Abstract: As Xiaomi Corporation's (hereinafter referred to as 'Xiaomi') first product to return to the tablet market, the Xiaomi Pad 5 (hereinafter referred to as 'Mi Pad 5') is of great significance to Xiaomi. However, Xiaomi has not paid sufficient attention at the system level to the Mi Pad 5, or even to the products across its entire tablet line. Based on this, some highly skilled independent developers have made the systems of new models into Mi Pad 5 port packages for others to flash and use.
Everything carries risk, and flashing is no exception. The flashing risk discussed in this article refers to the situation where an operational error causes a device's fastboot and recovery to disappear together, thereby entering the Qualcomm 9008 state, as well as methods for self-rescue after entering the 9008 state.

Keywords: flashing Xiaomi Pad 5 9008

I. Introduction to Related Terms

1. fastboot mode
   　　fastboot mode, abbreviated as fastboot or fb, refers to the mode the device is in when a computer is used to flash a ROM package to the device, i.e. 'fastboot flashing'. Normally, you only need to press and hold the power button and volume down button simultaneously while the device is off, or tap restart while the device is on and then press and hold the volume down button, to enter fastboot mode.
2. recovery mode
   　　recovery mode, abbreviated as rec, here specifically refers to twrp. twrp is a third-party recovery mode, equivalent to the Windows PE system on a computer, and is a simple operating system specifically used for flashing. The act of a user using twrp to flash a ROM package to a device is also called recovery flashing.
   　　It is worth noting that different Android versions require the corresponding version of twrp; otherwise, the data partition cannot be decrypted. As mentioned earlier, rec is equivalent to a simple operating system. Google has encrypted the data partition since Android 6.0 and above. Users need to enter the Android system's lock screen password in twrp to access files in the Android partition. If the data partition cannot be decrypted, the recovery flashing operation cannot be completed.
3. 9008 mode
   　　9008 mode, also known as Qualcomm 9008 mode, is a low-level flashing mode built into Qualcomm's Snapdragon chips. Entering this mode usually means that the device's fastboot and fastbootd images have been damaged or cleared, and devices in this mode usually need to be flashed using Qualcomm 9008 software.
   　　After the Xiaomi Mi 8, Xiaomi imposed some restrictions on 9008 mode, namely that when performing 9008 flashing in Xiaomi's official flashing software miflash, it verifies an after-sales account with 9008 flashing permission. If the corresponding permission is not detected, miflash will automatically stop the flashing operation.
   　　Therefore, when a Xiaomi device enters 9008 mode, the usual practice is for users to ask someone with an after-sales account to remotely connect to a computer for authorization, or to send the device to Xiaomi after-sales, where after-sales staff help flash it.
   　　It should be noted that having someone else authorize or flash on your behalf is usually paid, and the specific price is determined by the other party.
4. BootLoader lock
   　　BootLoader lock, also known as bootloader lock, abbreviated as BL lock. Unlocking the BL lock, commonly known as 'unlocking', is a necessary prerequisite for all flashing. After 'unlocking', the device will be able to flash third-party system images. If a flashing operation is performed without 'unlocking' the device, BL will check the digital signature of boot (the boot file), causing the Android kernel to fail to load into RAM, and therefore the system cannot start.
   　　If a user has an after-sales account with 9008 flashing permission, they can also flash system images without 'unlocking', but usually only official systems can be flashed. This method is suitable for downgrading official systems. If there is a need to flash a third-party system, it is still necessary to 'unlock' first.
   　　It should be noted that after the device is 'unlocked', all user data in the system will be cleared. Therefore, making a backup is very important. The specific method for backing up data will not be repeated here.

II. Bypassing 9008 Flashing Permission to Unlock (Taking Xiaomi Pad 5 as an Example)

1. Principle
   　　The author consulted relevant materials and found that in 9008 mode, the computer relies on the 【prog_ufs_firehose_sdm855_ddr.elf】 file in the ROM package to write all files in the ROM package into the phone in sequence according to the xml configuration code, thereby completing the 9008 flashing process. Xiaomi's encryption of 9008 is actually encryption of this file. When Xiaomi devices use MiFlash to perform 9008 flashing operations, they essentially call Qualcomm's flashing tool qpst, and when the 【prog_ufs_firehose_sdm855_ddr.elf】 file is read by miflash or qpst, it will forcibly report an error. After miflash reports an error, a Xiaomi account login screen will pop up. If the Xiaomi account has 9008 flashing permission, it will restart flashing and flash the ROM package.¹
2. Practice
   　　Step 1: Preparation. Use a computer to download an official fastboot ROM package, as well as the following files.
   　　Link:Tool for bypassing 9008 authorization and unbricking
   　　If you need to intuitively determine whether the device is in 9009 mode, you can download the Uotan Toolbox from the Uotan Community.
   　　Uotan Community portal:https://www.uotan.cn/
   　　Step 2: Extract the official fastboot ROM package, and put the [prog_ufs_firehose_sm7150_ddr.elf] file downloaded from the link above into the image folder in the extracted fastboot ROM package, replacing the original file.
   　　Step 3: Extract [MiFlashPatched.zip]. This is a modified version of the MiFlash flashing tool. Under no circumstances should you use the official MiFlash just for convenience, or open the exe file directly inside the archive without extracting it first.
   　　Step 4: Open the modified version of MiFlash, plug in the tablet, and click Refresh. At this point, you will see a device name starting with COM, such as COM5. Click Clean all at the bottom, click Flash, wait, and then an error will appear. Note that you must never click 'Clean all and lock'; this operation will lock the bootloader (BL) again, so the only option is to ask after-sales service to help unlock it.
   　　Step 5: Press and hold the tablet's power button + volume up button + volume down button simultaneously, that is, press and hold all three physical buttons at the same time, until the device restarts.
   　　Step 6: If the device has entered fastboot mode, it means fastboot was successfully flashed, so go directly to the next step. If the screen does not light up, it means the device is still restarting into 9008 mode. In this case, repeat steps 4 and 5. MiFlash will still show an error. If the device successfully enters fastboot mode after restarting, then the unbrick was successful.
   　　Step 7: Flash the official system. At this point, reconnect the tablet to the computer and refresh MiFlash. You will find that it already displays a device name consisting of a string of characters. Then you only need to follow the steps in Step 4 again to flash the official fastboot ROM into the device. During the flashing process, do not unplug the data cable. Wait for the tablet screen to light up again and enter the system, then you can unplug it².
   　　At this point, the entire unbricking process is complete. If you need to flash a third-party ported ROM or root the device, please refer to the corresponding tutorial; this article will not expand on it further.
   　　In short, the whole unbricking process consists of first flashing the missing fastboot image into the device so that the device has normal fastboot flashing functionality, and then flashing the official fastboot ROM back into the device so that the device again has a complete operating system that users can use.