Shield Android TV rooted

teletype · May 31, 2015

I just managed to get TWRP running on the new Shield console, and installed SuperSU successfully. Two caveats: the display is upside down, and the USB host ports don't work. I had to plugin a mouse via an OTG cable in order to interact with it. ETA: That's only an issue when booted to TWRP. Everything's working fine in the stock ROM after rooting.

Procedure:
- enable developer tools / USB debugging
- adb push supersu.zip /sdcard
- adb reboot bootloader
- fastboot oem unlock
- fastboot boot twrp-2.8.6.0-shieldtv-unofficial.img
- unplug USB cable, connect mouse via USB, install SuperSU

TWRP boot image is attached. Off to explore...

EDIT: by request, some more detailed instructions:

On the Shield device, head to Settings -> About, and click "Build number" 7 times. This will enable Android's Developer options.
Go to Settings -> Developer options, and enable USB debugging.
Install the ADB/fastboot drivers and utilities if you don't already have them. When "adb devices" shows your Shield, you're good to go.
Download and extract recovery.zip from this thread.
Head to the SuperSU forum and download the latest version.
Open a command prompt and navigate to the directory where you downloaded everything. (Google this for your OS if you don't know how).
With the Shield still booted, run "adb push supersu.zip /sdcard" (change supersu.zip to appropriate file name). This will upload the SuperSU update zip to your device, which you'll install from TWRP.
If that worked fine, run "adb reboot bootloader". Your device should shut down, and display the Fastboot screen after a few seconds.
FOLLOW THE NEXT THREE INSTRUCTIONS AT YOUR OWN RISK. This WILL wipe all your user data, back it up with ADB first if you want to preserve it. DISCLAIMER #2: I have no idea if there are any DRM keys or anything that get wiped when this is done (this was the case on my Xperia Z3 Compact). I will say that Grid streaming still works fine after doing this.
This step will unlock your bootloader to enable booting unsigned images.
Run "fastboot devices" and make sure your Shield is visible.
Run "fastboot oem unlock" and follow the prompts on the screen. Your bootloader is now unlocked.
Now, boot the TWRP image with: "fastboot boot twrp-2.8.6.0-shieldtv-unofficial.img" - Note: I used this instead of "fastboot flash" so I could keep the stock recovery around, to grab an image of it after rooting.
You should now see a TWRP recovery menu (upside down for now).
Connect a keyboard or mouse via OTG cable, and select "Install", navigate to your SuperSU zip, select it, and follow the prompts.
Click "reboot" and you should now be rooted.

arnold88 · May 31, 2015

Great job. Will try later.

Smokuevo · May 31, 2015

It offers fastboot OEM unlock?!? Sweet

Steel01 · Jun 1, 2015

I'm starting dev work on this as well. Can you try the flipped screen flag and see if it that fixes the display? That's required to make the tablet work correctly. I preordered the pro edition, so I can't test anything for almost another two weeks. Hopefully someone will be able to get the normal usb ports working, since it'll be much easier to use those for a mouse/keyboard.

S197Mike · Jun 1, 2015

Sweet can't wait to try this out

FreeEmulator · Jun 1, 2015

Thanks for posting this. I've got my NVIDIA Shield Android TV coming on Wednesday, so I'll give this a try. I had a USB OTG cable, but lost it several months ago so I ordered another one of those as well. Just to clarify... the 2 USB 3.0 ports will work after rooting when you boot back to stock, right?

Also, this works on the latest 1.1 OTA update too, correct?

Sorry to ask this as it is super n00bish, but could someone explain to me step-by-step directions for rooting this or perhaps link to a guide that uses this same procedure? I know the main steps are listed in the OP, but I'm not really sure how to use adb to push supersu.zip, reboot into bootloader, fastboot, etc.

Lastly, what will be the process of upgrading via OTA updates in the future after I root it? Will I need to unroot one way or another (instructions or a link to a guide would be great), or will OTA updates work just fine?

