Mi Box 1 Root achieved - Two methods

Discussion in 'Xiaomi Mi Box / Mi TV' started by MarkHUK, May 2, 2013.

  1. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    Hi everyone,

    Glad to say after a LOT of hours of work with 3 people, we have managed to ROOT the Mi Box successfully using two methods.

    Code:
    shell@android:/sdcard # whoami
    root
    shell@android:/system/app # ls -al
    -rw-r--r-- root    root        6128 2013-05-01 04:46 ApplicationsProvider.apk
    -rw-r--r-- root    root        24208 2013-05-01 04:46 ApplicationsProvider.odex
    -rw-r--r-- root    root        3822 2013-05-01 04:46 DefaultContainerService.apk
    -rw-r--r-- root    root        14512 2013-05-01 04:46 DefaultContainerService.odex
    -rw-r--r-- root    root        13326 2013-05-01 04:46 DownloadProvider.apk
    -rw-r--r-- root    root      175872 2013-05-01 04:46 DownloadProvider.odex
    -rw-r--r-- root    root        7841 2013-05-01 04:46 KeyChain.apk
    -rw-r--r-- root    root        27824 2013-05-01 04:46 KeyChain.odex
    -rw-r--r-- root    root        24797 2013-05-01 04:46 PackageInstaller.apk
    -rw-r--r-- root    root        30744 2013-05-01 04:46 PackageInstaller.odex
    -rw-r--r-- root    root        2710 2013-05-01 04:46 Provision.apk
    -rw-r--r-- root    root        1936 2013-05-01 04:46 Provision.odex
    -rw-r--r-- root    root        12493 2013-05-01 04:46 SettingsProvider.apk
    -rw-r--r-- root    root        60552 2013-05-01 04:46 SettingsProvider.odex
    -rw-r--r-- root    root      574184 2008-08-01 20:00 Superuser.apk
    -rw-r--r-- root    root        3498 2013-05-01 04:46 UserDictionaryProvider.apk
    -rw-r--r-- root    root        14912 2013-05-01 04:46 UserDictionaryProvider.odex
    shell@android:/system/app #
     
    shell@android:/sdcard # cat /proc/cpuinfo
    Processor: ARMv7 Processor rev 4 (v7l)
    BogoMIPS: 1594.70
    Features: swp half thumb fastmult vfp edsp neon vfpv3
    CPU implementer: 0x41
    CPU architecture: 7
    CPU variant: 0x2
    CPU part: 0xc09
    CPU revision: 4
     
    Hardware: AUGUSTRUSH
    Revision: 0001
    Serial: 000000000000000c
    
    Method 1 (Hardware) UART Serial hack (root in adb from console)

    DOWNLOAD HARDWARE ROOT GUIDE HERE (DO THIS AT YOUR OWN RISK! Miuiandroid.com IS NOT RESPONSIBLE FOR DAMAGES!!)

    Method 2 (May only work if you still have 1.1.x / unsure of 1.2 success but root holds in 1.2!)

    DOWNLOAD > > > Root pack by MarkHUK, m1cha and IanK

    Download this zip and extract the contents to your PC / Mac, make sure your USB stick is clean, when clean copy all the files over to the / (root) or the USB stick.

    Step 1. Reboot to recovery (Switch off Mi Box, press both buttons below the power button and keep them pressed. Whilst keeping these buttons pressed re power the Mi Box up until you see the screen with the Mitu Rabbit recovery logo and Android Recovery version (3e) or similar.

    Step 2. Try to flash blackrice_update_otg.zip, if this fails try blackrice_update_otg-signed.zip

    (if blackrice_update_otg-signed.zip comes up with an assert failed error proceed to flash crystalroot.zip)

    If method 2 does not work you will need to look to a hardware expert to root your Mi Box. More on Method 1 soon.

    Thanks from,

    MarkHUK, m1cha and IanK
     
    type-R, Wajk and nochtavio like this.
  2. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    PS. We cannot accept any liability for loss, damage or other issues as a result of these methods. All work is provided as is and we are not 100% sure of method 2 so please do not complain too much if it does not work. There is a hardware method and we've only just this evening done the none-hardware root and still think my old 1.1.11 system had a part to play.

    E.g. Xiaomi and Duokan updated 1.2 to release-keys from 1.x test-keys. If this is the case we are stuck for the moment with a hardware hack. If you have 1.1.11 or 1.1.x you are probably in luck!

    English UI will be done soon too! :)
     
  3. amiperetz

    amiperetzMembers

    Jun 16, 2011
    31
    1
    18
    good news mark :)
    ill try Method 2 in an hour and tell if its work... hope to not get brick XD

    Edit: got aborted for all the three but when going to system 1 (1.1.8) i have the option between the lux luncher and the miuitv (now white triangle).

    so its look like it work, not even after the aborted msg, not?
     
  4. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    reboot into system 1 recovery and re apply those zips
     
  5. IanK

    IanKMembers

    Jan 26, 2013
    6
    3
    13
    Male
    Good news indeed. To absolutely be 100% sure, your rooted, if you have adb installed on your PC, then run up adb into the MiBox. And see if you can change your user from shell to root. The following digest shows anything after the $ as the command you type and the MiBox return value afterwards.

    shell@android:/ $ whoami
    shell
    shell@android:/ $ su
    shell@android:/ # whoami
    root
     
    MarkHUK likes this.
  6. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    has anyone managed to root with the above? let us know please.
     
  7. amiperetz

    amiperetzMembers

    Jun 16, 2011
    31
    1
    18
    still the same -> after wipe
     
  8. Melvyn Ong

    Melvyn OngMembers

    Nov 30, 2012
    50
    9
    28
    Male
    Hi, wanna know if I wish to unroot.. how do I go about doing it?
     
