Database Info

[TOOL] Xiaomi ADB/Fastboot Tools

Hi everyone!
I'm Saki, a long time tech enthusiast, Xiaomi fan and developer. More than a year ago I started working on a program, called Xiaomi ADB/Fastboot Tools, that makes it easy to manipulate Xiaomi phones using ADB and Fastboot, which are official debugging tools for Android. They have command line interfaces and they can be used for a variety of things, including but not limited to uninstalling system applications, overriding screen density (DPI), enabling camera2 and flashing ROMs. This application makes their most popular features easily accessible to less tech-savvy users by providing a GUI to interact with.
Modules
App Manager - Uninstall/reinstall/disable/enable system apps and services on demand
Camera2 - Enable Camera2 and EIS (TWRP required)
File Explorer - Transfer files between a device and a computer using ADB
Screen density - Tweak screen density by overriding the DPI value
Screen resolution - Tweak screen resolution by overriding the width and height values
Device properties - Retrieve tons of statistics and information about your device
Flasher - Flash any partition with an image, boot to any image or flash a Fastboot ROM (unlocked bootloader required)
Wiper - Wipe the cache or perform a factory reset
OEM Unlocker & Locker - Lock or unlock the bootloader (unlocking is only supported by Android One devices)
ROM Downloader - Get links to the latest MIUI Fastboot ROMs or download them right away
Rebooter - Advanced rebooting options using ADB/Fastboot
The application has been in the works for over a year, some older versions even got posted on Reddit where the reception was overwhelmingly positive. The project is free and open-source, the source code is publicly available on GitHub so anyone can inspect the code or fork the project for themselves and add their own modifications to it if they want.
The Xiaomi/ADB Fastboot Tools was originally written in C# for Windows but I received a lot of requests to make it work on Mac and Linux so I rewrote the whole thing for the JVM, so it runs on Windows, MacOS and Linux as of today.
For more information, including instructions, screenshot, frequently asked questions and download, visit the project page on GitHub.
If you experience any issues, read the FAQ. If you cannot find the solution there, leave a comment here or open an issue case on GitHub. Feedback is highly appreciated!
For additional help with Xiaomi devices, feel free to visit the Xiaomi Community on Discord.
Thanks for reading and enjoy :angel:

Tell me. More about the EIS... Does it work with app like open camera...
Because EIS in Poco doesn't work in any camera app except stock camera
Sent from my POCOPHONE F1 using Tapatalk

Mr.Sm1th said:
Tell me. More about the EIS... Does it work with app like open camera...
Because EIS in Poco doesn't work in any camera app except stock camera
Sent from my POCOPHONE F1 using Tapatalk
Click to expand...
Click to collapse
Not sure if there's anything different about the Poco, but the method used here is equivalent to enabling persist.camera.eis.enable. If you tried enabling that and you didn't get anything out of it, this won't make any difference. The options to enable Camera2 and EIS are mainly for Gcam.

With this tools it's more easy to remove the bloatware as with a regular minimal adb?

Mikael1013 said:
With this tools it's more easy to remove the bloatware as with a regular minimal adb?
Click to expand...
Click to collapse
To me, checking a few boxes and clicking a button is much easier than entering a line of arguments for each application.

hi, i can't open it on my pc. i'm using windows 10 with java se development kit 11 and java runtime environment 8 installed.

Nice to see Xiaomi Reddit moderator here posting about the tool. For anyone asking: it works well for every MIUI version I tried. Though I've moved back to older version may be v2.0.0.2 cause that doesn't require java to run and I don't feel comfortable to install java bloatware just to use this tool.
Thank you Saki for the tool.

could you post link for that older version that doesn't require java

chilling said:
hi, i can't open it on my pc. i'm using windows 10 with java se development kit 11 and java runtime environment 8 installed.
Click to expand...
Click to collapse
If you have the Java 11 SDK, you have the JRE 11 as well. I'm afraid you have to download and use JavaFX with that JRE or uninstall Java 11 to be able to use JRE 8.

