Thanks again for the help. I've now got the 1.5.1 Mi Box 3c rooted. For anyone following... * koshergoy's link is good but, like a lot of people, I had problems putting it in recovery mode using the OK+back buttons while booting (some people say home+menu instead - I didn't try it). * I tried the TWRP method from this video. The script failed to install the TWRP image because of permissions, but broke the recovery enough to put the box in recovery mode on reboot. Luckily the USB stick still had the update.zip from koshergoy's link so I got the downgrade from 1.5.1 to 1.3.106 that I wanted. * The downgrade seemed to break the direct USB connection for KingoRoot so I ran the KingoRoot apk. It completed OK after several tries (probably due to poor quality wifi) but shows 'no root'. I can run su on the box & view protected directories but still lack some permissions, like modifying the /system/vendor directories (to mess with the default Xiaomi apks) * I was able to install my own launcher and could use the "pm hide com.xiaomi.tv.desktop" command together with the "Home Switcher" app to replace the default Xiaomi launcher. * Even though I had "intelligent updates" off, the box updated itself back up to 1.4.32 even after I declined the update. This didn't break the root and my launcher still worked. I couldn't resist taking the offered upgrade back to 1.5.1. I've (hopefully temporarily) lost the icons for the apps I've installed but the root still seems to be in place.