[S905x] Help with Mi Box (Android TV MDZ-16-AB) Bootloader Unlock And Root

Search This thread

coffenat

Member
Mar 15, 2015
14
2
for linux users

figured this would help linux users , just evilpotatos script , modified a little

#!/bin/bash
echo 'make sure you have flashed the userdebug version or this will not work'
echo 'remember this is a tethered root'
echo 'diabling automatic updates'
adb shell pm disable com.google.android.gms/.update.SystemUpdateService
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$ActiveReceiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$SecretCodeReceiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdatePanoActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$SecretCodeReceiver
echo 'starting root , remounting file systems'
adb root
adb remount /
adb remount
echo 'pushing superSu'
adb shell mkdir /system/app/SuperSU
adb shell mkdir /system/bin/.ext
adb push common/Superuser.apk /system/app/SuperSU/SuperSU.apk
adb push common/install-recovery.sh /system/etc/install-recovery.sh
adb push armv7/su /system/xbin/su
adb push armv7/su /system/xbin/daemonsu
adb push armv7/su /system/bin/.ext/.su
adb push armv7/supolicy /system/xbin/supolicy
adb push armv7/libsupol.so /system/lib/libsupol.so
adb shell touch /system/etc/.installed_su_daemon
adb shell mv /system/bin/app_process32 /system/bin/app_process32_original
adb shell mv /system/bin/app_process /system/bin/app_process_original
echo 'adjusting permisions'
adb shell chmod 0644 /system/app/SuperSU/SuperSU.apk /system/lib/libsupol.so /system/etc/.installed_su_daemon
adb shell chmod 0755 /system/etc/install-recovery.sh /system/xbin/su /system/bin/.ext/.su /system/xbin/daemonsu /system/xbin/supolicy
adb shell chcon u:eek:bject_r:system_file:s0 /system/app/SuperSU/SuperSU.apk /system/xbin/su /system/bin/.ext/.su /system/xbin/daemonsu
adb shell chcon u:eek:bject_r:system_file:s0 /system/xbin/supolicy /system/lib/libsupol.so /system/etc/.installed_su_daemon
adb shell chcon u:eek:bject_r:zygote_exec:s0 /system/bin/app_process32_original
adb shell chcon u:eek:bject_r:zygote_exec:s0 /system/bin/app_process_original'
echo 'linking files'
adb shell rf -f /system/bin/recovery-install.sh
adb shell ln -s /system/etc/install-recovery.sh /system/bin/install-recovery.sh
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process32
echo 'finishing the install of supersu'
adb shell su --install
echo 'setting up tether needs root to make it automatic just plug it in and itll do what it needs to do to boot :)'
echo 'ACTION=="add", ATTRS{idVendor}=="18d1",ATTRS{idProduct}=="4e12",RUN+="~/minit.sh"'> ./minit.rules
sudo mv ./minit.rules /etc/udev/rules.d/minit.rules
sudo chmod 0755 /etc/udev/rules.d/minit.rules
cd ~
echo '#!/bin/bash' > minit.sh
echo 'adb wait-for-device' >> minit.sh
echo 'adb root' >> minit.sh
echo 'adb remount /' >> minit.sh
echo 'adb remount' >> minit.sh
echo "adb shell 'setenforce 0'" >> minit.sh
sudo chmod 0777 ./minit.sh
echo 'root complete just remember to plug this device in during boot , or another device with adb and launch'
echo "adb root;adb shell 'setenforce 0'"
 

VivaLaVent

Senior Member
Jun 23, 2014
79
38
Google Pixel 4a
Rooting and installing SuperSU tutorial

I have been browsing this forum for hours now, and here is my tutorial for those who want working SuperSU on their MDZ-16-AB Mi Box 3. Warning: since the bootloader isn't unlockable yet, you will have to connect a laptop to run some commands EVERY TIME YOU BOOT UP THE MI BOX. Luckily, this doesn't apply to waking up from standby mode, so as long as you keep your Mi Box plugged in and don't power it off, you'll be fine.

You will need:

The steps:
  1. Put the downloaded userdebug firmware ROM on a FAT32 formatted drive.
  2. Enable developer options on the Mi Box. This can be done in your settings, find "About" and then click on "build" 7 times to enable the developer options. It will confirm you've done this with an on-screen toast notification.
  3. Connect the Mi Box to your computer and check if a device comes up when typing "adb devices" in command prompt. If not, wait for the Mi Box to display a dialogue confirming you want to allow adb on this computer.
  4. Type "adb reboot recovery" to put the Mi Box in recovery mode. Once in recovery, unhook the cable and plug in your usb, click "Apply update from EXT" then "Update from udisk" and select MiBOX3_USA_once_r454.zip, then just let the update do it's thing.
  5. Reboot the device. Once we're back, see if the box is still under adb devices.

