[S905x] Help with Mi Box (Android TV MDZ-16-AB) Bootloader Unlock And Root

[krytikul]

Hello everyone,

I've spent a little bit of time trying to unlock the bootloader/obtain root on the recently released Mi Box (Android TV MDZ-16-AB).

I spliced together a USB-A Male to Male cable and first started messing around with ADB.

I figured if I could get into fastboot (bootloader mode) I might be able to make some progress.

Here are some issues I'm running into:

1. Rebooting to the bootloader via the adb command(s) (adb reboot bootloader/adb reboot-bootloader) does not work, the device simply reboots without going into bootloader mode.

2. Rebooting to the bootloader through the recovery (image below ) does not work, the device simply reboots without going into bootloader mode .

3. All of the automated rooting applications fail to work (As I expected since this is MM)

Does this rom not have fastboot or download mode enabled?

If anyone could provide some help it would be greatly appreciated.

Thanks

 

[mattvirus]

did you try to sideload SU zip package? Just got my MI Box today, haven't opened it. what did you do to get it to boot into recovery mode?

 

[krytikul]

did you try to sideload SU zip package? Just got my MI Box today, haven't opened it. what did you do to get it to boot into recovery mode?

Sideloading anything other than official firmware won't work in the stock recovery unfortunately (afaik). I tried sideloading a SuperSU zip with no luck.

I also tried sideloading the official firmware ( "MiBOX3S_USA_Once_260516.zip") for the Mi Box 3S (not Android TV) since the hardware is the same. It seems that they sign both the Mi Box and Mi Box 3S the same since signature verification passed when trying to flash the mentioned firmware, but the process failed when checking the date of the build.

To get into recovery you can use the adb command "adb reboot recovery" or you can hold both the back button and center button of the directional pad while booting.

 

[mattvirus]

Yep I tried same and had same result. I have some older fw packages I will try. I thought maybe their stock recovery might not check sig . Wishful thinking I know, oh well....

 

[flindaman]

Does your USB port work for normal flash drives? I can't get anything to work on it.

 

[robinkooli]

Can you upload the full latest official firmware or give link to it?
I can try to help.

 

[evilpotatoman]

I was able to get this rooted, but haven't been able to unlock the bootloader.

1. Download MiBOX3S_USA_once_r454.zip from 4PDA.ru unrar it and put it on a USB stick.
2. Turn on adb from the developer options, connect, and "adb reboot recovery"
3. Unplug the USB cable and plug in the USB stick. Choose "Install from EXT">"From UDISK", and flash the update.
4. Reboot it and plug the USB cable back in. Re-enable usb debugging (if your settings were cleared) then disable dm-verity by typing "adb root" then "adb disable-verity" and then "adb reboot"
5. Once it reboots, you are now free to modify the system partition as you see fit by typing "adb root" then "adb remount". you are effectively 'rooted' at this point.

I went further and manually installed SuperSU to enjoy some rooted app goodness, but to be honest, it was a pain.

One thing I noticed is that the most recent OTA wipes your changes, so you may want to disable updates until I can come up with a more elegant solution:

adb root
adb shell pm disable com.google.android.gms/.update.SystemUpdateService
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$ActiveReceiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$SecretCodeReceiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdatePanoActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$SecretCodeReceiver

** edit **
I have a bootloader unlock authorization for this device from xiaomi, but I can't seem to get it into either bootloader mode or EDL mode. Any help on this front would be appreciated.

 

[jameyc]

I went further and manually installed SuperSU to enjoy some rooted app goodness, but to be honest, it was a pain.

What method did you use to install SuperSU? Was it necessary to flash anything, or did you just copy the binary into the system partition? I'd like to toss tasker and the sixaxis controller apps on this box to expand its functionality a bit, but not having SuperSU is a showstopper.

 

[steppinthrax]

Can you guys tell me how this unit compares to the other "Andoird TV boxes". I just got this from walmart last week. It seems to lack an SD card, but has a USB port etc... I see it has bluetooth. But for $69.00 I see andorid boxes on ebay for 24 or so from china.

Thanks

 

[dustintinsley]

I was able to get this rooted, but haven't been able to unlock the bootloader.

1. Download MiBOX3S_USA_once_r454.zip from 4PDA.ru unrar it and put it on a USB stick.
2. Turn on adb from the developer options, connect, and "adb reboot recovery"
3. Unplug the USB cable and plug in the USB stick. Choose "Install from EXT">"From UDISK", and flash the update.
4. Reboot it and plug the USB cable back in. Re-enable usb debugging (if your settings were cleared) then disable dm-verity by typing "adb root" then "adb disable-verity" and then "adb reboot"
5. Once it reboots, you are now free to modify the system partition as you see fit by typing "adb root" then "adb remount". you are effectively 'rooted' at this point.

I went further and manually installed SuperSU to enjoy some rooted app goodness, but to be honest, it was a pain.

One thing I noticed is that the most recent OTA wipes your changes, so you may want to disable updates until I can come up with a more elegant solution:

adb root
adb shell pm disable com.google.android.gms/.update.SystemUpdateService
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$ActiveReceiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$SecretCodeReceiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdatePanoActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$SecretCodeReceiver

** edit **
I have a bootloader unlock authorization for this device from xiaomi, but I can't seem to get it into either bootloader mode or EDL mode. Any help on this front would be appreciated.

what do you lose with this firmware? does it still have playstore and so on? would be nice to root the stock firmware. wonder if this "dirty cow" exploit could be utilized in someway...

 

[Goonshark]

I've been working with this box for a week now and managed to replicate all of the steps evilpotatoman has explained EXCEPT for the manual SuperSU install and the update disable. Some more technical advice would be appreciated. I can attest to the issue that this device is similar to the mi box 3 AA rev but several more hoops to jump through to get a proper root. I don't want to keep the device if I can't root it. Hopefully a solution pops up before my refund period ends.

 

[dustintinsley]

I've been working with this box for a week now and managed to replicate all of the steps evilpotatoman has explained EXCEPT for the manual SuperSU install and the update disable. Some more technical advice would be appreciated. I can attest to the issue that this device is similar to the mi box 3 AA rev but several more hoops to jump through to get a proper root. I don't want to keep the device if I can't root it. Hopefully a solution pops up before my refund period ends.

is this new image you flat the same as the original image? as in, still have plays tore and everything? i am still waiting on a male to male cable so just gathering info...

 

[dustintinsley]

I've been working with this box for a week now and managed to replicate all of the steps evilpotatoman has explained EXCEPT for the manual SuperSU install and the update disable. Some more technical advice would be appreciated. I can attest to the issue that this device is similar to the mi box 3 AA rev but several more hoops to jump through to get a proper root. I don't want to keep the device if I can't root it. Hopefully a solution pops up before my refund period ends.

The disabling of update should be simple. just enter those commands at adb prompt...

 

[Goonshark]

The disabling of update should be simple. just enter those commands at adb prompt...

Your right, didnt manage to do it right the last time. The update.zip evilpotatoman posted is the same except for the file browser, live channel, and movie player apps.

Now im at the point where i need supersu. You cant sideload, thats for firmware. Do i need some script or location to copy or apk? Not sure how to manually install it.

 

[dustintinsley]

Your right, didnt manage to do it right the last time. The update.zip evilpotatoman posted is the same except for the file browser, live channel, and movie player apps.

Now im at the point where i need supersu. You cant sideload, thats for firmware. Do i need some script or location to copy or apk? Not sure how to manually install it.

so play store is on the firmware posted by evilpotatoman?

 

[Goonshark]

so play store is on the firmware posted by evilpotatoman?

yes

 

[dustintinsley]

yes

sweet! i was concerned it would be a chinese firmware image or something. attached is a file that should flash the new boot images needed for this to work but allow you to keep your updated system will remain untouched. you will use the steps as before:

1. Download mibox_3s_boot_upgrade.zip, unzip it and put the contents on a USB stick.
2. Turn on adb from the developer options, connect, and "adb reboot recovery"
3. Unplug the USB cable and plug in the USB stick. Choose "Install from EXT">"From UDISK", and flash the update.
4. Reboot it and plug the USB cable back in. Re-enable usb debugging (if your settings were cleared) then disable dm-verity by typing "adb root" then "adb disable-verity" and then "adb reboot"
5. Once it reboots, you are now free to modify the system partition as you see fit by typing "adb root" then "adb remount".  You are effectively 'rooted' at this point.

To disable system updates:

adb root
adb shell pm disable com.google.android.gms/.update.SystemUpdateService
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$ActiveReceiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$SecretCodeReceiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdatePanoActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$SecretCodeReceiver

This method will allow you to be running at the latest system update that is available...

Now, to work on installing SuperSU.... Like I said do not get my cable until tomorrow, so I can't test until then, but I think I have a way to easily install it.... Will update.

 

[mr0187]

sweet! i was concerned it would be a chinese firmware image or something. attached is a file that should flash the new boot images needed for this to work but allow you to keep your updated system will remain untouched. you will use the steps as before:

1. Download mibox_3s_boot_upgrade.zip, unzip it and put the contents on a USB stick.
2. Turn on adb from the developer options, connect, and "adb reboot recovery"
3. Unplug the USB cable and plug in the USB stick. Choose "Install from EXT">"From UDISK", and flash the update.
4. Reboot it and plug the USB cable back in. Re-enable usb debugging (if your settings were cleared) then disable dm-verity by typing "adb root" then "adb disable-verity" and then "adb reboot"
5. Once it reboots, you are now free to modify the system partition as you see fit by typing "adb root" then "adb remount".  You are effectively 'rooted' at this point.

To disable system updates:

adb root
adb shell pm disable com.google.android.gms/.update.SystemUpdateService
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$ActiveReceiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gms/.update.SystemUpdateService$SecretCodeReceiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdatePanoActivity
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$Receiver
adb shell pm disable com.google.android.gsf/.update.SystemUpdateService$SecretCodeReceiver

This method will allow you to be running at the latest system update that is available...

Now, to work on installing SuperSU.... Like I said do not get my cable until tomorrow, so I can't test until then, but I think I have a way to easily install it.... Will update.

unfortinatly the file is not flashable something about a signiture and footer. I been trying all kind of stuff too wish didn't have to do long setup after wipe

 

[dustintinsley]

unfortinatly the file is not flashable something about a signiture and footer. I been trying all kind of stuff too wish didn't have to do long setup after wipe

odd, it should work. once i get my cable i can actually test, i will have a smoother method soon...

 

[dustintinsley]

unfortinatly the file is not flashable something about a signiture and footer. I been trying all kind of stuff too wish didn't have to do long setup after wipe

Ok, I am pretty sure i found the error with the zip file i posted. attached is updated boot image flash that should work this time. please let me know.