FORUMS
Remove All Ads from XDA
Honor 7x
Win an Honor 7X!

Guide: Reverse-engineering Xiaomi OTA Updates to Find Unreleased Versions

1,748 posts
Thanks Meter: 1,213
 
By duraaraa, Senior Member on 20th October 2017, 07:27 AM
Post Reply Email Thread
This is something I've been looking into in order to find newer, older, and unreleased updates for the Mi Mix 2.
Ideally, I'd like to figure out a way to get Xiaomi's nightly builds, which go out to only beta testers. I think I'm close, but any help I can get would be awesome.

I currently have two methods. One of them is rather difficult, the other is rather easy. Let's start with the easy one.

Method 1: Example 1
http://update.miui.com/updates/mi-up...ron_global&b=X
This is a URL which asks for an update to the unreleased MIUI 9 7.9.21 global edition.


If you visit this URL, you get the following response:
Code:
{"UserLevel":9,"LatestVersion":{"type":"rom","device":"chiron_global","name":"XM-MIMIX2-GLOBAL 7.9.21","description":"MIUI\u5347\u7ea7","descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/7.9.21\/chiron_global_0_7.9.21_4494ccfcc506caca9904efb74b489e0a.html","md5":"7f94ca393fae77c6171e6c7a551bea2e","filename":"miui_MIMIX2Global_7.9.21_7f94ca393f_7.1.zip","filesize":"1.6G","codebase":"7.1","version":"7.9.21","branch":"X"},"UpdateList":[{"type":"rom","device":"chiron_global","name":"XM-MIMIX2-GLOBAL 7.9.21","description":"","descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/7.9.21\/chiron_global_0_7.9.21_4494ccfcc506caca9904efb74b489e0a.html","md5":"7f94ca393fae77c6171e6c7a551bea2e","filename":"miui_MIMIX2Global_7.9.21_7f94ca393f_7.1.zip","filesize":"1.6G","codebase":"7.1","version":"7.9.21","branch":"X"}],"IncrementalUpdateList":[],"MirrorList":["http:\/\/bigota.d.miui.com"],"Signup":{"version":"","total":"","rank":""},"AuthResult":0,"ForceUpdate":0
We can piece together looking at this that the update file can be downloaded at:
http://bigota.d.miui.com/7.9.21/miui...ca393f_7.1.zip

Method 1 Example 2
It was announced today that there was a new Chinese stable release pushed only to some phones called 8.5.7.0.NDECNEF. We can modify the parameters in the URL to get this:

http://update.miui.com/updates/mi-up...1&d=chiron&b=S

This returns the following:
Code:
{"UserLevel":9,"LatestVersion":[],"UpdateList":[{"type":"rom","device":"chiron","name":"XM-MIMIX2 V8.5.7.0.NDECNEF","description":"","descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/V8.5.7.0.NDECNEF\/chiron_0_V8.5.7.0.NDECNEF_a9374e7e6aa4f38a22fd58aae29337ce.html","md5":"487f34ee14e84d0eb9ed280a059bcc65","filename":"miui_MIMIX2_V8.5.7.0.NDECNEF_487f34ee14_7.1.zip","filesize":"1.4G","codebase":"7.1","version":"V8.5.7.0.NDECNEF","branch":"F"}],"IncrementalUpdateList":[],"MirrorList":["http:\/\/bigota.d.miui.com"],"Signup":{"version":"","total":"","rank":""},"AuthResult":0,"ForceUpdate":0}
And that lets us know that the update can be found at:
http://bigota.d.miui.com/V8.5.7.0.ND...34ee14_7.1.zip

So now that we see that we have a way to query for downloads, let's look into some of the parameters.

At a minimum we need the following:

v=MIUI-V8.5.7.0.NDECNEF - This is the version with which you are querying.
c=7.1 - This is the build of Andoid. It's Android 7.1 so we put 7.1
d=chiron - This is the device. For Chinese Mix 2 firmwares it's chiron. For global it's chiron_global

You might also notice this:
b=S - S means stable. X means weekly. Actually, there is a whole list as follows, but not sure how accurate it is:
Code:
«S» — monthly build
«X» — weekly build
«D» — daily build
«E» — emegency build
«F» — stable build
«A» — experimental build
«I» — internal build
«T» — top secret build
«U» — unstable build
On top of this, there are more possible parameters. I will get around to these when talking about Method 2.