DomagojX said:
could you post link for that older version that doesn't require java
Click to expand...
Click to collapse
It's in the original post. Be aware that it doesn't have nearly as many features and can also contain a few bugs I haven't come across.

Is there a way to restore the Mi Cleaner app without doing a factory reset? (Redmi 4X running MIUI 10.3)

Nathan-NL said:
Is there a way to restore the Mi Cleaner app without doing a factory reset? (Redmi 4X running MIUI 10.3)
Click to expand...
Click to collapse
None that I know of.

Saki_EU said:
If you have the Java 11 SDK, you have the JRE 11 as well. I'm afraid you have to download and use JavaFX with that JRE or uninstall Java 11 to be able to use JRE 8.
Click to expand...
Click to collapse
already uninstalled jre 8. version 5.3 now works. thank you!

chilling said:
already uninstalled jre 8. version 5.3 now works. thank you!
Click to expand...
Click to collapse
Great to hear! So sorry you had to wait so long for the Java 11 compatible release, Oracle messed things up bad!

Version 5.4 is out!
Changelog and download on GitHub.

Thank you for app.

Nice app! Can it uninstall system apps too?

Version 6.0 is out!
Changelog:
- New module in ADB: File Explorer
- Added a check for updates on startup
- Minor UI changes
- Updated Kotlin library
- Minor code optimisations
Download link in the OP.

bowlofsausage said:
Nice app! Can it uninstall system apps too?
Click to expand...
Click to collapse
That's what it's for! It doesn't even offer apps for uninstallation that you can easily uninstall by yourself

Saki_EU said:
That's what it's for! It doesn't even offer apps for uninstallation that you can easily uninstall by yourself
Click to expand...
Click to collapse
I see line to add packages to uninstall list by name and i suppose i can unninastal it then. Can I see all list of apps at once not by adding by myself? Now on application start i only see some miui and google apps to uninstall, no other packages names

My devices have been hijacked...Im just getting up to speed and need help ANDROID!1!

Hey folks. I've a pickle. Several of my friends and associates, all from different walks of life, here in OKC, Ok, are the victim of software exploitation...let me explain...
I'm a computer - I.T. guy.. have a history involving Unix and LInux Distro's and have avoided Android until recently.
Currently my devices have been hijacked. Running processes include:
Google Framekework
Wi-Fi Direct
Sim contacts
Launcher 3
QcrilMessageTunnelService
Ive a cheap pre-paid verizon Alcatel 5905s Due to my Premium Devices being hacked
It has
Android 8.1.0 I cant update
Kernal 3.18.71
3d5xufx1
Baseband 7Genns Pack1.201905.1.236923.1
My other devices will run 15 or more services within Googleplayservices.... The Apk versions of these packages like: GoogleplayServices, Android Auto, Facebook Manager (I dont use it btw), etc..all ridiculous permissions include root access and such....
My bluetooth, cameras, wi-fi - are all being turned on by the apps permissions and need help. Again I'm familiar with the Android System a bit - having a I.T. and Unix/Linux background I can come up to speed quickly....
Technology - especially opensource technology should never EVER be used like this. I have encountered a problem which effects a lot of good people. Regardless of their goodness badness or whatever - no one should ever use technology in this way....
My questions are:
Some of my friends and their devices have custom roms === How can I remove them? J3 x2 J7, A10. A11, Alcatel 5095s, LG 322DL and AQT 100 tablet to start....
Each of the above programs utilize Googleplayservices to have extremely stupid permissions and their corrosponding related aps....
Im even giving numbers for anyone to call: 4zerofive921sixfour49 Wade and 405eighthtreeefour30sevenzero chris
if you can help...please do....

