that was previously used on the device, and without them access to the system is completely closed.
However, there is a method that allows you to bypass the lock or access settings through a hidden menu, which is caused by a combination of codes in the emergency call section.This method is not 100% guaranteed for all versions of MIUI and HyperOS, as manufacturers constantly close vulnerabilities, but it remains one of the most effective options for regaining control over the gadget without using complex software on a PC.
It is important to understand that manipulation of system code requires accuracy and care. An error in the sequence of actions can lead to the fact that the input window closes and the procedure has to be started again. Below we will discuss in detail the algorithm of actions, the necessary preparatory steps and technical nuances that will help you cope with the lock.
Reasons for blocking and the principle of FRP protection
The main reason for the message is the theft protection mechanism introduced by Google and adapted by Android smartphone manufacturers. When a user resets a device via Recovery Menu (a combination of volume and power buttons) or uses specialized reset utilities, the system marks the current state as “suspicious.”
The next time you download, Bootloader checks the integrity of the signatures and the status of the accounts. If it is found that the reset was not made through the standard settings menu, FRP Lock is activated. The system blocks access to the desktop, requiring proof of identity of the owner, this is done so that the stolen phone can not simply be re-fished and sold.
⚠️ Note: Using someone else’s Google account to bypass security is a violation of the law and this instruction is intended solely to restore access to your own device if you have forgotten your credentials.
There are several layers of locking. The first layer is Locked Bootloader, which prevents custom firmware from being installed. The second layer is FRP, which blocks login. The emergency call method is designed to bypass the second layer, allowing you to access the browser or Wi-Fi settings for further flashing or resetting.
The effectiveness of the method depends on the Android version and the security patch. On older versions of MIUI 11-12, vulnerabilities are more common, while MIUI 14 and HyperOS have more stringent checks. However, the attempt is worth it, since this is the only way to act directly from the phone screen without a computer.
Preparation for the release procedure
Before you start typing, you need to make sure that the device is ready to be manipulated, and locking often occurs at the initial setup, when the phone offers to select a language and connect to Wi-Fi, and that's where the entry point is.
You'll need a stable Internet connection if you plan to use the method to change. DNS or loading auxiliary APK-Files, Wi-Fi is critical, and make sure that the battery is at least as high as the battery. 40-50%, So that the device does not turn off at the most inopportune moment.
- 📱 Charge your smartphone to at least half to avoid sudden shutdowns during code entry.
- 📶 Prepare data from your Wi-Fi network as the internet will be needed to activate workarounds.
- 🧠 Remember or record the sequence of actions, as the input window may close automatically.
- 🔌 Have a cable on hand USB, If you need an emergency connection to the PC to transfer files.
If you can choose a language on the greeting screen, be sure to set up Russian or English, which will make it easier to navigate the menu, which can open after you successfully type in a command, and in some cases, the interface may be partially cropped, and understanding the basic terms will help you navigate.
☑️ Ready to unlock
Algorithm of actions through the emergency call menu
The most common way to get into a hidden menu is by using the emergency call feature on the welcome screen, where the phone asks you to insert it. SIM-A card or a network connection, usually has an Emergency Call button, and by clicking on it, we can access the phone book and dial the number.
There are several universal codes that can work on Xiaomi devices: enter one of the following codes in the dial box: ##4636##, ##6484## or ##225#. The first code opens the test menu, the second one opens the CIT engineering menu, the third one can call up balance information (which we don’t need, but the system’s response is checked).
If #4636## has worked, you'll see the Test menu, and you'll find Usage statistics or Wi-Fi. You can accidentally (or deliberately) call a pop-up asking you to open the Settings app or browser, and that's the goal of breaking out of the lock screen.