Now run these commands:
Code:
adb root
adb remount
adb disable-verity
adb reboot

The device will reboot. Once it's rebooted, run these commands to disable OTA updates (otherwise it will immediately update to an unrootable firmware
Code:
adb root
adb remount
adb shell pm disable com.google.android.gms/.update.SystemUpdateService
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$ActiveReceiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$SecretCodeReceiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdatePanoActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$SecretCodeReceiver
adb reboot

Wait for the device to reboot. Now we've disabled OTA updates we can install SuperSU. Unzip the SuperSU installer and run the installer BAT script. When the script is done, it will seem as if the device is bootlooping. From now on, this will happen EVERY TIME THE DEVICE BOOTS. Below are the steps you should perform to get your device to boot in SuperSU-rooted state.

  1. While the bootanimation is running, keep executing "adb devices" until your device is in the list.
  2. Once the Mi Box is in the adb devices list, type "adb root" and press enter. your device will be disconnected from adb again.
  3. Keep executing "adb devices" again until the Mi Box reappears. When it's there, type "adb shell setenforce 0"
  4. All these steps are performed while the bootanimation is playing. The device will boot shortly after the last command is executed. Be patient as it can take a while for the device to re-enter the adb devices list.
 

VivaLaVent

Senior Member
Jun 23, 2014
79
38
Google Pixel 4a
I'd also be interested in this. I only want root enabled for a couple of days to tweak a few settings and then unroot. Think it's too much a piece of work having to enter "setenforce 0" via a laptop every time power is off.
The point is that the commands are required because the system partition is altered, the only way to "unroot" would be to reflash stock, thus undoing the modifications. Until the bootloader can be unlocked, this is all we can do.
 

VivaLaVent

Senior Member
Jun 23, 2014
79
38
Google Pixel 4a
Yeah, just the fact that you did that is enough for me, man. I mean, really this thread is a damn mess.

Side note...where do I get the stock rom if I ever wanted to revert?
In theory just flash the userdebug ROM I provided, it will then OTA to the stock ROM from there (after disabling any modifications and re-enabling the OTA services, same commands just type enable instead of disable).

Unfortunately the OTA wouldn't come through for me, I have found the only reliable way to have your device egible for OTA again is to also factory reset :/
 

RavenII

Senior Member
Dec 4, 2006
398
43
In theory just flash the userdebug ROM I provided, it will then OTA to the stock ROM from there (after disabling any modifications and re-enabling the OTA services, same commands just type enable instead of disable).

Unfortunately the OTA wouldn't come through for me, I have found the only reliable way to have your device egible for OTA again is to also factory reset :/

Oh, ok, so a standard factory reset will still revert everything (sys partition, etc. etc.) back to normal...that's fine with me. Thanks again for all the help, I appreciate it.
 

VivaLaVent

Senior Member
Jun 23, 2014
79
38
Google Pixel 4a
Oh, ok, so a standard factory reset will still revert everything (sys partition, etc. etc.) back to normal...that's fine with me. Thanks again for all the help, I appreciate it.
A factory reset after flashing the userdebug rom, that is.

EDIT: Wanted to add that considering all these things it's not really worth it to root the Box imho, but that doesn't make my guide any less functional, it's still the only way to get root of you REALLY need it, which, again, I think is better without for me personally.
 
Last edited:

J-Pod

Senior Member
Jan 15, 2013
169
43
Wisconsin
Another Mi Box Nougat Firmware leak:

All credit goes to wrxtasy who posted the below on the kodi.tv forums and I am just reposting:

Another Mi Box Nougat Firmware leak:

WARNING - this Beta Firmware will break all Youtube playback.

Android Nougat Beta Build 1035 Aug 2017

Pre requisites, some sort of USB Hub and a Wireless USB or physical Keyboard attached.

- Save to a Fat32 formatted USB Stick
- Whilst plugging in Power Cord - hold down remote Back & large OK buttons to enter Recovery
- Update from EXT and select your USB - once-user 7.0 NBD92G 1035 release-keys.zip file
- Reboot

WARNING - this Beta Firmware will break all Youtube playback.

