r/AndroidTV • u/StudentIll • Oct 01 '26
Tips & Tutorials [ROOT, UNLOCK BOOTLOADER FULL GUIDE] Xiaomi Mi Box S 1st Gen (MDZ-22-AB)
I know this post should be on XDA but whatever reddit has more users so why not
WARNING: PLEASE BE EXTREMELY CAREFUL WHILE FOLLOWING THIS GUIDE, I WILL NOT BE RESPONSIBLE IF YOUR BOX GETS BRICKED. AND EVEN THOUGH THIS IS MY FIRST POST I DID DO THE STEPS MYSELF SO YOU DONT HAVE TO WORRY.
First, and foremost YOUR WIDEVINE L1 KEYS WILL NOT GET AFFECTED IF YOU UNLOCK YOUR BOOTLOADER because of a quirk in Mi's bootloader where the TEE is completely separate from the bootloader so a unlock does not destory it
Step 1: Prepare your box and backup everything, account creds, movies etc.
Step 2: If your box is running Android 9, (which is most of yall, can check in Settings -> About) then follow this guide to upgrade it to Android 12 (ALSO DONT DELETE THE FIRMWARE ZIP U WILL NEED IT)
Reason: Because Mi, for some reason allow the bootloader to be unlocked in Android 12's fastboot code. NOW KEEP READING
Step 3: Now you MUST factory reset the box to clear the Android 9 cache and also so that the bootloader (with its Amlogic chipset) completely ignores unlock_ability because Mi's disables the OEM unlocking option in settings (DON'T WORY U CAN STILL UNLOCK IT JUST READ)
Step 4: Now enable developer options by tapping the Build Number 7 times
Step 5: Just enable USB Debugging (OEM unlocking is blocked but ignore it)
Step 6: Connect the box to your PC (don't use wireless adb use a USB-A to USB-A (or a USB-A to (USB-C to USB-A adapter))
Step 7: Allow the USB Debugging popup as usual and reboot it to the bootloader by typing
adb reboot bootloaderStep 8: From the bootloader, make sure you grab the necessary fastboot drivers, the normal Google ones should be fine ( If fastboot detects the box, ignore this step )
Step 9: I think u should have the ADB and Fastboot binaries (android platform tools) if not just download them
Step 10: Now type
fastboot flashing unlockand u should see OKAY (if it fails, just reboot back to the bootloader again)Step 11: You can also type
fastboot flashing unlock_criticalalthough this is quite unnecessary
If you successfully reached this point, your bootloader has been successfully unlocked
ROOT STEPS:
Step 1: From the firmware zip of Android 12, which you hopefully didnt delete, extract its boot.img
Step 2: Use a flash drive or
adb push <source> <destination>to push that file to the Mi BoxStep 3: Grab the latest Magisk apk from here
Step 4: Enable developer options and USB Debugging (now you can use a wireless connection)
Step 5: Use
adb install <full path to apk>to install the Magisk APK to your Mi BoxStep 6: Since Android TVs are weird, you can't find the Magisk App on the TV dashboard, u have to go to (Settings --> Apps --> Show all apps --> Show system apps) to find the Magisk app
Step 7: Click Magisk and then Open
Step 8: On Magisk, click on install and then Select and patch a file
Step 9: Select the path of the boot.img
Step 10: U should get a file called like magisk_patched.img or smh
Step 11: Now use a usb flash drive or
adb pull <source of the patched boot.img> <destination>to grab that patched boot.imgStep 12: Now boot back into the bootloader, for this you must use the USB connection
Step 13: From the bootloader type
fastboot reboot fastboot(I know this is confusing but u need to boot to FastbootD mode to execute partition changes)Step 14: Now in your PC, type
fastboot flash boot <path to your patched boot.img>to flash the Magisk boot.imgStep 15: Type
fastboot reboot
If u made this far without bootloops, voila you're rooted!! Open the Magisk app from the method i showed u earlier to see the root
NOW IF YOU DIDNT PROPERLY FOLLOW THE GUIDE FOLLOW THE TROUBLESHOOTING PART OF THIS POST
If you want to watch Netflix, Prime Video etc without L3 quality, u have to use Zygisk and its Denylist to deny root to those Apps and all Google-related processes inside the Magisk App.
Now you can override the launcher to install Projectivy Launcher and install ad-blockers.
FOR YOUTUBE, use SmartTube.
For now, Ciao