[Xiaomi Mi Mix 2S Questions & Answers] khaosxiii:
Update:

Proof of concept Complete and Successful:

=================================

Record Server Response:

===================

-Downloaded ROM which is able to be flashed w/ XiaomiADB.exe - in this example: miui_MIMIX2SGlobal_V10.3.5.0.PDGMIXM_640d089ad0_9.0.zip

This ROM: Passed MD5 Hash Check & is on the list of allowed ROMs per update.miui.com permitted to be flashed to this CN device: M1803D5XE which is in a bricked state w/ error: "This MIUI Version can't be installed on this device"

Remember, the whole issue is that this ROM can be flashed, but the CN ROM cannot as it doesn't pass authorization ... likely due to re-seller modification of the device -or- something not matching up in the device after locking the device w/ Global ROM. If we could flash the CN ROM the theory is that we would be able to boot successfully unbricking the device. Even though flashing this Global ROM is successful, we get the error mentioned above - so we are really more interested in the server response here or the auth sent back from miui.

-Installed WireShark w/ PCAP & Began Tracing

-Verified/Recorded the HTTP POST & Response received from update.miui.com when flashing via XiaomiADB.exe (seen above)

-Took this one step further and performed the same POST request via Windows PowerhShell: Invoke-WebRequest & Recorded Response received from udpate.miui.com

-Recorded the response from Powershell - you can see it above as $response.Content - this seems to be a response key if you will or maybe just an encoded response - not sure (You could also record the response straight out of WireShark and skip PowerShell alltogether - but it's an easy way to perform web requests in Windows via Invoke-Webrequest -method Post etc. and was part of the initial test here - it also allowed me to verify my local server response)

Generate Update Server Authentication Locally:

====================================

-Install XAMP Local Apache/PHP Server (although I'm not sure it's needed due to the static file used here - probably any old web-server would work)

-Modified Windows Local HOSTS file to point update.miui.com to 127.0.0.1 (C:\Windows\System32\drivers\etc\hosts)

-Pinged update.miui.com and verified response was 127.0.0.1 - traffic successfully redirected via HOSTs file edit

-Created file to be served from XAMP - bare-bones txt w/ single line (encoded response from prior): D:\xampp\htdocs\updates\miotaV3.php

-Copied and pasted "key" or encoded response received from above test (this is the $response.Content received in PowerShell or traced in WireShark)

-Verified the following:

Attempting to Flash miui_MIMIX2S_V10.3.4.0.PDGCNXM_f9545a534a_9.0.zip with a Successful Response received from miui.com for ROM: miui_MIMIX2SGlobal_V10.3.5.0.PDGMIXM_640d089ad0_9.0.zip @ emulated local server fails w/ error:

rom md5 hash mismatch

[IMG="ROM MD5 Mismatch"]https://i.imgur.com/Xq8o8FE.png[/IMG]

Attempting to Flash miui_MIMIX2SGlobal_V10.3.5.0.PDGMIXM_640d089ad0_9.0.zip or miui_MIMIX2SGlobal_V10.3.5..zip (same file size, just diff name) with a Successful Response received from miui.com and emulated via local server @ 127.0.0.1 is successful!

[IMG="Update Success"]https://i.imgur.com/uXcUv4Z.png[/IMG]

Last test to verify this is all really happening locally:

-Modified "key" which is pasted into: \xamp\htdocs\updates\miotaV3.php (pasted random characters in it) and verified attempting to flash miui_MIMIX2SGlobal_V10.3.5.0.PDGMIXM_640d089ad0_9.0.zip again failed (I could have also probably looked @ xamp server logs)

What does this prove? (EDIT - I found out later I'm only passing 1st step of auth and additional step was happening outside of 127.0.0.1 somehow ... )

=================

-This proves that generating an authentication response locally can be successful in flashing a ROM via XiaomiADB.exe - we effectively bypassed the response from update.miui.com and provided our own response and then successfully flashed. The response appears to be very static - I can use the same response/key at a later time to verify it is not subject to any time-restraints ... but I don't guess that iw ould be

What's next?

==========

-I wonder if someone could successfully flash miui_MIMIX2S_V10.3.4.0.PDGCNXM_f9545a534a_9.0.zip w/ an unlocked bootloader, and record the response from update.miui.com? If the response were recorded and served locally as seen in the tests above - I wonder if it would it pass auth and be successfully flashed onto my bricked device?

-Need to start further investigating local requests from XiaomiADB.exe to local server and see if there is anything else that could be done outside of just giving the single key / single file response...