  9. amiperetz

    amiperetzMembers

    Jun 16, 2011
    31
    1
    18
    ithink if you just update the box you be unroot.
     
  10. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    YES - just OTA
     
  11. Melvyn Ong

    Melvyn OngMembers

    Nov 30, 2012
    50
    9
    28
    Male
    Actually, I'm not sure if I'm even rooted.. I have version 1.1.8.. I've tried flashing the 3 zips, first 2 failed.. but CrystalRoot worked.. I repeated the process to the other system partition.. But when I rebooted back to system 1.. I wasn't given the option to choose a different launcher..
     
  12. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    if cystalroot zip worked adb shell to your mibox and type: su

    if you get # you are rooted.
     
  13. Melvyn Ong

    Melvyn OngMembers

    Nov 30, 2012
    50
    9
    28
    Male
    Actually.. I don't even know how to adb shell into the box lol.. I've used SnapPea to install some apps and I can see Super SU is already installed, and I'm able to grant root access to SnapPea.. that aside, I've tried installing Google Play Store but it doesn't work. Anyone has the latest apk for Netflix 2.2.0? I'm trying to install it as well..
     
  14. jpenzo

    jpenzoMembers

    Nov 13, 2012
    386
    87
    52
    Male
    FRANCE - PARIS
    Hi MarkHUK

    it as Very good news for the Xiaomi Box
    so i can order mine finally ,

    i would like to enter in this game also
    i know this is the beginning but we can get the interface in english and rooted that's what we want

    Very good job !!
     
  15. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    if you get one - there's not a 100% guarantee for sware root. It works for me and some others, its a hit and miss process it seems. UART hardware method is guaranteed but you need electronics experience.
     
  16. jpenzo

    jpenzoMembers

    Nov 13, 2012
    386
    87
    52
    Male
    FRANCE - PARIS
    i am fine to do some electronic operations
    i am an IT engineer and have some Electronic Engineer friends too in case
    but we need a tuttorial from which step we need to start
     
  17. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    its on the forum :p

    http://miuiandroid.com/Rooting-MiBox-Using-UART.pdf
     
  18. so if i purchase a mibox today what are the chances of it coming with 1.1.x probably unknown...i no nothing of electrical work/soldering so option 2 is my only option if i'm going to root...not that it's that much money but i would hate to have something i cannot use since i don't speak or read chinese.
     
  19. powersteer

    powersteerMembers

    May 8, 2013
    8
    0
    11
    Thanks for your kind sharing :)

    Just ordered my box, fingers crossed it arrives fast!
     
  20. gamergod

    gamergodMembers

    Apr 22, 2013
    70
    1
    18
    Male
    sorry for delay, was playing around with my freshly acquired mi2s, needless to say i was completely blown out of the water :eek:

    anyway my Box have Version 1.1.8
    i tried installation methods



    blackrice_update_otg.zip => failed to verify whole-file signature
    signature verification failed
    Installation aborted



    blackrice_update.otg-signed.zip => assert failed: set_perm(0, 0, 6755, "/system/bin/su")
    Error in /tmp/sideload/package.zip
    (Status 7)
    Installation aborted.


    crystalroot.zip =>
    Installaing Crystal root by Soulflier
    Finished, reboot now.
    Install complete.

    mi_root_signed.zip =>
    [+] Running FS Hole Exploit for AML Processor
    [+] Linking RootShell to black rice exploit..
    [+] Running black Ro0t script to replace broken services...
    [+] Install High Permissio APKs...
    Welcome to tuzi.tv

    [!!!] Black Ro0t v0.2. MiBox Ro0ted. Enjoy.
    Install complete. :) :cool:

    So it seems mi_root_signed.zip worked.
    Check here for instruction video.
    http://v.youku.com/v_show/id_XNTM4MjQ4MzEy.html


    best regards
     
  21. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    @Gamergod,

    Crystalroot is all you needed :) Welcome to the root world! :)

    Anyone else success?
     
  22. MarkHUK

    MarkHUKCommunity Founder
    Staff Member

    Nov 6, 2010
    4,265
    1,940
    322
    IT Infrastructure Security Consultant
    Shenzhen
    PS. Are people using the MI2 OTG cable or the OTG for MiBOX?
     
  23. gamergod

    gamergodMembers

    Apr 22, 2013
    70
    1
    18
    Male
    I was playing around with the box and few minutes ago covers wouldn't load, so i checked system settings and there was a message "system is being upgraded", in panick mode I pulled the power, is there any way to prevent the box from updating?
     
  24. IanK

    IanKMembers

    Jan 26, 2013
    6
    3
    13
    Male
    Depends on what you want to do here. My understanding of the system (thus far) is that the OTA Packages are mostly patches. So, the updater script (written in Edify) checks some elements are what they expect. If the edify script detects something wrong, then the update program will abort.

    An example is shown below. Note the file being checked is /system/build.prop

    assert(getprop("ro.product.device") == "augustrush" || getprop("ro.build.product") == "augustrush");

    The code will assert if the check is false.

    You can use this to your advantage if you want to stop OTA by changing the /system/build.prop file values - such as ro.product.device.

    The advantage also is that you can undo this so you can start OTA again.

    This will only work if you have root and can modify the file.

    Hope this helps
     
    MarkHUK likes this.
  25. Misiak

    MisiakMembers

    Aug 6, 2012
    163
    12
    28
    Male
    Hi, my box arrived today from *******. It came with version 1.1.8 so hopefully I'll be able to root it. I will try in the evening. Ah, now I've realized I cannot do it without OTG cable... Shittt...
     

Share Our Site