Right now, I can't access anything but weekly and stable builds, so there are not really any undiscovered/unannounced/internal builds that I've been able to find. But I think we are on the right track to being able to find them. I'm hoping that other people can continue looking using this information, and we'll see if we can find anything. Stay tuned while I update this post with Method 2, which is much more complex and much more likely to yield results.

If you want to keep my stomach full while I keep this research going, give the Donate button a click!
The Following 22 Users Say Thank You to duraaraa For This Useful Post: [ View ] Gift duraaraa Ad-Free
 
 
20th October 2017, 07:31 AM |#2  
OP Senior Member
Flag 東京☆Улаанбаатар☆Los Angeles
Thanks Meter: 1,213
 
Donate to Me
More
Method 2
Here is the more complicated Method 2. This involved capturing an OTA request from the actual phone, then decoding it along with the response. I've finally got the riddle solved enough to emulate OTA calls, so I will share and hope that the community can take my work and carry forward.

I needed to do a lot of tricks to actually capture a request, as it's done over HTTPS, and it must be Xiaomi's original SSL certificate. But with JustTrustMe / Xposed, which only worked with 7.9.8 build, I was able to finally capture it. When I captured it, I was sad to see that it was actually encrypted. But I deodexed and decompiled the Updater apk and found the password to decrypt it

So what is the request? It's json, encrypted with rijndael-128 / cbc / PKCS5 Padding using the following key for encryption:
Code:
miuiotavalided11
The encrypted json is then encoded to base64, and encoded to URL-safe. Let's call that X after all of that. So calling that X, it' and POSTed to
Code:
http://update.miui.com/updates/miotaV3.php
In this fashion:
Code:
 q=X&t=&s=1
(Remember: X is the request, encrypted, encoded to base64, and encoded to URL-safe characters.)

We then get a response from the server, which is encoded in the exact same manner.