Why not simply on hijacked devices re-flash their Stock ROM to get rid off of the installed Custom ROM?
Although Android is based on a modified Linux kernel, it has nothing in common with Linux: the Android Framework, which is based on Java APIs, is the interesting part.
And: Nobody is forced to make use of Google Play Services / Google Services Framework: Custom ROMs like LineageOS don't have them built-in.

jwoegerbauer said:
Why not simply on hijacked devices re-flash their Stock ROM to get rid off of the installed Custom ROM?
Although Android is based on a modified Linux kernel, it has nothing in common with Linux: the Android Framework, which is based on Java APIs, is the interesting part.
And: Nobody is forced to make use of Google Play Services / Google Services Framework: Custom ROMs like LineageOS don't have them built-in.
Click to expand...
Click to collapse
Ok. Please let me in on this. It's intriguing. First I know little of Java but have started to begin learning development basics...so my questions are...
So I have an LG322dl....there seems to be no good info on ROMS my way...but then again these "apps' prevent me from looking at things that counter their functions....
I have ADB /Fastboot - and run Ubuntu 20.04. Theres a J7 that I tried to Flash but Heidall didnt work and dont know where else to turn... Theres also the Alcatel 5059s
I have 2 J3's the J7 an LG 322Dl and a Sam A11...i have read what is on here on each of the items. Basically I am told the LG no one can flash...(i dont believe it) the Alcatel is a headcache because I cant get any solid info...the A11 is now Google LOcked , and the Samsungs the original Flahing with Heidall doesnt do squat.....
Now all I understand are probably basics to you... If you got an issue you can flash your phone with the MF's Factory Build...but if your bootloader is locked, say - like on my A11 - I cant bypass for ****. I tried every which way 30 plus hours.... nothing... and it had my original fingerprint!
Also, the methods for each of my devices listed by users here and elsewhere just dont seem to work...
Can you please....explain to me the process to flash and or install a custom rom please?
thanks

Can't guide you: never have flashed a Custom ROM, because it never was necessary to do it.

General (OPEN DEV) BruteRoot - A collection of Root Tactics (Possibly Force Bootloader unlock on NA Samsung S22?)

