After flashing a custom ROM such as DerpFest onto a Xiaomi Pad 5 (codenamed nabu), the device typically boots into Google's Setup Wizard. If internet access to Google services is unavailable—due to regional restrictions or network configuration—the setup process stalls at "Preparing your tablet" or "Can’t connect to the internet," preventing entry into the home screen.

Standard workarounds like configuring a Wi-Fi proxy or using ADB commands often fail in this scenario. The primary obstacles are:

• The Setup Wizard UI restricts network configuraton options.
• The /data partition is encrypted by default, blocking direct file access before first boot.
• ADB is disabled until the device is provisioned, creating a catch-22 for command-based bypasses.

Why Common Methods Fail

Wi-Fi Proxy: Although the activation screen allows setting an HTTP proxy, Android’s connectivity checks (e.g., to connectivitycheck.gstatic.com) use HTTPS and may ignore proxy settings at the system level, especially in custom ROMs like DerpFest.

ADB Settings Commands: Commands like adb shell settings put global device_provisioned 1 require ADB to be enabled, which only happens after successful provisioning.

Recovery Execution: Even with ADB enabled in recovery (e.g., PitchBlack Recovery), the settings binary is unavailable because it depends on Android runtime libraries not present in recovery environments.

Manual APK Removal: Attempting to delete SetupWizard-related APKs from /system, /product, or /system_ext fails because these partitions cannot be mounted manually in recovery due to fstab restrictions.

Working Approach: Direct Binary Patching of ABX Settings Files

PitchBlack Recovery (a TWRP-based recovery available for nabu) supports mounting the encrypted /data partition during the initial boot if no lock screen password has been set—a typical state after a fresh flash.

Once mounted via the recovery’s "Mount" menu, the followign files become accessible via ADB:

• /data/system/users/0/settings_global.xml
• /data/system/users/0/settings_secure.xml

Despite their .xml extension, these files are stored in Android Binary XML (ABX) format—**not plain text**. Standard tools like sed or text editors cannot safely modify them.

Step-by-Step Binary Patching

1. Pull Files from Device

adb pull /data/system/users/0/settings_global.xml ./settings_global.bin
adb pull /data/system/users/0/settings_secure.xml ./settings_secure.bin

2. Analyze Binary Structure
Using Python, inspect the raw bytes around key flags:

with open('settings_global.bin', 'rb') as f:
    data = f.read()
idx = data.find(b'device_provisioned')
print(data[idx:idx+40])

This reveals a pattern like:
b'device_provisioned/\x00\x05\x00\x010/...'
The value 0 (unprovisioned) follows a fixed header. Changing it to 1 marks the device as provisioned.

3. Patch settings_global.xml

with open('settings_global.bin', 'rb') as f:
    data = bytearray(f.read())

target = b'device_provisioned/\x00\x05\x00\x010'
replace = b'device_provisioned/\x00\x05\x00\x011'

pos = data.find(target)
if pos != -1:
    data[pos:pos+len(target)] = replace
    with open('settings_global_patched.bin', 'wb') as out:
        out.write(data)

4. Patch settings_secure.xml

with open('settings_secure.bin', 'rb') as f:
    data = bytearray(f.read())

target = b'user_setup_complete/\x00\x05\x00\x010'
replace = b'user_setup_complete/\x00\x05\x00\x011'

pos = data.find(target)
if pos != -1:
    data[pos:pos+len(target)] = replace
    with open('settings_secure_patched.bin', 'wb') as out:
        out.write(data)

5. Push Modified Files Back

adb push settings_global_patched.bin /data/system/users/0/settings_global.xml
adb push settings_secure_patched.bin /data/system/users/0/settings_secure.xml

6. Reboot

adb reboot

Upon restart, the Setup Wizard is skipped, and the system boots directly to the launcher.

Critical Notes

• Ensure Data is mounted in recovery; otherwise, /data appears empty.
• Both files must be patched. Modifying only one may not fully bypass provisioning.
• This method works only when the device has **no lock screen password set**, which is true immediately after flashing.
• No data loss occurs—/data remains intact, unlike a factory reset.
• After bypassing, connect to the internet and sign in to a Google account to ensure proper activation state synchronization.