Once again, sorry for all the n00b questions. I just want to make sure I don't do something stupid to mess the device up...

teletype · Jun 2, 2015

FreeEmulator said:
Thanks for posting this. I've got my NVIDIA Shield Android TV coming on Wednesday, so I'll give this a try. I had a USB OTG cable, but lost it several months ago so I ordered another one of those as well. Just to clarify... the 2 USB 3.0 ports will work after rooting when you boot back to stock, right? Also, this works on the latest 1.1 OTA update too, correct?

Also, sorry to ask this as it is super n00bish, but could someone explain to me step-by-step directions for rooting this or perhaps link to a guide that uses this same procedure? I know the main steps are listed in the OP, but I'm not really sure how to use adb to push supersu.zip, reboot into bootloader, fastboot, etc.

Yup, everything works normally after rooting. These issues only exist in TWRP because I did an extremely quick and dirty build (extracted a Shield Tablet TWRP and replaced the kernel). I'll work on fixing them soon, unless someone beats me to it. Thanks for the tip on the screen flipping, Steel01.

I've updated the OP with some more detailed instructions.

ETA: I can't see OTAs being a problem. In theory, they could check if an su binary is installed and deny the update until you remove it, but if they're allowing oem unlock, I can't see why they'd do that. And you could just remove it anyway. You will have to re-root after each OTA update.

FreeEmulator · Jun 2, 2015

teletype said:
Yup, everything works normally after rooting. These issues only exist in TWRP because I did an extremely quick and dirty build (extracted a Shield Tablet TWRP and replaced the kernel). I'll work on fixing them soon, unless someone beats me to it. Thanks for the tip on the screen flipping, Steel01.

I've updated the OP with some more detailed instructions.

ETA: I can't see OTAs being a problem. In theory, they could check if an su binary is installed and deny the update until you remove it, but if they're allowing oem unlock, I can't see why they'd do that. And you could just remove it anyway. You will have to re-root after each OTA update.

Awesome, thank you so much for the info and instructions. :good: I should be good to go now once everything arrives on Wednesday.

mtbowl · Jun 2, 2015

Twrp for forge?

Is there any skilled folks out the with a forge tv? I'm in need of some kind of recovery for this. I'm a bit of a noob so compiling it on my own is kinda greek to me

agrabren · Jun 2, 2015

Quick warning for Pro owners: OEM Unlock takes about 92 minutes. Just be warned and ready for it...

Failrunner · Jun 2, 2015

Yeah so go to links with viruses in them and then waste time removing them. You know there are website without a million links to viruses all over them that can be used. It's always nice not to have to play guess which download link isn't a virus. -_-

A.N.Droid · Jun 2, 2015

i read somewhere that full hd/4k playback in netflix and other vod services needs a locked bootloader. is that right?

GalaxyWhy · Jun 2, 2015

A.N.Droid said:
i read somewhere that full hd/4k playback in netflix and other vod services needs a locked bootloader. is that right?

Hypothetically if you can oem unlock bootloader can you just oem lock bootloader to fix the issue?

Luxferro · Jun 2, 2015

teletype said:
ETA: I can't see OTAs being a problem. In theory, they could check if an su binary is installed and deny the update until you remove it, but if they're allowing oem unlock, I can't see why they'd do that. And you could just remove it anyway. You will have to re-root after each OTA update.

Actually rooting will likely break OTA updates. Since lollipop, Google has moved to block level OTA updates. That means it doesn't just patch individual files, it patches at the block level. So if there is a change to /system the OTA won't update.

The same seems to apply to the Shield TV. Here's the updater-script from the current OTA:

Code:

(!less_than_int(1432624016, getprop("ro.build.date.utc"))) || abort("Can't install this package (Tue May 26 00:06:56 PDT 2015) over newer build (" + getprop("ro.build.date") + ").");
getprop("ro.product.device") == "foster" || abort("This package is for \"foster\" devices; this is a \"" + getprop("ro.product.device") + "\".");
show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/platform/sdhci-tegra.3/by-name/APP", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/platform/sdhci-tegra.3/by-name/LNX");
show_progress(0.200000, 10);
nv_copy_blob_file("blob", "/staging");
nv_copy_blob_file("bmp.blob", "/bmps");

But borked OTA shouldn't be much of an issue, since Nvidia is releasing the fastboot factory images: https://developer.nvidia.com/shield-open-source The text is there now for them, but they aren't up yet. So you can always revert to stock, then OTA update.