Devices & Linux Versions I or other Testers have Successfully Gained Root on:
(Likely All) MTK CPU Based Android devices UP TO 11 (Maybe 12? I haven't tested) (I.e LG, Sony, Select Samsung devices)
Android Devices with LINUX KERNEL VERSIONS - 5.8 - 4.14 - Maybe More? (Needs Testing)
-THIS GUIDE IS NOT BEGINNER FRIENDLY - BASIC UNDERSTANDING OF PYTHON, UNIX/LINUX ETC WILL BE REQUIRED!-​
If you have been holding off updating your device, well here's some good news, your device may still be vulnerable to a method to gain root access (and subsequently, possibly the ability to edit Build.prop and therefore allow the ability for OEM unlocking on USA based devices.) <- correct me if I'm wrong, but this should be possible, and once done, should persist across updates, correct?
As of the time of writing this, there is not currently a simplified APK method, but, still this process is relatively straight forward.
Alot of the methods used HAVE been patched from what I understand, but there have got to be plenty of devices out there still which are not updated. This project aims to compile all current, former and future Root methods into an APK that will do all the leg-work. If its able to find a working method, the GUI will pop a root shell for the end user. This SHOULD work, regardless of the setting of the "OEM UNLOCK" option in the dev options. A bypass, essentially.
Regardless, The project linked below uses a myriad of known exploits & vulnerabilities and looks to find one that will work.
Methods used are:
Nearly all of GTFOBins
Writeable docker.sock
CVE-2022-0847 (Dirty pipe)
CVE-2021-4034 (pwnkit)
CVE-2021-3560
It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock, or the recent dirty pipe (CVE-2022-0847). More methods to root will be added over time too.
There is also an alternative (Dirty Pipe) injection method the uses @topjohnwu 's Magisk , this should be implemented into the apk. See this Github repo, Here.
I would imagine this could be implented in a way to target devices that have stopped being supported for updates, aswell, that do not have TWRP, such as the SM-T307U.
One big note - I am betting there are still ALOT of devices that are in inventory at retailers that remain on the vulnerable OS. So keeping that in mind, I'd say this is worth building.
What needs to be done:
TESTING!
Build APK - HELP NEEDED WITH THIS!
Deploy
Main Goals:
Get bootloader unlock ability for devices normally not unlockable (I.e North American Samsung Galaxy S22, Etc)
Above can be achieved by getting temp root via methods detailed here or otherwise, then editing build.prop, altering the below settings (The settings may be worded differently or simply not present at all, depending on device and Firmware version):
sys.oem_unlocking_allowed to 1
ro.oem_unlock_supported to 1 (most devices are set to 1 by default.)
ro.boot.flash.locked to 0
ro.secure to 0
ro.debuggable to 1
I think there may be one or two more that pretaint to Flash.locked. I.e flash.locked.other--or something very close.
Locally, gain temp root (System preferred, but any root will do.) on as many device types as possible.
Give device control back to end user.
Stay up-to-date on new exploits for root access & update apk accordingly.
STAY ETHICAL!!!! This is, in the end, a research project. Meaning all work preformed in the context of this project could result in a damaged or bricked device. By participating in this project you acknoledge these risks and accept them, and agree to not hold me, XDA, or anyone else responsible if you do some dumb ****. - k0mraid3
Github Project link: HERE for my fork & HERE for the original project.
My fork will incorporate the original project, as well as other found root access methods, such as the magisk injection method mentioned above - my repo is mainly used as a hub for the APK's dev - i don't have enough time to work on it at the moment but all are welcome to help.
July 15th 2022 (UPDATE) (SAMSUNG DEVICES ONLY): A new Escalation method has been found via the Galaxy app store (Versions BEFORE Galaxy Store 4.5.41.8). No details known yet, but it is said to be very easy. See CVE-2022-33708 (July132022). Unknown if downgrading the app to 4.5.0.0 will enable the method again or not.
Cred: liamg
One method to run Traitor on device - Thanks @DevinDking for sharing this.
Steps to get script on phone.
//
#!/bin/sh
set -e
dir=/data/local/tmp
adb=${adb:-"adb"}
$adb push traitor ${dir} //This puts file on phone make sure to run the terminal where its located
$adb shell chmod 755 ${dir}/traitor"
//
Now to run script start a new terminal
//
adb shell
#!/bin/sh
set -e
dir=/data/local/tmp
adb=${adb:-"adb"}
${dir}/traitor //script opens
//
But I assume this wouldn't work right, and isn't right.
Idk trying my best here xD
Click to expand...
Click to collapse
Tools & References:
Linux (and Android, FTMP) Privilege Escalation Techniques
Dirty Pipe - Magisk Injection
Traitor - Main Repo
GTFOBins
CVE Database (Public Database for exploits, vulnerabilities, etc.)
Windows Subsystem For Linux (Great for Dev)
ADB App Control - Cred @Cyber.Cat
Leaked Samsung Source Code ***Mod Edit: Link Removed***
Crontab Root Template script (File Attached - you still must edit crontab with "crontab -e" and point it to this file, see comments for guide, I will add one to post later)
Android Image Kitchen Used to create custom image's etc.
MTK Client
MTK Meta Utility (Source-???)
Will add more as time goes on and more found.
Interesting Attack vectors -
GFX Componets of a system.
Issues with Linux itself (i.e Dirty Pipe)
Privilage escalation via any means (I.e GTFOBins)
unprotected system process - Hijack them if possible (i.e RILService Mode, and a wide range of other OEM apps left on devices after ship)
7/24/22 - Samsung, LG & Other OEM's obfuscating (Intentionally Hiding) Fastboot and ADB Bootloader interfaces on PC
So over the last week or so i dived head first into USB Dev - ill save you the time and sum it up.
Vendors and OEM's are actively obfuscating the USB connection between your smartphone and the PC to keep you from Rooting. As far as im aware, there is no Universal way to fix this as each OEM screws with the USB drivers differently. THIS needs to be a point of focus for the rooting community. However, i have found a few tools for Dev if you wish to screw with this. (I'll upload them tonight)
7/24/22 - MTK (MediaTek) based Exploits
I Will try to compile a few methods for FORCING Bootloader Unlock on MTK based Devices as well as a way for manipulating said devices. I will attach two tools to this thread, these tools are EXTREMELY POWERFUL and can completely **** up your device. When i say REALLY F*CK UP your device, I mean to the point you cant even access recovery, Download OR bootloader mode. I'm Talking a blank DEAD device. So use with caution.
With that said, lets talk about the tools. You will need a basic understanding of Python to make use of MTK Client
First up, we have MTK Meta Utility (Currently Version 44) (Download Below)
Next we have MTK Client (Github Link)
So what can you do? Well, you can crash the Preloader to Brom with MTK Meta Utility while at the same time using MTK Client to send any payload you like to the device via Fastboot.
I know, vague right now, but ill add detail over the coming days.
I will continue to update the below list as new methods are discovered.
If you find Guides, tutorials or new exploits, please link them in the comments so I can include them in future development!
Telegram Channel: Here.
Information on Vulnerabilities, exploits & methods - CVE-2022-0847 (Jfrog) - The Story Of "Dirty Pipe" - XDA - Dirty Pipe - PWNKIT (CVE--2021-4034) - CVE-2021-3560 - Docker Breakout / Privilege Escalation - CVE-2022-33708 (July132022) - CVE-2022-33701 (July122022) - CVE-2022-22268 (Unlock Knox Guard with DEX) (JAN2022) - MTK Client -
Dev Team & credit to -
@topjohnwu - LiamG - @wr3cckl3ss1 - bkerler -
UPDATED - 7/29/22

