[Android Software Development] servo386:
Xiaomi Mi Laser Root Procedure

This is a long one. Also it was originally written for an audience who may have not been as familiar with Android/Linux commands so it has lots of explanation that might feel out of place on XDA.

So first and foremost ALL CREDIT BELONGS TO [MENTION=795239]loly[/MENTION] ON THE 4PDA.RU FORUM WHO ACTUALLY DISCOVERED THIS PROCESS

https://4pda.ru/forum/index.php?showtopic=810785&st=3260#entry75802829

I definitely am just a copy cat who guessed that his process would also work on this device since their both Xiaomi TV devices with Amlogic T96* boards.

So if you read his post (which you definitely should in addition to this post in order to get the full picture of how this is done), you'll see that this is quite complicated and a kind of high level hack. I hope I'll be able to explain it enough and walk through it enough for it be fairly accessible for less technically inclined people who want to root their Xiaomi projectors.

What is required:

1. HDMI cable you can chop up or an HDMI breakout cable like this one: https://www.amazon.com/Adapter-signals-Terminal-Breakout-Connector/dp/B01CU9SHOO/

2. UART to USB adapter cable/board like this one: https://www.amazon.com/Adapter-Serial-Converter-Development-Projects/dp/B075N82CDL though there are cheaper options available

3. Cables/wires to connect both things. The USB UART package above comes with some, though you'll have to strip the ends to screw them into the terminals of the HDMI breakout board.

4. A spare USB drive

5. A computer to use the USB to UART adapter and a terminal program, i am using Putty.

So the basic idea behind this is that one of the HDMI ports (HDMI 1 in this case, the one closest to the edge) also serves as a diagnostic/UART port via 3 of the 19 pins of the HDMI. When this HDMI port is properly wired to the UART adapter, and you have a terminal open observing said port, upon boot the machine reads out all its startup stuff and when booting into recovery, gives you a completely liberated UNIX terminal that accepts input from the UART terminal, with full root privileges and busybox! As [MENTION=795239]loly[/MENTION] says in his post, here we thank the people at Xiaomi for not bothering to secure this section and giving us full diagnostic root access with busybox. This is almost surely the way the developers of this machine would interact with this machine and developed for it. So let me try to explain how this works and how we get to TWRP and root.

Steps:

1. We need to properly connect the correct pins on the HDMI cable to the correct pins on the UART.

Here I am going to re-post some of [MENTION=795239]loly[/MENTION]'s images from the original thread, so all credit goes to him.

View attachment 4617376

Here we see the pins we need. Pin 14 is our VCC, which in this 5v (the UART adapter im using has a switch for 3.3v or 5v, this switch needs to be set to 5v!) Pin 15 is the receive pin and Pin 16 is the transmit pin

The fourth lead we need is the GND (ground), which in the case of an HDMI cable is usually an un-shielded wire that connects to the the case of the connector itself.

I'm going to stop here for a sec and say this is why it's alot easier to use the HDMI breakout board over trying strip an HDMI cable and finding which wire corresponds to which pin (you need a multi-meter to do that)

its a small investment but it makes everything ALOT easier. On the HDMI breakout board, the ground terminal is pin 20.

the corresponding pins on the UART are pretty straightforward. VCC goes to VCC on the UART, pretty straightforward, on the other hand the RX pin of the HDMI (pin 15) goes on the TX OF THE UART makes sense right? the receiever of the HDMI should be listening to the transmitter of the UART and vice versa, so the TX pin of the HDMI goes on the RX pin of the UART. The GND pin (pin 20 on breakout board) goes to the GND on the UART.

View attachment 4617377

Here's my setup. Sorry for the not very great picture. The terminal blocks on the HDMI breakout board work basically like you were connecting speakers to an amp, you unscrew the terminal till you see a little metal hole and you stick the stripped tip of the cable into the hole and screw the terminal back up till its snuggly holding onto the cable. You can use a multi-meter if you have one to make sure the wire is making contact with the terminal and even test the exact pin with the cable to make sure the connection goes all the way. If you're cable is making contact with the metal of the terminal, it is almost certainly correctly making contact with the actual HDMI pin, barring maybe a badly manufactured breakout board. I used spare MALE end pin connector cables to strip the ends and stick in the terminals, and connected them to the FEMALE connectors that came with the UART adapter. You don't necessarily have to do it this way, you can directly strip one of the female ends of the cable and connect the other female end to the pins on the UART, but you'll have a pretty short cable from HDMI to USB and you'll probably need a USB extension to comfortably use it with a computer.

