Bypass Xiaomi HyperOS Restrictions: How to Make Dhizuku a Device Owner via QR Code

The Android ecosystem is steadily tightening its grip. Hardware manufacturers—especially Xiaomi—are building multi-layered security barriers, tying advanced ADB permissions and system toggles strictly to their proprietary cloud accounts. When standard commands like dpm set-device-owner crash with a SecurityException or get blocked by hidden user profiles, traditional workarounds fail.

However, an elegant engineering workaround exists. Android's official enterprise mechanism—QR Code Provisioning (triggered by tapping 6 times on the initial welcome screen)—operates deep at the kernel level. It completely bypasses OEM-specific launcher restrictions as long as you follow the rules.

Here is a complete guide on how to promote Dhizuku to a Device Owner on "locked" firmware without needing root access or jumping through complex ADB hoops.
The Architecture: Why Do Standard Methods Fail?

On modern Android versions (including Android 14 running on HyperOS 2.0), attempting to grant Device Owner privileges on a live system (via adb shell dpm set-device-owner) is blocked if:

At least one account is registered (Google, Mi Account).

A specific security toggle requiring an active SIM and cloud authorization is disabled.

Cloned application traces (User 999) are present.

Enterprise provisioning via QR code, however, executes before the graphical shell loads and user services initialize. The system accepts a configuration JSON payload, downloads the APK, and grants MDM privileges at the system daemon level.

Step-by-Step Deployment Guide

Step 1. Package Preparation & Checksum

The Android Enterprise installer strictly requires package integrity verification using a SHA-256 hash encoded in URL-safe Base64.

Download a stable version of Dhizuku (e.g., v2.10.1; newer versions on certain chipsets may trigger SecurityException during provisioning).

Host the APK on any accessible web server, a local Python server, or a direct link.

Compute the file's hash in your Linux terminal:

Bash


openssl dgst -binary -sha256 Dhizuku_v2.10.1.apk | openssl base64 | tr '+/' '-_' | tr -d '='

Step 2. Constructing the JSON Configuration

The enterprise scanner accepts a strictly structured text configuration. Use the following template:

JSON

{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.rosan.dhizuku/com.rosan.dhizuku.server.DhizukuDAReceiver",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "http://YOUR_IP_OR_DIRECT_LINK/Dhizuku_v2.10.1.apk",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM": "YOUR_GENERATED_HASH"
}

(Note: Wi-Fi provisioning parameters can be omitted by connecting to the network manually on the first screen).
Step 3. Generating the QR Code

Copy the entire JSON block (including curly braces), paste it into any text-based QR code generator, and display the resulting matrix on your monitor screen.
Step 4. Provisioning Magic on the Device

Perform a Factory Reset on your device.

On the very first welcome screen (language/region selection), connect to the internet via Wi-Fi or mobile hotspot.

While on this setup wizard screen, rapidly tap 6 times on an empty space in the center of the display.

The built-in camera will automatically switch to enterprise QR code scanning mode.

Point the scanner at the monitor displaying your QR code.

The system will automatically fetch the configuration, download the APK, verify the checksum, install the app, and lock in Device Owner permissions at the system level.

The Result

Once the desktop launcher boots up, you have a fully provisioned smartphone powered by Dhizuku. You can now log into any accounts, re-insert your SIM cards, and dive deep into system optimization: freeze background telemetry (MSA, MIUI Daemon) using tools like Hail, and perform silent batch installations via InstallerX—completely bypassing HyperOS's nagging security scanners.

Open-source automation wins again!