There is also a new vulnerability exploit by Zhenpeng Lin that allows for privilege escalation on Pixel 6 and and Galaxy S22 devices running 5.10 kernel.

Don't update... destroyer of worlds

I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?

olivehue512 said:
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
Click to expand...
Click to collapse
Lol, everybody already updated the patch

blackhawk said:
Lol, everybody already updated the patch
Click to expand...
Click to collapse
This is just sad panda. I'm gonna skip next update anyways unless it comes with an actual other phone that is BL unlocked. I feel like everyone wants this so bad it can't be that far out before it happens.
Does the Magisk injection method work after July patch? I was reading through the work they did to get it done. Props to those guys.

sierratango88 said:
There is also a new vulnerability exploit by Zhenpeng Lin that allows for privilege escalation on Pixel 6 and and Galaxy S22 devices running 5.10 kernel.
Click to expand...
Click to collapse
Has it got a fancy number yet?! Eager to try this!!!! Maybe it can be put in with the others.

olivehue512 said:
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
Click to expand...
Click to collapse
Well, because they are known and accepted vulnerabilities and exploits. A very few have even been marked as "WONTFIX" such as the TTY method.

olivehue512 said:
This is just sad panda. I'm gonna skip next update anyways unless it comes with an actual other phone that is BL unlocked. I feel like everyone wants this so bad it can't be that far out before it happens.
Does the Magisk injection method work after July patch? I was reading through the work they did to get it done. Props to those guys.
Click to expand...
Click to collapse
Honestly, it's worth a shot but I doubt it.
One of the goals behind building the APK compilation of all these different tactics is to enable the end user to "give it a shot" easily on different devices, without having to know how to run all of this manually. Basically imagine an apk that just tries all the above methods and if ones successful the gui will pop a root shell open. From there, the possibilities are endless. Edit Build.prop, SELinux, Verity, Etc.

FYI even you applied the July update, seems like the Kernel version is still from June 21st, is still 5.10xxxx so we could still benefit from this exploit. Very interested in how we can get root here in the US.

K0mraid3 said:
Has it got a fancy number yet?! Eager to try this!!!! Maybe it can be put in with the others.
Click to expand...
Click to collapse
There hasn't been a CVE assigned to it yet that I am aware of.

xgerryx said:
FYI even you applied the July update, seems like the Kernel version is still from June 21st, is still 5.10xxxx so we could still benefit from this exploit. Very interested in how we can get root here in the US.
Click to expand...
Click to collapse
Go to the Github linked and try the different methods, see if you can pop a root and nano build.prop to allow OEM unlocking?

sierratango88 said:
There hasn't been a CVE assigned to it yet that I am aware of.
Click to expand...
Click to collapse
GREAT news for us! LEts get this temp root! lol

