Tutorial [UNBRICK] Mi Band 3 (with | without NFC)

rendal

Well-known member
Contributor
Joined
Aug 29, 2018
Messages
909
Likes
762
Points
103
#1
How to unbrick of hard bricked the Mi Band 3
(with | without NFC)

Last Updated: 07.04.2019
Warning
  • Proceed at your own risk !!!
  • It may also damage the internal electronics of the device (meganic damage, electrostatic discharge, etc.) !!!
  • I'm not responsible for permanently bricked your the MB3!!!
(Tested on two the Mi Band 3 without NFC, version CN, HW v0.18.3.2)

Introduction
This thread contains instructions for unbrick the Mi Band 3 (after flash wrong firmware through bluetooth), using the SPI Flash programmer to program the correct firmware, directly into to the SPI flash memory on the PCB of the Mi Band 3. The DA14681 processor boots executable firmware directly from this flash memory, which contains a boot loader, calibration and other production data, and executable firmware that is updated via bluetooth.
Known issues
  • Need to open the cover body of Mi Band 3.
  • When the body of the Mi Band 3 is opened, waterproofness is lost.
  • Need special equipment (Micro soldering station, programmer for SPI flash memory, and etc.).
You will need
  • Hard bricked the Mi Band 3 (bricked after flash wrong firmware through bluetooth)
  • Micro soldering station, with 0.2mm tip
  • SPI Flash programmer for programming correct firmware into internal SPI flash memory.
  • Control software for SPI Flash programmer (Flashrom / FT2232-SPI-Prog)
  • Hex editor for editing full dump bin file of the SPI flash memory.
  • Correct firmware file for the Mi Band 3
Procedure
  • How opening the cover body of Mi Band 3.
  • How to connect to the SPI flash memory
The Mi Band 3 contains the SPI flash memory GD25LQ32 32Mbit on the PCB. Unfortunately, there are no testpoints available on the PCB (maybe possible under the LCD), for easy contacting of the SPI flash memory. It is necessary to contact the terminal wire directly on the SPI flash memory package.​


Example of connecting to the SPI flash memory (for single use unbrick):

Or a better connection solution (for continuous tests):
  • How to connect to the SPI programmer (circuit diagram of the SPI Flash programmer)
You can use one of these programmers (FT2232 Programmers) based on FT2232 chipset to program the SPI Flash memory on the Mi band 3.​
I used my own circuit diagram with FT2232H, see. the circuit diagram below. The SPI Flash memory (GD25LQ32) on the Mi band 3 has supply voltage of 1.8V !!! The SPI interface of this memory is 3.3V tolerant. The Mi Band 3 battery 3.8V must be disconnected when programming the SPI flash memory GD25LQ32, otherwise the Mi Band 3 processor blocks communication over the SPI interface.​

# Flashrom (utility for flash BIOS/EFI/coreboot/firmware/optionROM images)
Dowonload tool: Windows (v1.0.1-rc2) / Ubuntu (v0.9.9+r1954-1)​
You install drivers (Windows) for Flashrom / FT2232H SPI Flash programmer using tool: Zadig libusb-win32.​
Flashrom requires these libraries "libusb-win32" !!!
Tool the Flashrom directly natively supports of the GD25LQ32 Flash memory.​

* Reading of the flash memory GD25LQ32:
Command: flashrom -p ft2232_spi:type=2232H,port=A​
You check the presence of the GD25LQ32 Falsh Memory (Found GigaDevice flash chip "GD25LQ32" (4096 kB, SPI) on ft2232_spi) !!!
* Reading of the flash memory GD25LQ32:
Command: flashrom -p ft2232_spi:type=2232H,port=A -c GD25LQ32 -r MB3_FullFlash_brick.bin​
"MB3_FullFlash_brick.bin" is the output file.
* Erasing of the flash memory GD25LQ32:
Command: flashrom -p ft2232_spi:type=2232H,port=A -c GD25LQ32 -E​
* Writing of the flash memory GD25LQ32:
Command: flashrom -p ft2232_spi:type=2232H,port=A -c GD25LQ32 -w MB3_FullFlash_unbrick.bin​
You make sure that Flash Memory has been verified (Verifying flash... VERIFIED) !!!
# FT2232-SPI-Prog (SPI Flash Programmer based on FTDI chips in MPSSE mode)
Dowonload tool: Windows (v0.1.13.0) / Ubuntu (v0.1.6.0)​
FT2232-SPI-Prog does not require special drivers and uses native drivers from FTDI (Windows): Virtual COM port (VCP) drivers
Tool the FT2232-SPI-Prog does not support the GD25LQ32 Flash memory directly, you can use "M25PX32" type and set the "Ignore Device ID" control.​
In case of problems with communication with the GD25LQ32 Flash Memory, you can set the communication slowdown by turning on "Disable Quad Mode".​
Also, do not forget to select the memory address range "Start Address" and "End Address".​
* Instructions to control the FT2232-SPI-Prog can be found here: FT2232-SPI-Prog
  • How to unbrick of hard bricked the Mi Band 3
    • You read out the Mi Band 3 GD25LQ32 SPI Flash memory full data range and save it to a file such as "MB3_FullFlash_brick.bin". This GD25LQ32 SPI Flash memory, which contains a boot loader, calibration and other production data (serial number), and executable firmware that is updated via bluetooth. These data are unique to the device and it is necessary to backup !!! Read the GD25LQ32 SPI Flash memory again, repeatedly and compare the files to see if the memory read is correct !!!
    • Open "MB3_FullFlashFlash_brick.bin" in any HEX editor and go to address 4000 and paste the correct firmware from this address. After paste the correct firmware, save the file for example as "MB3_FullFlashFlash_unbrick.bin".
    • Write the file "MB3_FullFlashFlash_unbrick.bin" back to the GD25LQ32 SPI Flash memory.
    • It is recommended that you also reload Firmware, Resources and Font files via Bluetooth after unbrick. This will prevent the Mi Band 3 instability !!!
    • That is all ;)
If you can't get unbrick the Mi Band 3, you can try uploading "Full Dump Flash Images for the Mi Band 3". Unfortunately, you will permanently lost your calibration and other production data (serial number), which is irreversible. However, the Mi Band 3 bracelet will be functional.
 

Attachments

Last edited:

aBStRAcTIrIs007

Well-known member
Contributor
Joined
Jan 31, 2019
Messages
803
Likes
1,212
Points
148
#2
my old mb3 bricked so i purchased new mb3 and i will try it with my briked mb3

!!!thankyou!!!
 

rendal

Well-known member
Contributor
Joined
Aug 29, 2018
Messages
909
Likes
762
Points
103
#4
Thanks it worked πŸ˜€πŸ˜€πŸ˜€πŸ‘πŸ‘πŸ‘πŸ‘πŸ‘I unbricked my mb3 thanks
The article is not yet complete and the essentials are not here. What did you use as a SPI programmer? What utility SW? What version of MB3 are you unbrick? CN / global / NFC? HW version?
 

aBStRAcTIrIs007

Well-known member
Contributor
Joined
Jan 31, 2019
Messages
803
Likes
1,212
Points
148
#5
The article is not yet complete and the essentials are not here. What did you use as a SPI programmer? What utility SW? What version of MB3 are you unbrick? CN / global / NFC? HW version?
I don't know when I did this process a white light flashed from my mb3 global version and the band started working
 

SarthAK47

Active member
Joined
Apr 17, 2019
Messages
84
Likes
79
Points
28
#8
What Causes This Bricking of Mi Band 3??
Can anyone tell me so that I can prevent this.
Plzz:rolleyes:
 

rendal

Well-known member
Contributor
Joined
Aug 29, 2018
Messages
909
Likes
762
Points
103
#9
Brick can only be done with faulty Firmware. Neither resources nor fonts brick does. Brick won't even turn off Bluetooth during firmware update.
 
Joined
Aug 19, 2018
Messages
50
Likes
19
Points
18
#10
Does someone have equipment to unbrick this for me in Europe?

Is waterproofment lost even if you use superglue when putting it back together?
 

rendal

Well-known member
Contributor
Joined
Aug 29, 2018
Messages
909
Likes
762
Points
103
#11
Does someone have equipment to unbrick this for me in Europe?

Is waterproofment lost even if you use superglue when putting it back together?
Certainly someone has, but the price of the new bracelet is so low that the service doesn't pay off. Bonding goes, but waterproofing is not 100%, but it can. Not guaranteed.
 

rendal

Well-known member
Contributor
Joined
Aug 29, 2018
Messages
909
Likes
762
Points
103
#20
can circuit be without that AT93C46 eprom chip? can I use 12MHz crystal?
Yes, the AT93C46 eprom may not be used. The AT93C46 eprom is used to address multiple devices on the USB bus. I don't have a datasheet, information about the crystal can be found in the datasheet.
 

Trusted Store

Members online

No members online now.

Our Telegram Channel

Which color of official strap would you like to buy for your Mi Band 3?

  • Black

    Votes: 2,154 52.8%
  • Deep Blue

    Votes: 1,197 29.4%
  • Redish Orange

    Votes: 726 17.8%

Forum statistics

Threads
2,408
Messages
40,524
Members
211,820
Latest member
careylui
Top