USB Burning Tool flashable CE 9.2.8 for mibox3

This is a byproduct of me reverse-engineering the Xiaomi mibox3/3c(MDZ-16-AA, the Chinese model) in April earlier this year.

The box has a locked bootloader and no reset button which made it impossible to side-load any other kernels, it even refused to boot into update mode when issued to do so from adb. Thus booting a CE/EE/Armbian/Openwet/whatever drive was impossible.

At the time I first touched this thing, the guys playing around with this box had to solder UART sockets to manipulate the u-boot, which is way too inconvenient. After digging through CE and Linux-amlogic’s source code and reverse-engineering all Xiaomi/Amlogic’s proprietary stuffs and constantly rebuild and test for 3 days, I finally built a USB Burning Tool flashable image for the box that’ll boot directly into CoreELEC.

After that I made many updates and eventually achieved side-by-side dual-boot with CE+EE via a USB Burning Tool image, which is the base for the now generic HybridELEC.

This is the latest image I built last night, which is basically the CE side in my old HybridELEC1.2 image however now standalone (I stopped updating standalone CE image after the first HE image released in early May)

This image includes the following differences from the official 9.2.8 image:

  • The emmc driver in kernel is patched so Xiaomi’s modified emmc layout can be recognised (Xiaomi moved the reserved partition to 4M offset, and so dtb is also moved)
  • A dedicated dtb, that is both compatible with Xiaomi’s u-boot, and CE/EE’s kernel, is included
  • Xiaomi’s proprietary IR protocol is supported
  • Xiaomi’s BT remote is supported
  • Kernel written to boot partition, and the squahfs system image written to system partition
  • Rootfs is mounted from /dev/system directly, no /flash mount
  • Partition layout is completed customed to achieve higher disk space utilization for the tiny 4G emmx

After flashing, the data partition will be around 3.4GB, utilizing most of the box’s tiny 3.7GB emmc

The method to flash the image is the same as other official USB Burning Tool images. Except you have to choose and only choose “Normal Erase”, the choose “Erase All” in the drop-down menu. This is because our partition layout is completely different from official (even no logo partition)

I decided to share this here since I saw vasco’s post:

And I think the image should not only be enjoyed by a small group of people

1 Like

Added note about why this is only built recently:
I came back to build this by myself after all these months because I finnally got a more powerful box for EmuELEC and decided to use my mibox3 as a dedicated CE box instead. And I found therre’s many people downloading the old pre-hybrid CE image for mibox3 according to github stats so decided to come back to share it.

Added note about known issues:
I use this image (an CE+EE dual-bootable version containing the same kernel and system image) for around 3 months as my main media box and didn’t find any major issues (not those reproducible on official 9.2.8), but there’s some known issues I can’t/don’t have the ability/knowledge to fix that does not hurt the user experience under Kodi:

  • CEC for some TV combinations is faulty, but for my TV (Baofeng TV 40X) it’s OK
  • If failed to flash the image due to instable power supply/USB connection, the MAC address for the WiFi/BT chip could be lost, an official Xiaomi Android firmware must be flashed and booted to make sure the wireeless is functioning before another flash
  • None of waking up features work (WakeOnLan, or with remotes), and BL301 inject won’t work on Xiaomi’s heavily modified u-boot so don’t even try to use it unless you want to brick your box. For me I just manually plug the power when needed
  • The bluetooth remote (named 小米语音遥控器 on BT setting menu, could be un-recognizable if you’re not using Arial-based fonts since the default font bundled with Estuary does not support Chinese characters) can only function as a Human Input Device, the microphone on it does not work. Technical detail: the remote does not work at all on official LibreELEC/CoreELEC, I force its ID to hid-generic driver as a workaround, so there’s no Audio-In drive assigned to it

It also inherits all known issues in official CE 9.2.8 as my goal about this and also my another project HybridELEC is to provide the experience as-is and don’t want to bury myself under the same amount of maintainace work a whole team handles (i.e. I can’t handle by myself)

Added note about mergable features:
These are added feature they can be easily ported to LibreELEC, CoreELEC and EmuELEC with simple git cherry-pick but I don’t have the time for it and feel it hard to decide which project to open pull request on. Cherry-pickable features include:

  • The support for Xiaomi’ proprietary IR protocol, this uses raw scan code in lircd.
  • The support for BT Xiaomi Voice Remote (小米语音遥控器), this uses a udev rule to assign hid-generic driver for it when connected
  • The mibox3/3c (MDZ-16-AA) dtb
1 Like

I tested and it works on my mibox 3c.
Thanks. You’ve done a good job