Guide: Reverse-engineering Xiaomi OTA Updates to Find Unreleased Versions

duraaraa

Senior Member
This is something I've been looking into in order to find newer, older, and unreleased updates for the Mi Mix 2.
Ideally, I'd like to figure out a way to get Xiaomi's nightly builds, which go out to only beta testers. I think I'm close, but any help I can get would be awesome.

I currently have two methods. One of them is rather difficult, the other is rather easy. Let's start with the easy one.

Method 1: Example 1
http://update.miui.com/updates/mi-updateV6.php?v=MIUI-7.9.21&c=7.1&d=chiron_global&b=X
This is a URL which asks for an update to the unreleased MIUI 9 7.9.21 global edition.


If you visit this URL, you get the following response:
Code:
{"UserLevel":9,"LatestVersion":{"type":"rom","device":"chiron_global","name":"XM-MIMIX2-GLOBAL 7.9.21","description":"MIUI\u5347\u7ea7","descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/7.9.21\/chiron_global_0_7.9.21_4494ccfcc506caca9904efb74b489e0a.html","md5":"7f94ca393fae77c6171e6c7a551bea2e","filename":"miui_MIMIX2Global_7.9.21_7f94ca393f_7.1.zip","filesize":"1.6G","codebase":"7.1","version":"7.9.21","branch":"X"},"UpdateList":[{"type":"rom","device":"chiron_global","name":"XM-MIMIX2-GLOBAL 7.9.21","description":"","descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/7.9.21\/chiron_global_0_7.9.21_4494ccfcc506caca9904efb74b489e0a.html","md5":"7f94ca393fae77c6171e6c7a551bea2e","filename":"miui_MIMIX2Global_7.9.21_7f94ca393f_7.1.zip","filesize":"1.6G","codebase":"7.1","version":"7.9.21","branch":"X"}],"IncrementalUpdateList":[],"MirrorList":["http:\/\/bigota.d.miui.com"],"Signup":{"version":"","total":"","rank":""},"AuthResult":0,"ForceUpdate":0
We can piece together looking at this that the update file can be downloaded at:
http://bigota.d.miui.com/7.9.21/miui_MIMIX2Global_7.9.21_7f94ca393f_7.1.zip

Method 1 Example 2
It was announced today that there was a new Chinese stable release pushed only to some phones called 8.5.7.0.NDECNEF. We can modify the parameters in the URL to get this:

http://update.miui.com/updates/mi-updateV6.php?v=MIUI-V8.5.7.0.NDECNEF&c=7.1&d=chiron&b=S

This returns the following:
Code:
{"UserLevel":9,"LatestVersion":[],"UpdateList":[{"type":"rom","device":"chiron","name":"XM-MIMIX2 V8.5.7.0.NDECNEF","description":"","descriptionUrl":"http:\/\/update.miui.com\/updates\/updateinfo\/V8.5.7.0.NDECNEF\/chiron_0_V8.5.7.0.NDECNEF_a9374e7e6aa4f38a22fd58aae29337ce.html","md5":"487f34ee14e84d0eb9ed280a059bcc65","filename":"miui_MIMIX2_V8.5.7.0.NDECNEF_487f34ee14_7.1.zip","filesize":"1.4G","codebase":"7.1","version":"V8.5.7.0.NDECNEF","branch":"F"}],"IncrementalUpdateList":[],"MirrorList":["http:\/\/bigota.d.miui.com"],"Signup":{"version":"","total":"","rank":""},"AuthResult":0,"ForceUpdate":0}
And that lets us know that the update can be found at:
http://bigota.d.miui.com/V8.5.7.0.NDECNEF/miui_MIMIX2_V8.5.7.0.NDECNEF_487f34ee14_7.1.zip

So now that we see that we have a way to query for downloads, let's look into some of the parameters.

At a minimum we need the following:

v=MIUI-V8.5.7.0.NDECNEF - This is the version with which you are querying.
c=7.1 - This is the build of Andoid. It's Android 7.1 so we put 7.1
d=chiron - This is the device. For Chinese Mix 2 firmwares it's chiron. For global it's chiron_global

You might also notice this:
b=S - S means stable. X means weekly. Actually, there is a whole list as follows, but not sure how accurate it is:
Code:
«S» — monthly build
«X» — weekly build
«D» — daily build
«E» — emegency build
«F» — stable build
«A» — experimental build
«I» — internal build
«T» — top secret build
«U» — unstable build
On top of this, there are more possible parameters. I will get around to these when talking about Method 2.

Right now, I can't access anything but weekly and stable builds, so there are not really any undiscovered/unannounced/internal builds that I've been able to find. But I think we are on the right track to being able to find them. I'm hoping that other people can continue looking using this information, and we'll see if we can find anything. Stay tuned while I update this post with Method 2, which is much more complex and much more likely to yield results.

If you want to keep my stomach full while I keep this research going, give the Donate button a click!
 
Last edited:

duraaraa

Senior Member
This is my first miui device, using miflash, I cant select the .zip file as it's not a fastboot image.
How did you manage to flash the .zip with fastboot flashing ?
I used sdat2img.py to convert the system data to something flashable. Then I looked up which partitions need to be flashed where by checking a flash-all.bat file, and followed that format using fastboot to flash each partition.

But... there's no reason to flash this. It's not a public release and it doesn't really do anything better than other choices. I think flashing xiaomi.eu is a better choice.
 
  • Like
Reactions: punkmonkey1984

punkmonkey1984

Senior Member
Aug 16, 2008
2,063
613
0
Bucheon 부천시
I used sdat2img.py to convert the system data to something flashable. Then I looked up which partitions need to be flashed where by checking a flash-all.bat file, and followed that format using fastboot to flash each partition.

But... there's no reason to flash this. It's not a public release and it doesn't really do anything better than other choices. I think flashing xiaomi.eu is a better choice.
Thanks for the reply, Good luck with digging with the OTA update .zips, hopefully, you manage how to capture the download newer unreleased files to share with us all. :good::good: