[Tutorial] How to apply ADB hacks to Xiaomi devices

pr3jker

Member
Hi every1

This is a tutorial for granting ADB hacks in Xiaomi devices (I used Mi 11i).
We'll use Wireless ADB, not USB, but note it only works on Android 11+ (you can use classic USB Debuggng if your device is not on Android 11)
Note : all commands in this tutorial are "quoted", but you must not insert quotes in the actual command line

A-Initial needs:

1-On the Xiaomi device:
1.1-Enable Developer options (google to find how to do it)
1.2-Enable USB debugging
1.3-Enable Wireless debugging
1.4-Enable USB debugging (Security Options)
1.5.Disable adb authorization timeout

2-On your Mac/PC:
2.1-In order to apply this ADB hacks you will need Google's ADB tool (note that only the latest version works on Android 11+). Get it here:
PC: https://dl.google.com/android/repository/platform-tools-latest-windows.zip
Mac: https://dl.google.com/android/repository/platform-tools-latest-darwin.zip
2.2-Once you have a working adb connection, you will type and run the adb commands from the command line/terminal on your computer:


B-Instructions

1.On the Xiaomi device
11.-Go to: Settings > Additional serttings > Developer Options > Wireless debugging.
1.2-You must pair the device with your Mac/PC on your 1st connection. Use the option "Pair device with pairing code" (Take note of device IP address and port n#, and note the pairing code)

2- On your Mac/PC
2.1-Launch your Terminal /Command line. Run "adb pair [your device IP : port n#]". For example:
"adb pair 192.168.1.128:40225"
2.2-Type your device pairing code when asked (from step 1.2)
2.3-You are now paired with your device!
2.4-Run the command "adb devices -l" to list the connected devices. Your Xiaomi device should be listed.
2.5. Now, you're ready tho fire those ADB hacks commands, whatever they are!.
For example, the 1st Macrodroid command should be: "adb shell pm grant com.arlosoft.macrodroid android.permission.WRITE_SECURE_SETTINGS"
2.6-At the end of your session, type "adb kill-server" before disconnect the device.
THat's it! Hope this helps
 

FrameXX

Well-known member
I personally prefer "adb connect [local_ip_adress]" command which is way easyer to use. For example "adb connect 192.168.1.128"

EDIT: I am trying and it doesn't seem to work. I am sure it worked at least on my Android TV. I am doing something wrong, propably just missing right port behind the ip adress. It's refusing connection.

Alternatively, If you are missing PC you can try this app to connect into your Android from another Android and perform ADB commands. But this app doesn't seem to work with Xiaomi devices for me.
 
Last edited:

chaoscreater

Active member
Can't you just use adb connect ip:port instead?

Or adb tcpip 5555 and then just run whatever adb shell commands you want using shell script.

The problem with all of these approaches is that when your phone reboots, you have to tether your phone to get it working again. With LADB, I can just start the local ADB server and run adb commands without using another device, but I have to make sure my wifi is on, otherwise my wireless ADB gets disabled.
 

Snurre

Well-known member
Can't you just use adb connect ip:port instead?

Or adb tcpip 5555 and then just run whatever adb shell commands you want using shell script.

The problem with all of these approaches is that when your phone reboots, you have to tether your phone to get it working again. With LADB, I can just start the local ADB server and run adb commands without using another device, but I have to make sure my wifi is on, otherwise my wireless ADB gets disabled.
LADB also works perfectly for me 😉
I made a button that enables wifi, enables adb_wifi and then launcher LADB
Then I don't have to worry about wifi connection 😊
 

Snurre

Well-known member
EDIT
Sorry but I dont know if the system settings is named like mine, I have a Samsung not Xiaomi
But I think these is something similar
 

chaoscreater

Active member
Tested on my Xiaomi Redmi Note 9T on Android 11. Works fine :)

Now just need to figure out how to automatically run "adb tcpip 5555" from within LADB. The "ADB Shell Command Plugin" can be used as a plugin in MacroDroid to automatically load adb shell commands. If LADB supports this as well, that would be easy, but it doesn't seem like it's possible....
 

Snurre

Well-known member
Nice 😉
But I don't know about "adb tcpip 5555" is it really necessary?
I have never used it and LADB works just fine without it
 

chaoscreater

Active member
Certain commands won't work without adb tcpip 5555 (adb over wifi).

I think this command requires adb over wifi:
adb shell svc data enable

Try it in LADB and see if it works for you. It should enable mobile data for you. You can also just use "disable" instead of "enable" to turn off mobile data.

Also, looking at your last screenshot, that isn't really necessary. When you turn off wifi, it turns off wireless debugging automatically (at least it does for me).
 

Snurre

Well-known member
Certain commands won't work without adb tcpip 5555 (adb over wifi).

I think this command requires adb over wifi:
adb shell svc data enable

Try it in LADB and see if it works for you. It should enable mobile data for you. You can also just use "disable" instead of "enable" to turn off mobile data.