Steel01 · Jun 2, 2015

Wait... What? You got one of of the tablet twrps to boot on the console? I'm shocked that worked. Didn't think it what that easy to get 32-bit mode. Anyways, that's why it's upside down, because that flag is set for the tablet. As soon as a console section opens up here and on androidfilehost, I'll post my builds. I have cm, twrp, and multirom compiling, but I can't test them until next week, when Amazon ships the pro, so they might not even boot.
@agrabren: Oh my goodness, the wipe takes that long? What's it doing? US Government certified nuking? And people complain about multi minute cache wipes on the tablet now. What am I going to be hearing in a couple weeks for this?

Actually, since you're around again... Do you still have the CM files you made for the portable? I'm still interested in what you did to make the cwm recovery work as well as it did.

FreeEmulator · Jun 2, 2015

One more quick question for now... once rooted, does anyone know how I would go about locking the GPU clock speed / frequency at its highest setting (which if I've read correctly is 1 GHz)? I'd like to be able to flip the lock on only while testing out some pretty hardware intensive emulator games (the Dolphin GameCube/Wii emulator, which I was told by a developer of the emulator to try to lock the maximum GPU clock speed to ensure best performance). Thanks again for all the help, you guys are great.

sonicadvance1 · Jun 2, 2015

Tested out the pro console on my side (Got it early due to reasons).
It refuses to mount any partitions, so it is impossible to root.

Luxferro · Jun 2, 2015

sonicadvance1 said:
Tested out the pro console on my side (Got it early due to reasons).
It refuses to mount any partitions, so it is impossible to root.

It's probably because the partition layout/names are different for the internal 500GB drive. If you poke around you can probably find the info, or just dump your boot.img, decompile it and look for the fstab file. It will look similar to the below (that is for the ADT-1).

Code:

# Android fstab file.
#<src>                                                  <mnt_point>         <type>    <mnt_flags and options>                               <fs_mgr_flags>
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK


/dev/block/platform/sdhci-tegra.3/by-name/system      /system             ext4      ro                                                    wait
/dev/block/platform/sdhci-tegra.3/by-name/cache       /cache              ext4      noatime,nosuid,nodev,nomblk_io_submit,errors=panic    wait,check
/dev/block/platform/sdhci-tegra.3/by-name/userdata    /data               ext4      noatime,nosuid,nodev,nomblk_io_submit,errors=panic    wait,check,encryptable=/dev/block/platform/sdhci-tegra.3/by-name/crypto
/dev/block/platform/sdhci-tegra.3/by-name/misc        /misc               emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/boot        /boot               emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/recovery    /recovery           emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/DTB         /dtb                emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/staging     /staging            emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/sysdata     /sysdata            emmc      defaults                                              defaults

patt2k · Jun 2, 2015

Someone skilled do this also for Forge anyways hopefully XDA adds Android TV forums.

Keep up the good work even though I don't own the Shield.

Luxferro · Jun 2, 2015

patt2k said:
Someone skilled do this also for Forge anyways hopefully XDA adds Android TV forums.

Keep up the good work even though I don't own the Shield.

The forge has a locked bootloader. Sure, you can root it (supposedly), then replace the recovery, but you'll never be able to use fastboot until it's unlocked.

BTW, the Nvidia Shield TV factory images are up now :victory:

Shield Android TV rooted

Member

Attachments

Senior Member

Senior Member

Recognized Developer

Senior Member

New member

Member

New member

Member

Inactive Recognized Developer

Senior Member

Senior Member

Senior Member

Senior Member

Recognized Developer

New member

Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts