Jump to content

Xiaomi Mi TV Stick (xiaomi-aquaman)/Hacking and Researching: Difference between revisions

From postmarketOS Wiki
Exkc (talk | contribs)
Exkc (talk | contribs)
 
(No difference)

Latest revision as of 15:35, 23 February 2025


Warning WARNING: This is just an unorganised section for notes.

Implementing "Multiboot" mode (see Amlogic#Boot process) in the U-Boot environment via the U-Boot shell is needed to boot pmOS and older android 9 uboot has uboot shell.

U-Boot 2015.01-g0a28df3-dirty (May 26 2020 - 19:23:51), Build: jenkins-aquaman_release-293
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
gxl_aquaman_v1#

Unfortunately in newer revision of Android 9 the u-boot shell is disabled. Sadly, there is no way to downgrade.

However, it was found that fastboot can run U-Boot commands, and that it does not seem to do any checks on what commands are being ran. Might be exploitable (see #amlogic-postmarketos OFTC IRC logs (2025-01-12)). You can enter fastboot with adb reboot fastboot.

So the guides in Xiaomi Mi Box 3 (xiaomi-once) might work for this device if it is done via fastboot, although it might need some changes because the buffer in which the fastboot commands are stored before being ran is limited. However that is currently untested.

Some dumps are available: https://dumps.tadiphone.dev/dumps/xiaomi/aquaman.

Some XDA Forum posts and YouTube videos imply that the bootROM USB mode is not password-protected, so the TV stick might be vulnerable to a bug in the USB mode, that allows running unsigned code. Additionally, some other XDA posts claim that there is a way to enter USB mode, by shorting pins (at your own risk!) on the green variant. It may be possible to enter USB mode with the HDMI boot dongle as well.

The TV Stick can be upgraded to Android 10. It was discovered that the Android 10 upgrade brought back the U-Boot shell, so it is possible to enter it via UART:

U-Boot 2015.01 aquaman_q-user (Aug 01 2023 - 16:50:19), Build: jenkins-Aquaman_Q_uboot-2493
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
aquaman_q#

However the go command got removed in android 10 since newer android 9. However, "bootm" can be used to boot a kernel instead.