Once you upgrade to Nougat you cannot downgrade back to Marshmallow.

However you can downgrade to the previous - pretty stable Nougat Beta Firmware if Youtube is really needed:

Previous Nougat Beta Firmware

TIPS:
Double Pressing the Small Center Button activates the quick Apps Switcher/Killer

Observations:

HD Netflix with 5.1 Audio works (I have a DD+ capable TV)
5.1 AC3 Passthrough in Kodi Krypton works
No Kodi dynamic refresh switching disappointingly.
Nougat is at least 2X faster than Marshmallow - the remote is now ultra responsive Smile
Apparently 4K HDR Netflix works - I have only tested 4K but not HDR.
Casting H264 video seems improved (apart from Youtube)

And one last time:
WARNING - this Beta Firmware will break all Youtube playback.
All credit goes to wrxtasy who posted the above on the kodi.tv forums and I am just reposting

If posting like this is not ok, moderators please let me know.
 

James101

Senior Member
Jan 4, 2013
159
25
THanks!
Does this break the Youtube app? or breaks kodi addons that stream from Youtube or both???
 

Top Liked Posts

  • There are no posts matching your filters.
  • 12
    Found the link for google's servers: android.googleapis.com/packages/ota/xiaomi_once_once/87cf61497f0f6c6ed49ff22bc9b8bd3d3167b9e5.zip
    and latest Android 6.0 r750 in case you want to revert: android.googleapis.com/packages/ota/xiaomi_once_once/4798e23749378f1bc5a7a072b2d9351a980abbfb.zip
    Happy Easter everyone!
    10
    I was able to get this rooted, but haven't been able to unlock the bootloader.
    1. Download MiBOX3S_USA_once_r454.zip from 4PDA.ru unrar it and put it on a USB stick.
    2. Turn on adb from the developer options, connect, and "adb reboot recovery"
    3. Unplug the USB cable and plug in the USB stick. Choose "Install from EXT">"From UDISK", and flash the update.
    4. Reboot it and plug the USB cable back in. Re-enable usb debugging (if your settings were cleared) then disable dm-verity by typing "adb root" then "adb disable-verity" and then "adb reboot"
    5. Once it reboots, you are now free to modify the system partition as you see fit by typing "adb root" then "adb remount". you are effectively 'rooted' at this point.

    I went further and manually installed SuperSU to enjoy some rooted app goodness, but to be honest, it was a pain.

    One thing I noticed is that the most recent OTA wipes your changes, so you may want to disable updates until I can come up with a more elegant solution:

    Code:
    adb root
    adb shell pm disable com.google.android.gms/.update.SystemUpdateService
    adb shell pm disable com.google.android.gms/.update.SystemUpdateService$ActiveReceiver
    adb shell pm disable com.google.android.gms/.update.SystemUpdateService$Receiver
    adb shell pm disable com.google.android.gms/.update.SystemUpdateService$SecretCodeReceiver
    adb shell pm disable com.google.android.gsf/.update.SystemUpdateActivity
    adb shell pm disable com.google.android.gsf/.update.SystemUpdatePanoActivity
    adb shell pm disable com.google.android.gsf/.update.SystemUpdateService
    adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$Receiver
    adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$SecretCodeReceiver

    ** edit **
    I have a bootloader unlock authorization for this device from xiaomi, but I can't seem to get it into either bootloader mode or EDL mode. Any help on this front would be appreciated.
    10
    supersu script

    The attached script will install supersu after following my previous guide.

    12/19/2016 -- updated script --

    The script represents the steps I manually took to install supersu, and should work, but is itself untested. You can open up the .bat file with notepad to see what's going on.

    Unzip the attached file on your desktop or somewhere, then double click InstallScript.bat

    IMPORTANT (As I've stated previously): Due to an issue with SElinux, make sure USB Debugging is ALWAYS ON prior to rebooting the box, otherwise you'll need to reinstall the firmware.

    If you hang after a reboot, do this:
    1. in your connected computer, in a shell, type "adb root"
    2. type "adb shell setenforce 0"
    This can only be done if usb debugging is set to ON prior to the reboot, otherwise you'll need to reinstall the firmware.
    8
    USA MDZ-16-AB updated supersu script

    I believe I've corrected to bootloop issue and submit an updated script.
    8
    this isn't related to root but here's the beta nougat update for those interested
    mega nz/#!xaZgBCrY!l65tcGGt9izhZ2k1HCtka6w3H5-3qXSmq_sBcZn6uy8