Sequence of action:
1. Press "Emergency call."
2 Enter code ##4636##
3. Select "Wi-Fi Information" or "Use Statistics".
4. Press three dots (menu) in the corner of the screen.
5. Select "Send Review" or "Share".Once you have selected the option to share or send, the system can offer you a choice of application to send. If you have Settings or Chrome browser on the list, select them. Once you have setup, you can access the About Phone section or start a browser to download. APK-launcher or reset utility FRP.
What if the code doesn't work?
Alternative methods and use of TalkBack
If the test menu doesn't open, TalkBack's accessibility feature can help, but activating it through the welcome screen often allows you to access settings. On some versions of MIUI, swipe your two fingers across the screen or draw an "L" (depending on the version) quickly enough.
When you activate TalkBack, you'll hear voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-activated voice-tapping, and your task is to reach TalkBack's settings, and in some cases, you'll find a link to help or learning that opens Google's browser. Once in the browser, you can enter a download request. APK-dumper FRP (for example, FRP Bypass APK).
| Method | Difficulty | Efficiency at MIUI 12+ | Risk of discharge |
|---|---|---|---|
| Code ##4636## | Low. | Medium | Low. |
| Activation of TalkBack | Tall. | Tall. | Medium. |
| Google Assistant | Medium | Low. | Low. |
| Keyboard Connection (OTG) | Medium | Tall. | Low. |
Another option is to use Google Assistant, and if there is an assistant button on the locked screen (or it is called by the volume button), try saying, "Open settings" or "Enable TalkBack." However, on locked devices, the assistant's functionality is often stripped down.
It is also worth mentioning the method of connection. USB-keyboard OTG-Adapter: By connecting the keyboard, you can try calling the task manager or the menu of recent applications with key combinations (for example, Alt).+Tab or menu button, which sometimes allows you to switch to a running setup process.
💡
If you have OTG-cable, connect a computer keyboard, which will make it much easier to type and navigate if the touch screen is not working properly or locked.
Actions after successful blocking bypass
Suppose you managed to open a browser or settings. What do you do next? The main goal is to reset the Google account data that the phone requires. The most reliable way is to download and install an FRP reset application (for example, FRP Bypass or specialized APKs for your version of Android).
Once you install this app, you can add a new Google account or completely delete old accounts from the system. Go to Settings → Accounts and Sync. Delete any suspicious or old accounts. Only then will the device reboot be successful without asking for a password.
If you can’t download a file through your browser, try using the Send Review feature in the testing menu to open a standard browser, and search for “download chrome apk” or “google apk.” Once you install the browser, you will get full Internet access.
⚠️ Warning: After a successful login, be sure to complete a full reset via the settings menu (Settings) → Advanced settings → Recovery and reset) to clear traces of temporary bypass files.
It's important to act quickly. Some temporary security holes close minutes after opening or when you lose your Internet connection. APK-file on another device to quickly copy or manually enter.
💡
The main goal after logging into the menu is to remove an old Google account from your sync settings or install it. APK-file-reset FRP.
Frequent mistakes and ways to solve them
One of the most common problems is that when you enter the code, nothing happens, or the window closes immediately, which may mean that your firmware version is protected from such calls, in which case, try changing the interface language to English before entering the code, which sometimes changes the system's response.
Another mistake is trying to enter the code too slowly, so the system may take the pauses as the end of the input and try to make a call. Type ##4636## quickly and confidently. If the phone says "Call," then the code is not recognized as the system command.
If the screen goes out or locks during the process, it may be due to a screen timeout.Try to constantly touch the display to keep it active.In some cases, it helps to quickly press the lock button to unlock it again without interrupting the process.
- 🚫 Don’t try to enter codes indefinitely after 5-10 Failed attempts can block the input for an hour.
- 🔄 Rebooting the device often resets the time states, allowing the method to be tried again.
- 🌐 Lack of internet may prevent some system links from being opened, check connection.
Xiaomi is constantly updating security, and methods that work today may be closed in tomorrow’s update, and if none of the software methods work, you can go to the service center or use paid boxes to unlock.