So let's take a look at what is actually contained in the request, shall we? We'll see many more parameters than Method 1.
(Note: I have added newline characters between each parameter and added comments, but in reality there needs to be no whitespace between commas for it to work.)
Code:
{"n":"",  # I don't know what this parameter is
"unlock":"1",  # 1 means bootloader is unlocked. 0 means locked.
"g":"(This is 32 hex characters, lower case)", # This seems to be the android_id of the device. Maybe encoded somehow.
"sn":"0x00000000", # Probably the serial number of the device, maybe encoded somehow.
"a":"0", # Don't know what this is.
"v":"MIUI-7.9.8", # The version of MIUI installed.
"l":"en_US", # The locale.
"i":"(This is 64 hex characters, lower-case)", # This seems to be the imei of the device, obviously encoded somehow.
"b":"X", # Same as above, 'X' for weekly build.
"c":"7.1.1", # Same as 'c' above, it's the Android version.
"sys":"0", # I don't know what this is.
"p":"msm8998", # The chipset
"id":"", # I don't' know what this is.
"cts":"0", # I don't know what this is.
"d":"chiron", # The device name, same as above, chiron for Chinese, chiron_global for global.
"f":"1", # I don't know what this is.
"bv":"9", # I don't know what this is.
"isR":"0", # I don't know what this is.
"r":"CN" # I don't know what this is, maybe region of device?}
So, if we take this data replacing 0 for the system-identifying information, and encode it as specified, we can make a post using curl like this:
Code:
curl -d "q=6Lx%2FLwJ03fj0SAHc64gdDAB2lQ%2FlpgxmJ1KB1Ulu6mNMb825axcFrKjQycLWjbdhgiZ0R4isbsovXZKfiIviPVZVIn1V9RRtJnkM086YsFPsmBvhr0Qw9hejGdxeDT2CKJww0khuIC0DbG2YBNsAWyrnRq5L6KkHzs5GQWt9IAisvKdAHJmUBNSXoH2doRx%2FprkkbB1LgbBfHg%2BEGgI6ODgCa4CQwt6UNS0w%2FewwJ1hVUkPLiFqbLevy2FUb7Y%2FRenO6z5VVfrDcq4lez6CHPiofUT8EsJJhsB%2Bric1s8udYg8Bz9FMssyGp06yDdho3bVg3cNqww4TBap1qddxXK6aEPjNAAyFOxcxgin5%2FeHc%2B1CIKdn9d5BxPXZMAOEuI2kGrnm0oEp9KHMnaZ4GwqA%3D%3D&t=&s=1" http://update.miui.com/updates/miotaV3.php
And we get back:
Code:
O63inYnZcET2HTDyJmr+5VMsHOvahc6Xa6lRAMuZD8hlZQQ0GW0uN+sLEegAREU3S22hAJPduZXGMUaspe338cOMF5LJMqfTElzIoJ0RrAYC/jMFyUsiTFEZxz3aSLv6lFPQQ0dkl3oJp9cjAulRNr7oCvcOsz4tuz9ibxToChYtj0fsN9Qlsj0AlhUgXXvA1bsNK1X/3ILwGqGjGdm6Sgzh/+pu9AkR5h3VJiWuRRrkFVh+vFeN62RtflHyoNWpVL36EdP2q46l9sowN6P5i1yfhosOB/bTL00p3T3R+ZIiaiq0aqRMmzF8z0qemvOc0xpQXrZfgUa4pg5CighdBd9MdYr8Yke8z7tbA1XMJ8OzT6U9+tnWAPgsbKJwsY6uUjmzocTukvyZ8W0BzDCnYXqB+4i1WTO4C09/14jdg1mhKisBFetXFJ+1908cSJNEYIBRm+0ccprqhvvyj+aBPOYZtRFoAPaUpN2EbwSu5cuZmyc2Y3GcOhMQaRWuTmCkUZcIEH62H8OVx0RtE55/xv3bvRaOVs+Ib2I+7RkjvgFCuzq0pq4fS7aBlS0I5cyLGQJcn3FgBgBRlKUTOdVGb7dgB7Oqfi/Ia0OPYlfRgU3/uLIHsn44fQ33htlEOyxIWehQnT5QM25bck4yL9z08SBgpo1tijhdYtCQoQ7/DKZaLV0WEsi7urJZZXJapKnTt8Qi/1UruTB64fXU2cSo+EMWctGbnRNjF6x1u6l113IBlek/1PY4/U6NvlkFSFumT/7DeXwbqqzkVhZBxwnbKzq1utBrduwhjSp/R6Oo/yIxY0P9KuziwJBjcTjAeuOUvsbw4ic30KeZBRBnr2m3pfqzh0BTOp8kmKTx3VYmFQAWZgIwR7HG0OA7HBb6fl08tNAXlOVGAHtNtz6Y/bZxeyUmuYlmkJOV1rGnmSijxrzmA/9tEGY0rX2xMHJk320KM6lo5EYjDYPu8rwAhFhApsr+M8OZhldOfT5S2fD5bgpgY5IQkrawFb/ck2Wdqk/GHt9NuVAg4/4SGzg3K8eI0y/fZUiUN6aPSM5ysjWMVpcaITQW9XeEZBDcTORPsQR14wEC8cK2+wlqUYARSArlu0kJG8GqEnKtz0H9h0Kd0IkJ6XB84QfeHA+VMufI5+vSJoWM4dCLNwBXd9aZ6UVyn0exjvF24EJIsQ1L336LTC9ssDP9BYmVCxG6Qgz0neYzsjSQMkmzoRjamhbrtGgZcj9snTu4WcdTsmsS1hvZttB1V2vaA5wk85Ja20nP6BTddX7VPYD1onUTPFh3vZhAyZkiPEePMEZiZodRGKfq0tyHBwfWpKQL7nRKzLED0X66nyHG5NeDrefc2MFI/R4AslMRyj3Rsr9WfzgSDCp3czWheXi5FpQRpL+iwkOcSfcit0YZwW4rC2sCNdchY6x4nJ/NIuXVYIHsmKOzierEAP0aCOIXpKR7Iy5fexRuYgCBsHsuvLVZD8jdi6hmKPCFgSpggGkAiMZvnNkGe3IzWggiUOBHI37WwebIIXu8oIIcZAi7pcZrFx/2mzZBScA61Y4LTXPWsO8J1wY3TSy+MvVLlgaLy8VEu5oU0kzc4GyoiOSWKAhCw/W/m09HlBlE7zd4VslETCJDQj76gBGkbZG5HvsG/W8tg9pBikLE6OPtMY3jjCfJA/zp0HRoYw8tSDJHne3VyMqzrZrxxMloBzdmy12QKSOhFet0x0v+rCxW+DKKbOYkXFFwUEeDrPcjTY6/BVraP4qy3MYVbmP/yrg6rFdrjFxByvKxPbGH8ChWMZUAVP6IxgMpdE8RG2sWAIltRCdZa05guKmbVN1Kl4EyNEBNGPRcvF+sIrtRY0kSodZVpd0JGKY6Yf4+a058SLjtolLaPIihHg8AKeElxAMkJPbnAKdd+oU2fmCrFitnXTR8BsVSV+WKOhuQkEXtOZ2OOG0smXZUF9whaPkvRphSbycj6SlqV0I7c8oVkcktsuZOQqbuUvWwA52TeiQhCvd1LN517R3NNRv4FE6E6LhvaAGqz/0r986FHPnMcEao7tIlmo/on1LgtiDVj4SyzhweVP7bxkdnyHwSoKVJUCzL4WYmZ6jaA3cjz0mbbJ7sNZbb0syhVgqtTrsacDgLP/NL8OsyRDZNwyju2GbRUcTGkemPuLgy2imht4WpxsXJWqQDU2UIEc5XdMz7QBvmBTKg4u6cavMi1VKMxjHY/wc5/H2RoW7u4WQL4m+IVR8kzL4wNvt58IguswghY9hWKj5JaSzbKd3DAfsWlcaVtlLza48QNYxIizKL56ImfVqzR1wl+YRbL8MfxOn/XpTWbEXhp/2n+AvDYklGXNBd0Cl3wOEkGsqB605ru6WdPapws0yBAYYIEEVUrkPhrI5JalJC6as1VDInqmkb3DMG7cNgc0Vl1hIhLlsHCaOUraRscyX1YlvvRsolMdm+UD8cT3AE7JTr3oM213utmVI2DEQUUQD7LsAvpLsWr1M1gmE/aDvvCOPGPyMan6aMr5a80Yu1CXxMEq5HX9C9/pZEo6CBspsKcCdLOO9IMisTQiqZ0ekb2Wb1cZcTU5yb/qfLi7bSrUl6UgjU5bJpOD4Sy4LlPXfPq/AsG6BHb92oPVgcVxNsuUsOQiwKRdPgXMW/q8DqwuABq8b8w37kXA8KBbGufo92vCnefscbcPTWKxdMK4qbWJfv9jAWSS3ryH6T6qiAceVbe6EC/aV0fPZ2L+iWCrWh/saHmG66jvogo+rB1C+XbhmZxy5cBC+DSwKkhh9W3XbLgs2aQ/2T8fBfe4DUoicxVbQ+K1PypOZEryguq97uD3AUPMHKqd7+mLsZBlv/2Fg5aHqA0zbJQZtlbP8rTsypNnraNC2OIK1c0dW3Uh/t2fkUJmpULcvnBekxYftQGu49u6WBlHwzaS1YPXvHMxgOBWDlOlDIDjl3hJqSZPCBrA1x3DbJvB4GQcBD65yGt57sVAVgZTUbXehs82StasJ6+df8IZQjEQXe3tuqIaPp5tkw9oa2L9a5RYD0oDtlQbE+LoE+vT2mJ6n5g+r2uHEz1iIAUmmA6cXR6VyfbwnxfoZhpW+E1WYLbuGeZwAtlWCKl02LYXCuhYWSXDqP4uR71/D7j3t7xdoRVdg/ze1853ekyhJlyeAZKEEWhPbyoyMUJrrgHSg1ZbravYUhLtHCAcz0cQoDPUCoSw9oTs6WUs7Tpn1LfxXT3u2ALlCQhqTgO7fymzm+4UoOd4dPrOXP7a/4zP6FC1Vlm4MTsp8SbPM3S+OHKm2tqPQhMInclllTq3RKbsr46TPELjalfnBb56TMrJSVOMbqEcCbQhu6dXynMg1bYXKQslbuoT71o9GzNER/HccfuJJn1dWNMeeziUgZFbegkOXGdkvAj4JUm6UzwUJ0ehuOEb390VMUihquimqnRqI88ve2U+sLovPwicuQsvszuv0S5m1szJnQtzAjYwV4+9wKePU260i1bF4zSgsrswU3nj2DHlouv65nY4jDQiFIwb44MU96XEyPt3wXxrS+KjtmFfXMQTjmZ9GQxNZPmxNPOnRxfjG9SuSOaW0I0cHwTy46HBAWo1Dx+kj56J2bjLyXFfDdXOJ8K0+kLCPxXFucEhAxpYkLB9miuNbiYHHujW6FWXNaF8trkDyfE6qSkSqUfHvzPbq7xs0n3k43tiMQr0nzCJ0btsnuXATvZW7sJqMkJlQPqD1NTvgC7yrqpGiyh5dTCTfudk9g/pv6rbdXHw85JlylwtnstFoQQbBIPNxKAfLHFHoZX3nWpVMggf34wmbU1BI2cntqaAjBAgtmmu3OM8+i5Ht+lRCz5WZiXSdQ7oQkbG/CBnXG6N9ZO48nxihXKLMuosZmd57wILMaI4q3eIAtrprnRA7cVUeWynum2KA+kd9BF0y2Y0Qh9v389RAwkZOBp5EDkp4SCakPF7o+5L9szCOKUpb1MsEzhYwrR+NvtvPXy1rv+7iY44ZFnDamGQJiVcoL74mHOAFAmyQUB3KBg+24Q3IzG+Sv2r68AcjICrvye7HedbNdqM572uCliTqmwypLMeYA5CPANSCpFfMQ1x2n0wEjJmr7BmSdYftdT3E11wdmPOYGIsPDg33kRIYtB3TGDC1FoBlfs50D82URfKV9QzaiIC3yhak6ovgzKiTMFwqNc8iOdAJXOCIxEtW2DIFo0nz/bBHErWEmPrHwgs5tTB+kc7cry8XsmUOs17NwMxOafN6y/98U68ECVoKUFY3SSk8XKWu85P8V3yPxbu1e8ixmBODGUTXjNdcPxeoeuDCRcis2pK43oi2ob9oMpMOgYx5X2NPJplOB+VKRcSnggRGaFabXvqJuvscoWVY5OwnsNE0e+dzDptzx124mqqDoL3PepGvSCTyp0rOEqdZjNu7UcPGD/vWz3tGdMUisHdesp0n4Dd25QoIWFK75/BBeVjAQNLeBDTAn/cE3VLYoex4sEmiRD8sWZZVoeoocnANBeChX1lxuWuLKcTT4UcilNDjp3utQzUen4lZr65udZnHBIVsQgKiv+NON9c48DDgnhxo8c+Wac2fZs+d+vKZg7oW/Q4H9E+JnKkClvKvjSdBbChvR2KVxkvFKMZ+x3BuzYeHe0Xl7pP9kwj2qSkHapniYy72Kvt+yD+caIqa/vNR5flBjT1iv84h7MDXd6jPuwrtlVOQxNLPZiQ==
Which when decrypted becomes:
Code:
{  
   "UserLevel":9,
   "LatestRom":{  
      "type":"rom",
      "device":"chiron",
      "name":"XM-MIMIX2 7.9.27",
      "description":"MIUI\u5347\u7ea7",
      "descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/7.9.27\/chiron_0_7.9.27_en_3a76231d04d1b42ce4f6dcfaaacd1484.html",
      "md5":"544b5231d0a5e43681a4645cfe4c78dc",
      "filename":"miui_MIMIX2_7.9.27_544b5231d0_7.1.zip",
      "filesize":"1.5G",
      "codebase":"7.1",
      "version":"7.9.27",
      "branch":"X",
      "changelog":{  
         "Home screen":{  
            "txt":[  
               "Fix - Wallpapers weren't fully shown after entering Second space(09-27)"
            ]
         }
      },
      "filepath":null,
      "Validate":"E7ruxlSYDxGiyQB3vbWdB3GnfQk0eq0GScwmqFkMo4X5LCYuciJ+4awJrUhyiXR0yr49eBLwPKyaZ0O2e7T4XtMvY5yAOnf9FGCR0x6XgYITvBpXW6cHLQbhui7cAV0CJGHvgBOgZmKkaWm5BqpVIS219GuRhP46gV25lYXRD7IENxeomFe\/V\/EgFiF7NX5W71MVETvZYV1YqI49JBNQ+MlSkxdss3\/tiO\/h9JwbDd6pP4LyUkTmqO+j53heKQ4rB5PweT3WomwwXdfc16cXAnY3IrTBCgTVv9P4BfJtZ7JP2GrJtZo2M\/hqRFDqSYqcSPEPRd8QNaWSEMfqcU+KaQ==",
      "Erase":0
   },
   "CurrentRom":{  
      "type":"rom",
      "device":"chiron",
      "name":"XM-D5 7.9.8",
      "description":"",
      "descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/7.9.8\/chiron_0_7.9.8_en_778cf237532f4439c07cab7bf5237de8.html",
      "md5":"7fea962602b88a9b89a9ff2c9fcbb8b1",
      "filename":"miui_CHIRON_7.9.8_7fea962602_7.1.zip",
      "filesize":"1.4G",
      "codebase":"7.1",
      "version":"7.9.8",
      "branch":"X",
      "changelog":{  
         "Highlights":{  
            "txt":[  
               "Optimization - Simplified and improved the design of the virus scan result page(09-07)"
