Xiaomi Mi Box 3 (xiaomi-once)

Category:Devices with known UART pinout
There are 2 variants:
* Mi Box 3/mda-16-ab, running Android TV and sold everywhere else.
* Mi Box 3C/mda-16-aa, running MIUI TV and sold in China. Seems to only have 4GB of storage and 1GB of RAM.
Some people succeeded at flashing the mda-16-ab firmware to an mda-16-aa set-top box though.
Note that these instructions are only expected to work on the mda-16-ab variant.
== Note about the stock u-boot==
=== If running Android 8/7/6 ===
It can be intercepted when it is booting.
It will load either aml_autoscript (more info) or recovery.img (android recovery mode image), both at the root of a USB stick, the latter being booted when Android TV and the recovery mode aren't bootable.
=== If running Android 9 ===
You're out of luck! You need to downgrade to Android 8.
== Installation ==
Before doing everything here, please follow the instructions in #Downgrading from Android 9 to Android 8.
Only installing to a USB drive works currently.
Use pmbootstrap to build your own image, like so:
$ pmbootstrap init
$ pmbootstrap install --sdcard=/dev/sdX # change 'sdX' with the path of your USB drive
After you created the image, connect the UART to your Mi Box.
Next, intercept U-Boot when it's booting. You should get a shell.
Run these commands to modify the default boot behavior for making pmOS automatically boot when it powered on and a pm os usb stick is pluged in:
once# setenv bootandroid "${bootcmd}"
once# setenv bootcmd "usb start;ext4load usb 0:1 ${loadaddr} aml_autoscript;autoscr ${loadaddr};run bootandroid"
once# saveenv
Run those command to reboot after you have modified the default boot behavior
once# reset
You can still boot into android by unplugging the pmOS usb stick after you have modify the default boot behavior.
You can manually boot pmOS if you dont want to modify the default boot behavior.
Run these commands to boot pmOS:
once# usb start
once# ext4load usb 0:1 ${loadaddr} aml_autoscript
once# autoscr ${loadaddr}
=== Downgrading from Android 9 to Android 8 ===
There's a guide for downgrading from Android 9 to 8: https://forum.xda-developers.com/t/mi-box-3-mdz-16-ab-downgrade-android-9-pie-to-android-8-oreo.4194075/
If that guide doesn't work, try this:
# Plug a USB drive into your computer and format it as FAT32
# Download via BitTorrent or MEGA
# Extract update.zip and xiaomi_update from the zip file, as well as recovery.img from update.zip and put them at the root of your USB drive
# Power your Mi Box on and boot it into the recovery mode
# Plug your USB drive to it
# 'Apply update from EXT' > 'From Udisk' > update.zip (note: "Udisk" is a translation error in the recovery)
# Flash and reboot! Your Mi Box should reboot a few times. You should see a progress bar after that. (It only flashed U-Boot, and Android 9 isn't bootable from it, and thus it loads recovery.img from the USB drive, which runs xiaomi_update)
# After that, it's going to boot into Android 8, which will fail. It's then going to boot into recovery mode and you should see the following error message: "Cannot load Android system. Your data may be corrupt. If you continue to get this message, you may need to perform a factory data reset and erase all user data stored on this device."
# 'Factory data reset' > 'Yes'
# Then it should reboot automatically by itself
# Done!
== Recover back to the default booting behavior ==
Run these commands:
once# setenv bootcmd ${bootandroid}
once# setenv bootandroid 
once# saveenv
== Unlock the bootlocker ==
This device has a locked bootloader (It seem only mda-16-ab have this kind of bl) that can only signed boot image supposedly.
However exkc find out it can chainboot a unlocked bootloader from the locked bootloader via "multiboot" mode.There are some work on unlocking the android 6 bootloader which allow you to boot unsigned boot image directly from the stock bootloader.
== Recovery ==
The following instructions would show a wobble circle with a progress bar.
== Boot into recovery mode ==
# Unplug power from Mi Box 3
# Remove batteries from remote control
# Press and hold middle select button + back button on the remote
# While holding select+back, put batteries back in remote
# Reconnect power to the Mi Box 3
# Hold the remote close to the Mi Box 3 and wait for recovery screen
Source: https://l.opnxng.com/r/AndroidTV/comments/g3mw3s/xiaomi_mi_box_3_reboot_into_recovery_mode
== Maintainer ==
* exkc
== Users owning this device ==
== See also ==
* initial PR
* stock rom download
* UART 
* What different between Mi box 4(china variant)、4c(china variant)、3s(china variant)、3c(china variant)、3 enhanced(china variant) (Simplify Chinese)
* How to flash mda-19-ab's os on mda-19-aa? (Cantonese with Mandarin subtitles)
* unlock bootloader