Mi Box Modding

Official review coming soon! (Sometime August)

I bought the Mi Box because I needed an Android TV to tinker with, and because I’m addicted to Netflix. (Seriously, it’s my first time watching Breaking Bad, so naturally I’m completely hooked to the series.)

Unfortunately, the version I bought had Korean crap smeared all over it. Some weird app named “Telebee” prevented me from using the Leanback Launcher. Now there is only one remedy for things that block my way - get rid of it completely. Obliterate it from the face of the Earth.

And that’s what I did. Let’s go through the process.

(no I mean the app not the box dammit)

First steps

You will need:

  • A Mi Box with the following model number: MDZ-16-AB. Anything else won’t work.
  • A USB, 1GB or larger. I recommend at least 8GB since you will be working with 500MB images and it’s handy to just put all of them on the USB at once.
  • Your computer for adb-ing. Obviously, adb (platform-tools) should be installed on your computer. Google if you don’t know how to do this.
  • THIS ENTIRE PROCESS IS ON YOU. I AM NOT LIABLE FOR ANY DAMAGES YOU MAY CAUSE AND NOT LIABLE FOR ANY ACTIONS YOU MAY TAKE. Do not come whinging to me because you bricked your box.

First, go to my Downloads page. From there, grab these files:

  • minimal-flash.tar.gz
  • minimal-flash.tar.gz.sha512sum

Checksum these files and make sure they match. From there, unpack minimal-flash.tar.gz. You should end up with these files:

  • rom3.img
  • update-once.zip

Now, you need to prep the USB. Format it to FAT32, and then put these files at the root of the USB drive:

  • update-once.zip

Done? Great. Now back to the box.

(Korean variant only) Globalizing the box

You need additional files. Grab these from the Download page linked above:

  • Original Firmware/once-7.0-1028.zip
  • Original Firmware/once-7.0-1028.zip.sha512sum

Make sure checksums match, and place the once-7.0-1028.zip in the USB.

Done? Great. Now we need to flash it. Plug the USB in the back of the box, then hold the remote steady.

This part is going to be tricky. While holding the back and center button (that is the back arrow button, and the round, concave button in the middle of the circular four buttons), power on the box. Keep holding these buttons until the recovery appears.

If you boot into the Android TV, then you just didn’t hold it fast enough. Try it again. If it just doesn’t work, take out the batteries from the remote, put them back in, press the buttons and hold them and power the box on.

Once you’re in recovery:

  • Go into Apply update from EXT
  • Go into Update from udisk
  • Select once-7.0-1028.zip

It should flash. Once it’s done, choose Wipe data/factory reset and then Reboot system now.

Great, your Korean Mi Box should now be globalized. Follow the rest of the instructions below!

Going back to Marshmallow

Since Nougat is really, really buggy, I prefer to go back to Marshmallow first. However, there are some problems with this approach.

The Mi Box, for some stupid reason, stores the DRM and Netflix ESN keys in the bootloader/kernel partition rather than a dedicated partition (such as the /efs partition on Samsung devices). Therefore, if you wipe the bootloader/kernel partition and install another bootloader/kernel, the keys are lost and you are forever stuck without DRM. No Netflix. No Google Widevine. You have, essentially, a $50-70 paperweight.

Fortunately, there’s a solution. You just need to back up your bootloader, flash a modified bootloader, install the Marshmallow build, and then restore your original bootloader. The steps are pretty easy:

  • Boot your Mi Box up completely and go through the setup process.
  • Connect it to the Wi-Fi network.
  • Connect your laptop to the same Wi-Fi network (THIS WILL NOT WORK UNLESS YOU DO SO)
  • On the Mi Box, enable “Developer Mode”, then enable “USB debugging”.
  • Find out the Mi Box’s IP address, by using the information in the Wi-Fi section or by checking your router page.
  • On your computer, run adb connect <IP address>. For example, if the IP address is 192.168.0.108, then you would run adb connect 192.168.0.108
  • The computer should connect to the box. Run the command adb root, then run the adb connect <IP address> command again if needed.

Since the connection part is done, now we need to get to the actual back up process.

  • Type the following commands:
  • adb shell
  • dd if=/dev/block/mmcblk0 of=/sdcard/backup-256mb.img bs=1024 count=262144
  • TYPE THE ABOVE COMMAND CORRECTLY. FAILURE TO DO SO CAN BRICK YOUR BOX.
  • exit
  • adb pull /sdcard/backup-256mb.img
  • You should find the file backup-256mb.img in your current folder. (On Windows, your User folder. On Linux, type pwd)
  • MAKE DAMN WELL SURE THIS FILE IS EXACTLY 256MB (268,435,456 bytes). Yes, dammit, check if the byte count match up as well. This is your insurance plan should anything go disastrously wrong. Not saying that this will be a 100% insurance plan, but it’s pretty close.
  • Now, type adb push (with the space at the end of push), then drag the rom3.img into the Terminal window. Then append ` /sdcard/ at the end. (With a space between rom3.img and /sdcard/`) Your command should look like this:
  • adb push rom3.img /sdcard/
  • OR adb push /home/users/ideaman924/......./rom3.img /sdcard/
  • OR… you get the idea. Essentially, it depends on your computer and operating system.
  • Wait for it to push, then when it’s done, we need to flash the modified bootloader.
  • adb shell
  • dd if=/sdcard/rom3.img of=/dev/block/mmcblk0
  • Yes, I am fully aware I did not specify bs or count. They are unnecessary. BE PATIENT WITH THIS COMMAND.
  • exit
  • Before you execute the next command, make sure your USB is plugged in.
  • adb reboot recovery

Now you should be thrown into recovery. Don’t worry if it’s in Vietnamese, we’ll fix that in a bit. Your USB should already be plugged in. Go into Apply update from EXT > Update from udisk > update-once.zip

Once it’s done, don’t forget to Wipe data/factory reset. Then Reboot into system.

Once in system, you need to act FAST. Quickly set up the box, then enable “Developer Options” and “USB debugging”. On your computer, run:

  • adb connect <IP address>
  • adb root
  • (optional) adb connect <IP address>
  • adb push <Drag backup-256mb.img> /sdcard/
  • You should drag the backup file we made earlier when it comes to type the thing between the brackets. It should look like:
  • adb push backup-256mb.img /sdcard/
  • Or.. yeah. Something like that. Again, depends on where it is and what OS you are using. Then type this (WARNING, DO NOT MISTYPE THIS COMMAND, IT IS EXTREMELY DANGEROUS.)
  • dd if=/sdcard/backup-256mb.img of=/dev/block/mmcblk0
  • exit
  • adb reboot recovery
  • Run Wipe data/factory reset one more time, then Reboot into system.
  • Congratulations! You should be back on Marshmallow with the DRM keys intact.

What now?

Oreo update

The update came out two days ago (coincidental?) just as I was modding my box. Thanks, Xiaomi.

Conclusion

This box will be fun to use, and I like that it has the Oreo update. Hopefully I don’t wreck my academics watching Netflix.

Official review coming soon!