            ]
         },
         "Security":{  
            "txt":[  
               "Optimization - Simplified and improved the design of the virus scan result page(09-07)"
            ]
         }
      },
      "filepath":null,
      "Validate":"mg70sGTdGNruAyrTMWfgCELPnN4ZqySCsK7B+8H1IcntuuNuQMoQqKC\/xej85sebJ0QNwV+d\/fB\/nBm0OwZH2ikhwG2qWV5sO4UYM9LAXYgPjD0M0TE4YVoCqDmkIJwEJ2+gO5Ob7J2ouAgO9cP4aoC5YqNkR8HGu6yRJIl17\/g0HFjpY22G3RaXyf99yEFeeyRlh0Bb3pn8JCFiRkLD0A4DGmg6iz\/ZSNKxtu5FBpZe7ZMGe7V20ByDQcs2+Ki2MHalrm6zSp66vSaO3GhePhwRmAg5Y7SqTyL2\/89w4qfbdcKjSy2gCohpH1JyjwD82vGdcFaR0e2XPZ54emqyTw==",
      "Erase":0
   },
   "IncrementRom":{  
      "type":"ota",
      "device":"chiron",
      "name":"XM-MIMIX2 7.9.27",
      "description":"MIUI\u5347\u7ea7",
      "descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/7.9.27\/chiron_0_7.9.27_en_3a76231d04d1b42ce4f6dcfaaacd1484.html",
      "md5":"544b5231d0a5e43681a4645cfe4c78dc",
      "filename":"miui_MIMIX2_7.9.27_544b5231d0_7.1.zip",
      "filesize":"1.5G",
      "codebase":"7.1",
      "version":"7.9.27",
      "versionForApply":"7.9.8",
      "branch":"X",
      "desDetail":[  
         {  
            "Home screen":[  
               "Fix - Wallpapers weren't fully shown after entering Second space(09-27)"
            ]
         }
      ],
      "changelog":{  
         "Home screen":{  
            "txt":[  
               "Fix - Wallpapers weren't fully shown after entering Second space(09-27)"
            ]
         }
      },
      "filepath":null,
      "Validate":"E7ruxlSYDxGiyQB3vbWdB3GnfQk0eq0GScwmqFkMo4X5LCYuciJ+4awJrUhyiXR0yr49eBLwPKyaZ0O2e7T4XtMvY5yAOnf9FGCR0x6XgYITvBpXW6cHLQbhui7cAV0CJGHvgBOgZmKkaWm5BqpVIS219GuRhP46gV25lYXRD7IENxeomFe\/V\/EgFiF7NX5W71MVETvZYV1YqI49JBNQ+MlSkxdss3\/tiO\/h9JwbDd6pP4LyUkTmqO+j53heKQ4rB5PweT3WomwwXdfc16cXAnY3IrTBCgTVv9P4BfJtZ7JP2GrJtZo2M\/hqRFDqSYqcSPEPRd8QNaWSEMfqcU+KaQ==",
      "Erase":0
   },
   "Icon":{  
      "Highlights":"file_1499853287_6769.png",
      "Security":"file_1500448862_6767.png",
      "System":"file_1499853295_9393.png",
      "Gallery":"file_1499851680_4325.png",
      "MI Wallet":"file_1499852587_8034.png",
      "Home screen":"file_1499850502_548.png"
   },
   "MirrorList":[  
      "http:\/\/bigota.d.miui.com"
   ],
   "FileMirror":{  
      "video":"http:\/\/file.update.miui.com\/video\/",
      "image":"http:\/\/file.update.miui.com\/image\/",
      "icon":"http:\/\/file.update.miui.com\/icon\/"
   },
   "Signup":{  
      "version":"",
      "total":"",
      "rank":""
   },
   "AuthResult":0,
   "Cta":0,
   "Strategy":false,
   "Clause":false,
   "Code":{  
      "code":2000,
      "message":""
   }
}
And indeed this is all the information we need to find the update file of the current build, along with whatever update there is.

