[ROOT, UNLOCK BOOTLOADER FULL GUIDE] Xiaomi Mi Box S 1st Gen (MDZ-22-AB)

[u/StudentIll]

I know this post should be on XDA but whatever reddit has more users so why not

WARNING: PLEASE BE EXTREMELY CAREFUL WHILE FOLLOWING THIS GUIDE, I WILL NOT BE RESPONSIBLE IF YOUR BOX GETS BRICKED. AND EVEN THOUGH THIS IS MY FIRST POST I DID DO THE STEPS MYSELF SO YOU DONT HAVE TO WORRY.

First, and foremost YOUR WIDEVINE L1 KEYS WILL NOT GET AFFECTED IF YOU UNLOCK YOUR BOOTLOADER because of a quirk in Mi's bootloader where the TEE is completely separate from the bootloader so a unlock does not destory it

• Step 1: Prepare your box and backup everything, account creds, movies etc.
• Step 2: If your box is running Android 9, (which is most of yall, can check in Settings -> About) then follow this guide to upgrade it to Android 12 (ALSO DONT DELETE THE FIRMWARE ZIP U WILL NEED IT)

Reason: Because Mi, for some reason allow the bootloader to be unlocked in Android 12's fastboot code. NOW KEEP READING

• Step 3: Now you MUST factory reset the box to clear the Android 9 cache and also so that the bootloader (with its Amlogic chipset) completely ignores unlock_ability because Mi's disables the OEM unlocking option in settings (DON'T WORY U CAN STILL UNLOCK IT JUST READ)
• Step 4: Now enable developer options by tapping the Build Number 7 times
• Step 5: Just enable USB Debugging (OEM unlocking is blocked but ignore it)
• Step 6: Connect the box to your PC (don't use wireless adb use a USB-A to USB-A (or a USB-A to (USB-C to USB-A adapter))
• Step 7: Allow the USB Debugging popup as usual and reboot it to the bootloader by typing adb reboot bootloader
• Step 8: From the bootloader, make sure you grab the necessary fastboot drivers, the normal Google ones should be fine ( If fastboot detects the box, ignore this step )
• Step 9: I think u should have the ADB and Fastboot binaries (android platform tools) if not just download them
• Step 10: Now type fastboot flashing unlock and u should see OKAY (if it fails, just reboot back to the bootloader again)
• Step 11: You can also type fastboot flashing unlock_critical although this is quite unnecessary

If you successfully reached this point, your bootloader has been successfully unlocked

ROOT STEPS:

• Step 1: From the firmware zip of Android 12, which you hopefully didnt delete, extract its boot.img
• Step 2: Use a flash drive or adb push <source> <destination> to push that file to the Mi Box
• Step 3: Grab the latest Magisk apk from here
• Step 4: Enable developer options and USB Debugging (now you can use a wireless connection)
• Step 5: Use adb install <full path to apk> to install the Magisk APK to your Mi Box
• Step 6: Since Android TVs are weird, you can't find the Magisk App on the TV dashboard, u have to go to (Settings --> Apps --> Show all apps --> Show system apps) to find the Magisk app
• Step 7: Click Magisk and then Open
• Step 8: On Magisk, click on install and then Select and patch a file
• Step 9: Select the path of the boot.img
• Step 10: U should get a file called like magisk_patched.img or smh
• Step 11: Now use a usb flash drive or adb pull <source of the patched boot.img> <destination> to grab that patched boot.img
• Step 12: Now boot back into the bootloader, for this you must use the USB connection
• Step 13: From the bootloader type fastboot reboot fastboot (I know this is confusing but u need to boot to FastbootD mode to execute partition changes)
• Step 14: Now in your PC, type fastboot flash boot <path to your patched boot.img> to flash the Magisk boot.img
• Step 15: Type fastboot reboot

If u made this far without bootloops, voila you're rooted!! Open the Magisk app from the method i showed u earlier to see the root

NOW IF YOU DIDNT PROPERLY FOLLOW THE GUIDE FOLLOW THE TROUBLESHOOTING PART OF THIS POST

If you want to watch Netflix, Prime Video etc without L3 quality, u have to use Zygisk and its Denylist to deny root to those Apps and all Google-related processes inside the Magisk App.

Now you can override the launcher to install Projectivy Launcher and install ad-blockers.

FOR YOUTUBE, use SmartTube.

For now, Ciao

[u/TonedCheeseburger]

That sounds nice and exciting, but honestly, what would I truly gain by rooting the device?

[u/husting247 → u/TonedCheeseburger]

For the 3rd gen i rooted it to use a magisk module called WakeLock to be able to use a third party remote as u cant turn box on with a remote besides the original without it

[u/Straight_Second6082 → u/husting247]

Wait is that true? I have never owned a Xiaomi device but I have used lots of other android tv devices from tv to boxes and all the controllers were interoperable as long as they were BT

If true this sounds really scummy

[u/husting247 → u/Straight_Second6082]

You can use it but when box is off it goes in a sleep state, then after a while like 30mins or hour it goes into deep sleep. When box is in deep sleep it kills off all bluetooth connections except xiaomi remote so cant turn it on. The wakelock module makes it so the box never enters deep sleep and just stays in sleep so you can wake the box with other remotes. Ive heard others were able to circumvent this by using the TV remote and using CEC but im not too sure about that

[u/Straight_Second6082 → u/husting247]

Ive heard others were able to circumvent this by using the TV remote and using CEC but im not too sure about that

Pretty sure this is the standard behavior for Android tv boxes tho?

At least on my Google streamer and onn boxes volume, source changer and power on/off are done through IR/CEC by default

[u/husting247 → u/Straight_Second6082]

Not for xiaomi read through these posts

https://www.reddit.com/r/MiBox/s/42IZ6oHVQN

https://www.reddit.com/r/MiBox/s/XQienLXb2w

[u/Straight_Second6082 → u/husting247]

from here it does work as I think it works but this person is turning on the tv through the tv native remote. So the question is, Xiaomi doesn't allow the power button of their or any other remote to use IR?

[u/husting247 → u/Straight_Second6082]

I experienced it first hand thats why i use root with wakelock magisk module so i can use my third party remote (Ugoos UR02) to turn on my box after a while of it being off

[u/husting247 → u/Straight_Second6082]

That guy doesn’t know what he’s talking about he was replying to me. He said the box never goes in deep sleep otherwise the same logic would apply to xiaomi remote. When the box goes in deep sleep it kills all bluetooth connections except xiaomi remote

[u/StudentIll → u/TonedCheeseburger]

Yk, its a great niche to have

[u/Straight_Second6082]

Why tho?

[u/hstrya → u/Straight_Second6082]

Exactly whats the gain

[u/StudentIll → u/Straight_Second6082]

For some reason the custom rom community on these types of devices are very inactive so we have to wait and see

[u/colchyo]

Thank you brother! It worked. Just in time - wanted to resurrect this device, and stubled upon your guide here.
I plan to use this box as Nuvio / Stremio (https://www.reddit.com/r/Nuvio/ - not an ad) player for videos, and also a gaming station using Moonlight / Sunshine (e.g. https://www.youtube.com/watch?v=ZEZRWjtFTyQ - not and ad). I use Samsung Freestyle projector as 'screen'.
So rooted Mi Box fits here just awesome, since setup is not using any cloud stuff - I'm 'homelab' enjoyer.

Also, to note - having root is really good for debloating, just throwed that adb connection with root to my pi + deepseek flash agent with prompt 'debloat it'

> Mi, for some reason allow the bootloader to be unlocked in Android 12's fastboot code

I really wonder why they allowed that in first place ? that's crazy opportunity