Mi 8e5 Unlock Toolkit

Automated bootloader unlock assistant for Mi 8e5 series devices, implementing CVE-2026-43499.

This is an English-translated and macOS/Linux-ported fork of the original Windows-only release by @Kernix.
Original repo: https://github.com/Linuxoid-cn/Mi8E5-Unlocker-by-CVE-2026-43499
Fork maintained by @joehquak

Original Author: @Kernix
Original Contact: [email protected] / Telegram: @C_Valmont

What's different in this fork

• Full English translation — all script prompts, warnings, and README translated from Chinese
• macOS support — new 8e5-unlock.sh script for macOS (and Linux)
• Bundled platform-tools — ADB and Fastboot binaries included for both Windows and macOS, no separate install needed
• Unified folder structure — all binaries consolidated into platform-tools/
• Automatic ADB authorisation handling — detects unauthorized devices, restarts the ADB server to trigger the Allow USB debugging popup, and guides the user through approving it

Changelog

v2.0.0

• Synced with upstream v2.0.0 backup reliability fixes
• ABL backup files now written to /data/local/tmp instead of /sdcard — fixes failures when device is at lock screen or data partition is encrypted
• Backup files pre-created with touch and chmod 0777 before writing for improved pull success rate
• /data/local/tmp cleared before and after the process to avoid stale file conflicts

v1.0.2

• backupABL/ folder now included in the zip so the script doesn't fail on first run
• Backup contents remain gitignored — only the folder structure is tracked

v1.0.1

• macOS script now detects when a device is connected but not yet authorised
• Automatically restarts the ADB server to trigger the "Allow USB debugging?" popup on the device
• Improved error messages with clearer instructions at each failure point

v1.0.0

• Initial release — English translation and macOS port of the original Windows tool by @Kernix

Overview

Integrates ADB, Fastboot, unlock components, data cleanup images, and automation scripts to streamline authorized bootloader unlocking. Supports Windows and macOS.

Supported Devices

Requirements

• USB debugging enabled on device (Settings > Developer Options)
• OEM unlock enabled on device (Settings > Developer Options)
• USB cable connected to PC/Mac

Platform-specific tools (adb, fastboot) are included in platform-tools/.

Usage

macOS

chmod +x 8e5-unlock.sh
./8e5-unlock.sh

Windows

Double-click 8e5-unlock.bat or run from Command Prompt.

What It Does

1. Pushes exploit payload to device via ADB
2. Gains temporary root via CVE-2026-43499 (LD_PRELOAD injection)
3. Backs up original ABL (bootloader) partitions to unlockFolder/backupABL/
4. Flashes patched ABL to bypass bootloader lock
5. Reboots to Fastboot, confirms unlock, erases FRP
6. Restores original ABL and triggers factory reset

For a detailed step-by-step breakdown of exactly what the script does at each stage, see HOW-IT-WORKS.md.

Folder Structure

8e5-unlock.sh              macOS script
8e5-unlock.bat             Windows script
platform-tools/
  adb                      macOS ADB binary
  fastboot                 macOS Fastboot binary
  adb.exe                  Windows ADB binary
  fastboot.exe             Windows Fastboot binary
preload-8e5-Ennea.so       CVE exploit payload
linuxloader_unlock.efi     EFI unlock component
misc_wipedata_mi.img       Factory reset trigger image
unlockFolder/
  factoryABL/              Patched ABL files per device
  backupABL/               Your original ABL backup (created at runtime)

Warnings

• All data on the device will be wiped. Back up everything first.
• Not guaranteed compatible with all firmware versions.
• Do not remove any files from the folder — the script will fail.
• For personal devices, authorized testing, and security research only.

Applicable Uses

• Personal device bootloader unlocking
• Firmware research and verification
• Android security research / CVE verification

Not for: unauthorized devices, commercial use, or privacy data extraction.

Disclaimer

This project is for learning, research, and authorized testing only. Users assume all responsibility for data loss, device damage, or warranty changes.