Also, looking at your last screenshot, that isn't really necessary. When you turn off wifi, it turns off wireless debugging automatically (at least it does for me).
Works for me without "adb tcpip 5555" (Samsung)
 

chaoscreater

Active member
Works for me without "adb tcpip 5555" (Samsung)
You're not already running adb over wifi already or have a rooted device? I'm using Xiaomi devices and both require adb tcpip 5555.

In fact, if you look up Tasker and ADB related commands, it is required to run adb tcpip 5555 for some of them. I don't know how you're able to do that on Samsung but it seems like you're already running an elevated ADB process.
 

Snurre

Well-known member
No root, just using the macro in post #9 and then it works for me
And I don't use Tasker, I'm trying to use as few apps as possible 😉
MD is great for my needs (for now)
 

Roboboard

New member
Hello,

If I apply the command adb shell pm grant com.arlosoft.macrodroid android.permission.WRITE_SECURE_SETTINGS I have error messages.

* daemon started successfully *

Exception occurred while executing 'grant':
java.lang.SecurityException: grantRuntimePermission: Neither user 2000 nor current process has android.permission.GRANT_RUNTIME_PERMISSIONS.
at android.app.ContextImpl.enforce(ContextImpl.java:2028)
at android.app.ContextImpl.enforceCallingOrSelfPermission(ContextImpl.java:2056)
at com.android.server.pm.permission.PermissionManagerService.grantRuntimePermissionInternal(PermissionManagerService.java:1445)
at com.android.server.pm.permission.PermissionManagerService.grantRuntimePermission(PermissionManagerService.java:1426)
at com.android.server.pm.PackageManagerShellCommand.runGrantRevokePermission(PackageManagerShellCommand.java:2300)
at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:251)
at android.os.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:98)
at android.os.ShellCommand.exec(ShellCommand.java:44)
at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:22187)
at android.os.Binder.shellCommand(Binder.java:932)
at android.os.Binder.onTransact(Binder.java:816)
at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4645)
at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:4415)
at android.os.Binder.execTransactInternal(Binder.java:1162)
at android.os.Binder.execTransact(Binder.java:1126)

What does this mean? Yet I see my Xiaomi connected.

Thank you
 

FrameXX

Well-known member
Hello,

If I apply the command adb shell pm grant com.arlosoft.macrodroid android.permission.WRITE_SECURE_SETTINGS I have error messages.

* daemon started successfully *

Exception occurred while executing 'grant':
java.lang.SecurityException: grantRuntimePermission: Neither user 2000 nor current process has android.permission.GRANT_RUNTIME_PERMISSIONS.
at android.app.ContextImpl.enforce(ContextImpl.java:2028)
at android.app.ContextImpl.enforceCallingOrSelfPermission(ContextImpl.java:2056)
at com.android.server.pm.permission.PermissionManagerService.grantRuntimePermissionInternal(PermissionManagerService.java:1445)
at com.android.server.pm.permission.PermissionManagerService.grantRuntimePermission(PermissionManagerService.java:1426)
at com.android.server.pm.PackageManagerShellCommand.runGrantRevokePermission(PackageManagerShellCommand.java:2300)
at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:251)
at android.os.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:98)
at android.os.ShellCommand.exec(ShellCommand.java:44)
at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:22187)
at android.os.Binder.shellCommand(Binder.java:932)
at android.os.Binder.onTransact(Binder.java:816)
at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4645)
at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:4415)
at android.os.Binder.execTransactInternal(Binder.java:1162)
at android.os.Binder.execTransact(Binder.java:1126)

What does this mean? Yet I see my Xiaomi connected.

Thank you

Before using the grant command firstly use 'adb devices' command to authorize your pc on your device.
 

tanutanu

Well-known member
Hello,

If I apply the command adb shell pm grant com.arlosoft.macrodroid android.permission.WRITE_SECURE_SETTINGS I have error messages.

* daemon started successfully *

Exception occurred while executing 'grant':
java.lang.SecurityException: grantRuntimePermission: Neither user 2000 nor current process has android.permission.GRANT_RUNTIME_PERMISSIONS.
at android.app.ContextImpl.enforce(ContextImpl.java:2028)
at android.app.ContextImpl.enforceCallingOrSelfPermission(ContextImpl.java:2056)
at com.android.server.pm.permission.PermissionManagerService.grantRuntimePermissionInternal(PermissionManagerService.java:1445)
at com.android.server.pm.permission.PermissionManagerService.grantRuntimePermission(PermissionManagerService.java:1426)
at com.android.server.pm.PackageManagerShellCommand.runGrantRevokePermission(PackageManagerShellCommand.java:2300)
at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:251)
at android.os.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:98)
at android.os.ShellCommand.exec(ShellCommand.java:44)
at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:22187)
at android.os.Binder.shellCommand(Binder.java:932)
at android.os.Binder.onTransact(Binder.java:816)
at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4645)
at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:4415)
at android.os.Binder.execTransactInternal(Binder.java:1162)
at android.os.Binder.execTransact(Binder.java:1126)

What does this mean? Yet I see my Xiaomi connected.

Thank you
You need to turn it on.
 

Attachments

  • IMG_20211112_184434.jpg
    IMG_20211112_184434.jpg
    280.3 KB · Views: 20
Top