The trick for most device is to get a serial console and set uboot "flashargs" or using the init=bin/sh trick, grab the root hash, shove it through hashcat.

You are exactly correct.

https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/blob/mas...