So now you have you're HDMI diagnostic cable!

2. Setup your computer for UART and Putty.

Connect your UART to USB adapter to your computer. In Windows 10, it should automatically install drivers, but if it doesn't, your device should come with a link or something to download the drivers. I'm not going to get into the specific of how to install drivers on Windows computers but needless to say, you need to get the computer to recognize the device and properly utilize it via the drivers. Once you have it properly installed on the machine, it should show up in your device manager under Ports (COM & LPT) or something similar.

View attachment 4617379

this is important because we need to 1. determine what COM port you're device is on and 2. change the baud setting.

So in the photo you see that it tells you what COM port is, which we need for later.

Now you need to go into the settings of the device and go into Port Settings tab

View attachment 4617381

WE NEED TO SET THE BITS PER SECOND TO 115200!

Very important!

Setting up putty:

View attachment 4617383

Basically open up putty and put the button on Serial, set the speed to 115200 and in the SERIAL LINE put the correct COM port number (COM1, COM2, COM3, ect)

Pressing enter on this should open a big blank black terminal with no activity. Thats good because its working. If it wasn't, you'd get an error about not reaching COM port or something.

3. Testing out our diagnostic cable with UART and Putty

Unplug your projector. Plug your HDMI into HDMI port 1 and connect your USB to computer. Open up a Putty terminal session as outlined above. If you get a big black screen with no errors upon launching the terminal, youre in a good spot.

Plug in the Projector. If you've done everything right you should get a big long readout of text scrolling by as it boots. If you get this, congratulations, you've accessed the diagnostic correctly!

View attachment 4617385

The final step for actually accessing the usable terminal is doing the same but while booting into recovery.

4. Booting into recovery

Turn off your projector. Unplug it. Take your remote and hold down THE OK BUTTON and the BACK BUTTON at the same time. While still holding this, plug in the projector. It should start booting up. You're terminal Putty should be going crazy with text readout like last time. After a few seconds, let go of the buttons. Your projector should eventually end up on the Recovery menu, which is just some big buttons in english and chinese with a black background.

View attachment 4617401

image courtesy of jaberwocky on AVS

After the readout in the terminal has stopped, press enter. It should skip to a new line with

~#

Tada, root! You're officially in a fully privileged root terminal in the underlying unix system of the projector.

This is the hard part of all this. If you've successfully reached this part, you've won the battle. Everything from here on out is just a couple of commands and some files being downloaded and transferred.

Launching TWRP, making a Nand dump, flashing Magisk, getting Root

So if you indeed have reached the point where, from recovery, you can enter commands into the terminal session, now the question what to with it. The answer is basically anything you want, but let's launch TWRP and go from there.

So here is where you need to download this zip file, also courtesy of [MENTION=795239]loly[/MENTION] from the original russian thread. He went to the trouble of (I'm assuming) compiling his own TWRP for Xiaomi Mi TV 4A which, which as I've mentioned before it's chip (Amlogic T962) is the in the same family as the chip in our projector (Amlogic T968) so it works. That said I would say right now this is not a full TWRP specially made for our projectors, so we aren't going to flash it. We are going to launch it from the terminal (as per [MENTION=795239]loly[/MENTION]'s instructions) and use it, but not flash it to our recovery partition. This is for the best right now because a. it's not for our device and b. stock recovery allows us to install OTA updates if they come in the future

View attachment 4617409

my attached version has only the twrp folders, no recovery image, no magisk included.

https://yadi.sk/d/uTUrwdAl3ZyUcN <---- original zip

Download that zip file and unzip its contents right into your USB drive, so that the folder `twrp` (lowercase) is in the root of your drive . This will make it easier to type the commands exactly as they appear later. Ignore the recovery.img, we're not flashing this onto this device.

The magisk included in the TWRP.zip is old by this point. I flashed Magisk 17.1 flashable zip, the latest stable as of this writing. Get it here https://github.com/topjohnwu/Magisk/releases/download/v17.1/Magisk-v17.1.zip and put it on the flash drive.

A quick primer, this terminal instance has Busybox installed. Busybox is a "swiss army knife" of unix command like binaries because it packages all the standard linux commands into one single binary, so instead of calling

ls

to see the contents of the directory you instead would type

busybox ls

and it would work.