For those who want to play around with this, get python-mcrypt 1.1 and you can try this code:

decrypt.py
Code:
from mcrypt import *
import base64

def decrypt(inp):
    m = MCRYPT("rijndael-128", "cbc")
    m.init('miuiotavalided11', '0102030405060708')
    
    r = m.decrypt(base64.b64decode(inp))
    while r[-1] != '}':    
        r = r[0:-1]
    return r

def encrypt(inp):
    m = MCRYPT("rijndael-128", "cbc")
    m.init('miuiotavalided11', "0102030405060708")
    bs = m.get_block_size()
    n = bs - (len(inp) % bs)
    while bs - (len(inp) % bs) != bs:
        inp += chr(n)
    return base64.b64encode(m.encrypt(inp))
miuichecker.py
Code:
from decrypt import *
import urllib2, base64, json, threading, sys, urllib
global checkurl
checkurl = 'http://update.miui.com/updates/miotaV3.php'

default = {
    "n":"",  # I don't know what this parameter is
    "unlock":"1",  # 1 means bootloader is unlocked. 0 means locked.
    "g":"00000000000000000000000000000000", # This seems to be the android_id of the device. Maybe encoded somehow.
    "sn":"0x00000000", # Probably the serial number of the device, maybe encoded somehow.
    "a":"0", # Don't know what this is.
    "v":"MIUI-7.9.8", # The version of MIUI installed.
    "l":"en_US", # The locale.
    "i":"0000000000000000000000000000000000000000000000000000000000000000", # This seems to be the imei of the device, obviously encoded somehow.
    "b":"X", # Same as above, 'X' for weekly build.
    "c":"7.1.1", # Same as 'c' above, it's the Android version.
    "sys":"0", # I don't know what this is.
    "p":"msm8998", # The chipset
    "id":"", # I don't' know what this is.
    "cts":"0", # I don't know what this is.
    "d":"chiron", # The device name, same as above, chiron for Chinese, chiron_global for global.
    "f":"1", # I don't know what this is.
    "bv":"9", # I don't know what this is.
    "isR":"0", # I don't know what this is.
    "r":"CN" # I don't know what this is, maybe region of device?
} 

def makeRequest(inp, tval="", sval="1"):
    js = json.dumps(inp, separators=(',', ':'))
    global svalue
    postdata = "q="+urllib.quote_plus(encrypt(js))+"&t="+tval+"&s=" + sval
    print postdata
    global checkurl
    try:
        response = urllib2.urlopen(checkurl, postdata)
        ret = response.read()
        r = decrypt(ret)
        json.loads(r)
    except:
        print "Problem"
        
print(makeRequest(default))
Just put your parameters into miuichecker.py then run
Code:
python miuichecker.py
And you will get the decrypted result.