Looks like another new one! CVE-2022-33708

Another Samsung Exclusive - CVE-2022-33701

So, ive just spent my entire friday and friday night MANUALLY testing all the GTFOBins & reproducing some of the newer CVE's on Samsung Galaxy S7 Edge (Android 9) -Galaxy tab A 8.4, (Android 11), Galaxy S21 & S22 (Android 12) --- A little bit of progress made. Again, ill need someone with better working knowledge on APKs & Java to really move forward. All i can say so far, is this all must be awk for sammie, because cronie is looking promising
"crontab -e"

interesting find. not "New" but still new-ish enough some may be able to use. CVE-2022-22268 (Unlock Knox Guard with DEX)

New to this all but not rooting. Anyone recommend a way tutorial on how to try these methods on Win 11?

I don't have a deep understanding of Linux, I have tried, debian and unbuntu. I get traitor to run but it's detecting the Linux kernel and not my phones. How can I get the program to search for vulnerability on my phone not my Linux. I would love a more in depth guide and I'd love to give feedback on methods.

DevinDking said:
I don't have a deep understanding of Linux, I have tried, debian and unbuntu. I get traitor to run but it's detecting the Linux kernel and not my phones. How can I get the program to search for vulnerability on my phone not my Linux. I would love a more in depth guide and I'd love to give feedback on methods.
Click to expand...
Click to collapse
i had the same issue but cant remember how i worked that out. let me see if i can find out what i did on win11

How to disable GUI and other unwanted processes?

Hi, after some long, and hard time I've finally managed to root my Xiaomi MI 11 lite 5G NE. The reason why I wanted to root it, is that I want to convert that phone to a simple java server. The problem is, that most of the phone's RAM is being consumed by system apps (out of 6GB, 5.5 is being used). How can I reduce that number and minimize my phone to a command-line-only device?
Additional question: is it possible, to make it all in .sh script? That way I could disable everything whenever I wanted, and if didn't, then I would use a device like a normal android phone

fibur said:
Hi, after some long, and hard time I've finally managed to root my Xiaomi MI 11 lite 5G NE. The reason why I wanted to root it, is that I want to convert that phone to a simple java server. The problem is, that most of the phone's RAM is being consumed by system apps (out of 6GB, 5.5 is being used). How can I reduce that number and minimize my phone to a command-line-only device?
Additional question: is it possible, to make it all in .sh script? That way I could disable everything whenever I wanted, and if didn't, then I would use a device like a normal android phone
Click to expand...
Click to collapse
Either use adb debloat utility to disable most processes or flash a custom rom.

Fytdyh said:
Either use adb debloat utility to disable most processes or flash a custom rom.
Click to expand...
Click to collapse
What custom rom would you recommend? Honestly I would prefer to just flash linux to my phone, but i am afraid it's impossible since Ubuntu Touch is available only for some certain devices. Additionally, Mi 11 Lite 5G NE (lisa) doesn't have much community support, and there are only several unofficial roms

well, this one seems official and stable
[ROM][13][OFFICIAL] PixelOS [AOSP][STABLE][10/05/2023]
PixelOS is an AOSP based ROM, with Google apps included and all Pixel goodies. We aim to provide an experience similar to Google Pixel phones with numerous performance enhancements and a small amount of useful additional features. /* Your...
forum.xda-developers.com

Fytdyh said:
well, this one seems official and stable
[ROM][13][OFFICIAL] PixelOS [AOSP][STABLE][10/05/2023]
PixelOS is an AOSP based ROM, with Google apps included and all Pixel goodies. We aim to provide an experience similar to Google Pixel phones with numerous performance enhancements and a small amount of useful additional features. /* Your...
forum.xda-developers.com
Click to expand...
Click to collapse
And could I achieve what I asked using that ROM?