One last thing before I continue: while doing terminal stuff, I quickly learned that occasionally the terminal would throw up all kinds of gibberish which, as far as I can tell, had no rhyme or reason to it and more important had no discernible effect on what i was doing. Its a weird bug that maybe only ill experience because of my setup, I don't know. It would take two forms, one where it would throw up a bunch of lines of technical sounding text which included references to errors and such, but would ever actually affect anything. the other is when it would randomly spit out something like "hotplug_9" and again, id just press enter to get to the new line and nothing would have been affected. Don't be alarmed.

1. Insert USB drive into projector

Take your USB and plug it in. On your terminal, you should a small flurry of activity and references to a new device located at

/dev/block/sda1

or

/dev/block/sda2

take note of this, because this is the physical address of your USB drive thats going to have to be mounted. sda1 is the typical one, in my experience.

2. Mount USB and copy over files

This is just a series of commands, type them in precisely as I have them here, assuming you've maintained the same file structure on your USB stick as I did, unzipped the TWRP.zip straight onto the root of the USB.

busybox mount /dev/block/sda1 /sdcard

This mounts your USB device to the folder `/sdcard' if you're usb is at a different device location, change it appropriately.

busybox ls /sdcard

Just do a quick readout of the contents of `/sdcard` to make sure it properly mounted. you should see the contents of your USB drive listed here

busybox cp -r /sdcard/twrp/twres /

Copy the folder `twres` from the USB to the root of your projector

busybox cp -r /sdcard/twrp/license /

Copy the folder `license` to the root of your projector

busybox cp -rf /sdcard/twrp/etc/* /etc

Copy the contents of the folder `etc` to the etc directory on your projector

busybox cp -rf /sdcard/twrp/sbin/* /sbin

Copy the contents of the folder `sbin` to the sbin directory on your projector

busybox chmod -R 0750 /sbin

Change the permissions of the sbin folder to its all executable

So thats all the copying, now the moment of truth

3. Launch TWRP

YOU NEED A MOUSE PLUGGED INTO THE PROJECTOR TO NAVIGATE TWRP!

/sbin/run.sh

after hitting enter on this command, TWRP should boot up on your screen (and a bit of readout in your terminal

IF TWRP DOESN'T LAUNCH, YOU'VE DONE SOMETHING WRONG. GO BACK AND CHECK EVERYTHING.

I hope if you're doing this you're somewhat familiar with TWRP, but I will try to walk through the 2 most important things to do

4. Rom backup

One of the big buttons is BACKUP, go there and you'll see a series of check boxes for each of your partitions (boot, bootloader, recovery, system, ect). Select the ones you want (I selected all but I know for a fact this is unnecessary but I did't want to overlook anything and I didn't want to guess which I could ignore). It should ask you where to save the backup, select either the USB drive or internal memory and pick a folder. Slide over the thing to begin backup. It'll take a bit but eventually it should finish. Tada, you have a backup of your entire device.

5. Flash Magisk (ie get root)

This is the big kahuna, the one that unlocks everything OS-wide. Before trying to flash Magisk, we need to mount the system partition. This was big headache for me cause I didn't know why all the commands in the install scripts for failing and it was because /system/bin contains all the commands/binaries that Magisk installer script uses to do its stuff, so thats why we need to mount it first before trying anything. Go to the big MOUNT button and you should see checks next to USB and INTERNAL MEMORY or something to that effect, i can't remember off the top of my head. Almost certainly SYSTEM does not have a check next to it, meaning its not mounted. Click the check mark next to SYSTEM and that should be it, it is now mounted.

There is a quick way to check this, which is to go to ADVANCED>TERMINAL and in the terminal type

mount

if you get any sort of read out of device partitions, you're good, that means the mount command is working meaning the /system/bin is being made available to TWRP to execute commands.

With that done, go over to the INSTALL button on the home screen and navigate over to your USB stick and find the Magisk 17.1.zip. Select it. Check the check mark to reboot after install. Slide over the slider to begin the install. Moment of truth, you'll likely get to errors in big red text something like MOUNT -O BIND /SDCARD FAILED or something, thats fine, ignore it. It should go onto to say

|----Magisk Installer Script 17.1----|

or something like that, that means its doing its thing. Everything should go well and it should ask to reboot.

6. Verify root

Once you boot into the Xiaomi home screen after flashing Magisk, you should get some kind of thing asking to confirm that you want to install the application. That application is the Magisk Manager, which means you did it, Magisk installed successfully!

Go ahead and install some app that you know asks for superuser and it should prompt you for superuser access, grant it. You did it, you're root!

View attachment 4617430