It works this way: we enter BROM mode, the SP Flash Tool will upload DA (download agent) to the phone, and SP Flash Tool will communicate with the DA to perform actions (erase flash, format data, write data, etc). Some have had their phone bricked when they were flashing to the recovery partition from within the recovery, while others have found that installing a stock ROM through fastboot on an unlocked bootloader also bricks the device Xiaomi needs a better way to unbrick its devices instead of Authorized Mi Accounts We can find the handshake bytes ( A0 0A 50 05 ) to find the reference to the handshake routine (actually found two of them, one for USB and one for UART).