HI, any chance I could somehow fully get rid of UI? It doesn't matter, that phone will be just black screen - I setted up SSH on my device, so I can easily access it, I just want to get rid of any not needed processes. When I try to kill that process by id, then it restarts after short time, or entire phone gets restarted

You can remotely disable / enable GUI via ADB
Code:
adb shell "stop"
or
Code:
adb shell "start"

What are red lines in device tweaking? Or how to avoid bricking by mistake

Hi All!
I've recently got P40 Pro and I like it very much. Now I need some software to be installed - maps, chats, banking etc.
However almost all of these apps need Google services or HMS. I'll try to avoid using these frameworks by using MicroG and Aurora store.
My goal is to have some set of required apps and don't have bloatware (like Huawei AI apps).
So I also going to find browser, phone, file manager and others on F-droid and use them instead of pre-installed apps. And disable those via ADB.
There are tons of information I need to read to do that, and I'll surely will read.
BUT, most manuals have big disclaimer which says "Do everything on your own risk, you can brick the phone!". And that's what I definitely don't want to.
So my questions are - what is the set of safe operations? What predefined applications can be safely removed via ADB? How to make backup that will restore phone if something goes wrong?
I believe there should be some thread with same concerns, but I could not find it. If somebody could point me to it, I'll be very grateful! Thank you in advance!

The first and main thing is "Everything Do at your Own RISK" if you want to go through android modding or making changes in the system you should not fear from resetting or formatting the system first and other thing is that installation of any unstable or unsupported mod can brick your device to get recover from these situations you should have knowledge about adb and fastboot,oem unlock and bootloader,custom recovery,root,magisk and custom roms to get the full back of your android in current state needs root for root you have to unlock your bootloader and for unlocking bootloader you need fastboot tool or your device oficial bootloader unlocker tool then you can backup you droid by the most common tool titanium backup or simply by backu option in your custom recovery

I think having a fully capable ROM bootloader (EDL mode, MTK, Allwinner, RockChip...) is most important.
There are still times that your system is wedged and you'll need either ROM mode test points or flash disable.
That's when the boot chain is broken enough to not work, but not broken enough to be recognized as broken.
If things are totally broken it will go to ROM bootloader mode all by itself.

Thank you for your advises!
I could not find P40Pro in TWRP devices list, and AFAIK, to unlock bootloader it needs to be disassembled. Is that correct?
To get used to rooting, custom ROMs, flashing and things I'll better get some cheap used phone - this one is way pricey for savage experiments, especially when you're completely noob. So rooting isn't an option for me for now.
At the moment I 'm debloating phone with "adb shell pm disable-user" and following lists:
[GUIDE] EMUI 11 Complete Debloating Guide & Bloatware List
This de-bloating guide will help you start using EMUI 11 as clean as possible. Please list packages in the comments section that you know is a bloatware and I didn't include in the spreadsheet. This guide assumes that you're using Windows 10 as...
forum.xda-developers.com
P40 Pro debloating guide
Hey everyone, I've spent the last couples days going through all the installed packages, cross-referencing different debloating guides and testing my changes. I'm running the latest EMUI 10.1.0.158 (C636). RECOMMENDATIONS: if you can, follow...
forum.xda-developers.com
[GUIDE] List of bloatware on EMUI safe to remove
Hi all, i was working on a guide on the vast amount of packages that we find already installed on EMUI by default and safe to remove because i'm sure that it would be useful for users like me, users that doesn't like to have space occupied on...
forum.xda-developers.com
Next step - involve Android profiles to isolate spying apps, which I still need, from each other and from contact list
I also looking for decent replacement for buit-in file-management, phone, messaging and contacts apps. And, maybe, launcher, I don't know if it's needed and secure. So far I found:
Emerald Dialer | F-Droid - Free and Open Source Android App Repository
Make calls, view call log
f-droid.org
Silence | F-Droid - Free and Open Source Android App Repository
Encrypted SMS/MMS conversations made easy!
f-droid.org
Koler | F-Droid - Free and Open Source Android App Repository
uniquely stylized phone app with customizable features
f-droid.org
But haven't installed or tried yet. I'd gratefully accept recomendations for those app categories.

Dont waste your time. On this phones you cannot unlock the bootloader and definitely you cannot have access to the root. Also debloating is a non-sense: you can do more bad things than good things. The phone is powerful enough to not need debloating. It is not a Galaxy S2.