Wow, that was long! But that's where I'm at right now. Hopefully someone can look at this and find ways to get something cool!
The Following 18 Users Say Thank You to duraaraa For This Useful Post: [ View ] Gift duraaraa Ad-Free
22nd October 2017, 03:29 AM |#3  
punkmonkey1984's Avatar
Senior Member
Flag Bucheon 부천시
Thanks Meter: 573
 
More
Isn't this link (http://bigota.d.miui.com/7.9.21/miui...ca393f_7.1.zip) global miui 9?

I say because Chinese dev rom (miui 9) is the same miui version (7.9.19 which is a lower firmware number)
22nd October 2017, 09:31 AM |#4  
OP Senior Member
Flag 東京☆Улаанбаатар☆Los Angeles
Thanks Meter: 1,213
 
Donate to Me
More
Quote:
Originally Posted by punkmonkey1984

Isn't this link (http://bigota.d.miui.com/7.9.21/miui...ca393f_7.1.zip) global miui 9?

I say because Chinese dev rom (miui 9) is the same miui version (7.9.19 which is a lower firmware number)

Yes, that's global miui 9, but it's old. I'd like to find a newer one.
22nd October 2017, 02:05 PM |#5  
Senior Member
Thanks Meter: 92
 
More
Quote:
Originally Posted by duraaraa

Yes, that's global miui 9, but it's old. I'd like to find a newer one.

<snip>
22nd October 2017, 02:08 PM |#6  
OP Senior Member
Flag 東京☆Улаанбаатар☆Los Angeles
Thanks Meter: 1,213
 
Donate to Me
More
Quote:
Originally Posted by Caitlin550

<snip>

Before you snipped it.... it's from September 21, so it's a month old. :P
22nd October 2017, 02:29 PM |#7  
Senior Member
Thanks Meter: 92
 
More
Quote:
Originally Posted by duraaraa

Before you snipped it.... it's from September 21, so it's a month old. :P

I believe this is the global version? I know this is different to Xiaomi's global MIUI9 releases

https://sourceforge.net/projects/xia...1.zip/download
22nd October 2017, 03:14 PM |#8  
OP Senior Member
Flag 東京☆Улаанбаатар☆Los Angeles
Thanks Meter: 1,213
 
Donate to Me
More
Quote:
Originally Posted by Caitlin550

I believe this is the global version? I know this is different to Xiaomi's global MIUI9 releases

https://sourceforge.net/projects/xia...1.zip/download

It's a modified version of the Chinese ROM. It's not the official global ROM from Xiaomi.
22nd October 2017, 03:28 PM |#9  
Senior Member
Thanks Meter: 92
 
More
Quote:
Originally Posted by duraaraa

It's a modified version of the Chinese ROM. It's not the official global ROM from Xiaomi.

Ah okay
22nd October 2017, 04:30 PM |#10  
punkmonkey1984's Avatar
Senior Member
Flag Bucheon 부천시
Thanks Meter: 573
 
More
Quote:
Originally Posted by duraaraa

Yes, that's global miui 9, but it's old. I'd like to find a newer one.

Have you tried it? Does it work without issues?
Does it receive OTA updates to a newer one?
22nd October 2017, 04:35 PM |#11  
OP Senior Member
Flag 東京☆Улаанбаатар☆Los Angeles
Thanks Meter: 1,213
 
Donate to Me
More
Quote:
Originally Posted by punkmonkey1984

Have you tried it? Does it work without issues?
Does it receive OTA updates to a newer one?

Yes, I tried it. It works without issues. It does not receive any newer OTA right now. Hopefully soon.
The Following User Says Thank You to duraaraa For This Useful Post: [ View ] Gift duraaraa Ad-Free
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes