ATOTO S8 - System Contents

Search This thread

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
I use one of the Play Store apps to get into Developer options and it does show an ADB debugging option and most of the other choices available in a typical Developer's menu. The one I use is the first one that comes up in the search on play store, I think the author is Singlebyte.

Update. I changed USB logging. But two laptops, 2 cables and 4 USB cables coming out of the head unit, and I still was unable to see adb devices anything.


However, feeling invincible and comparing their boot.img to their patched IMG file (5kb difference) I tried to root my head unit using the Joying patch.

It didn't brick anything but it also didn't do anything positive. Radio doesn't work and big red letters are stuck across my screen.

I'll revert back using the Atoto firmware tomorrow.
 

buffaloquinn

Senior Member
Update. I changed USB logging. But two laptops, 2 cables and 4 USB cables coming out of the head unit, and I still was unable to see adb devices anything.


However, feeling invincible and comparing their boot.img to their patched IMG file (5kb difference) I tried to root my head unit using the Joying patch.

It didn't brick anything but it also didn't do anything positive. Radio doesn't work and big red letters are stuck across my screen.

I'll revert back using the Atoto firmware tomorrow.
I was looking at the same root idea myself. Disappointed it didn't pan out.
Let us know if it reverts back okay If it does I might get a little more daring myself.
 
Last edited:

buffaloquinn

Senior Member
I was looking at the same root idea myself. Disappointed it didn't pan out.
Let us know if it reverts back okay If it does I might get a little more daring myself.
So here is another option that might be worth a try. You have the firmware that you updated from and you said it works well so in theory you should be able to extract the working boot image from that. If so, might this method work?
 

buffaloquinn

Senior Member
1. I can confirm that I flashed/updated the S8 Ultra using the Dropbox zip file above and after it reset Android, it did nothing but reset my google credentials. My apps were still there.

But it also didn't brick my S8 Ultra .

It has the similar files as the Joying zip file which has the same chipset.

After the flash, my phone asked to authorize the adb debugging, while connected to the head unit. I'll see if I can get the head unit to turn on adb debugging so I can root it.
Backtracking a little here. How did you do the update? Did you put the update zip file on a USB flashdrive or did you use an SD card in the TF slot? Also, how did you get the unit to do a cold boot, which I assume you need to do to flash the update?
 

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
I was looking at the same root idea myself. Disappointed it didn't pan out.
Let us know if it reverts back okay If it does I might get a little more daring myself.
Yup it's back to normal minus my installed apps and maps.

The Joying sc9853i and the Atoto S8 series have very close boot.img files. I suspect some audio drivers caused the radio app to crash. So don't go that route.

But I'd also guess that you can flash those two files if you get into trouble. If you're worried just beg Atoto for the rom for your unit.
Claim:
- touch screen doesn't work and you have only Bluetooth mouse and eventually let them suggest the idea of flashing your unit...
 

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
Backtracking a little here. How did you do the update? Did you put the update zip file on a USB flashdrive or did you use an SD card in the TF slot? Also, how did you get the unit to do a cold boot, which I assume you need to do to flash the update?

Saved to a MicroSD card with the right zip file on it which launched an immediate option to Start flashing or Cancel.

Not necessary to use the reset button (pin hole) or hold down the power button for 10 sec.

Magisck installs but doesn't give me the option to select a boot.img to patch. I'm not sure if I can do it on another device with Atoto's boot.img and then flash it via a signed Zip using the java jar.

Can't hurt I suppose.
 

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
Saved to a MicroSD card with the right zip file on it which launched an immediate option to Start flashing or Cancel.

Not necessary to use the reset button (pin hole) or hold down the power button for 10 sec.

Magisck installs but doesn't give me the option to select a boot.img to patch. I'm not sure if I can do it on another device with Atoto's boot.img and then flash it via a signed Zip using the java jar.

Can't hurt I suppose.

So able to patch on my phone using the Atoto boot.img. But not able to sign the zip and the odds are against it working. There's a deprecated java library (BASE64 from sun) which which means I have to go back to Java8.

This step wouldn't be necessary if I could just get adb to work.
 

buffaloquinn

Senior Member
Yup it's back to normal minus my installed apps and maps.

The Joying sc9853i and the Atoto S8 series have very close boot.img files. I suspect some audio drivers caused the radio app to crash. So don't go that route.

But I'd also guess that you can flash those two files if you get into trouble. If you're worried just beg Atoto for the rom for your unit.
Claim:
- touch screen doesn't work and you have only Bluetooth mouse and eventually let them suggest the idea of flashing your unit...
I put in a request to ATOTO for my firmware, well see what happens. I suspect it uses the same one as the Ultra though because some of the options in system menu are hardware features only available in Ultra devices. If you get a chance can you grab me all relevant info on the Ultra firmware so I can compare it to mine.
 

buffaloquinn

Senior Member
So able to patch on my phone using the Atoto boot.img. But not able to sign the zip and the odds are against it working. There's a deprecated java library (BASE64 from sun) which which means I have to go back to Java8.

This step wouldn't be necessary if I could just get adb to work.
I'm going to try to get ADB working sometime this weekend. I'll let you know if I have any luck. Did you unlock the bootloader already?
 

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
I'm going to try to get ADB working sometime this weekend. I'll let you know if I have any luck. Did you unlock the bootloader already?

No. I've signed the Zip 6521_1.zip using the jar file for Joying under an assumption that it will work.
=> Oracle didn't send me a frickin password reset so I had to get Java8 from OpenLogic
=> the size of the 6521_1.zip is half what it was (the boot.img vs patched is only 5kb bigger)
=> I've copied the patched boot.img into the zip file and resigned it which I think means that I'm "fooling" the bootloader (and don't need to unlock it).

No adb, no fast boot. Working on a chromebook with GalliumOS. We'll see how this goes shortly.

Edit: latest SignApk2.jar created a similarly sized 6521_1.zip file. So I'm going to use that instead.
 

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
So it's this the Update to Ultra with the Magisk patched boot?

The same two files are used in the Joying and the Atoto head units (both based on sc9853i intel/GPU head units). Which makes me believe (?) that you can take just the two 6521_1.zip and 6521update files, load them onto a microSD card, and it will kick off the update.


The S8 ULTRA zip file contains the whole thing with the patched boot.img and the signed 6521_1.zip (and the unpatched one as "goodboot.img" should you want to flash it back to original) but that should be avoided if you don't have an ULTRA.

Are you able to do the "safe" flashing where it resets back to stock on reboot if it doesn't work?

% adb reboot bootloader (wait a couple of seconds then)
% fastboot boot boot.img
 

buffaloquinn

Senior Member
The same two files are used in the Joying and the Atoto head units (both based on sc9853i intel/GPU head units). Which makes me believe (?) that you can take just the two 6521_1.zip and 6521update files, load them onto a microSD card, and it will kick off the update.


The S8 ULTRA zip file contains the whole thing with the patched boot.img and the signed 6521_1.zip (and the unpatched one as "goodboot.img" should you want to flash it back to original) but that should be avoided if you don't have an ULTRA.

Are you able to do the "safe" flashing where it resets back to stock on reboot if it doesn't work?

% adb reboot bootloader (wait a couple of seconds then)
% fastboot boot boot.img
So, do you have root after all of this?
 

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
Did you run the Magisk app after you updated the boot image?
Yes. Which led me to believe I was successful, along with Termux saying I had the root # prompt. But RootCheck and SuperUser tells me no.
=> so now I'm looking at copying su, busybox *in the atoto flashing script* and chmod 7775 them so they're basically a part of the image.

Most people who do this either have a) an unlocked bootloader and b) access to Recovery/ADB/fastboot but I can sign (I'm sure) the firmware so I don't find a lot of help on the inter-web.

I also muck with the apps pre-installed (editing the Allapp.pkg using "xar") because EasyConnect.apk gets in the way.
 

buffaloquinn

Senior Member
Yes. Which led me to believe I was successful, along with Termux saying I had the root # prompt. But RootCheck and SuperUser tells me no.
=> so now I'm looking at copying su, busybox *in the atoto flashing script* and chmod 7775 them so they're basically a part of the image.

Most people who do this either have a) an unlocked bootloader and b) access to Recovery/ADB/fastboot but I can sign (I'm sure) the firmware so I don't find a lot of help on the inter-web.

I also muck with the apps pre-installed (editing the Allapp.pkg using "xar") because EasyConnect.apk gets in the way.
RootCheck has been know to return a false negative. And are you talking about the Superuser in Magisk or a separate program? Because a separate program won't recognize Magisk's binaries.
 

JMeister234

Senior Member
Mar 16, 2011
73
12
Mississauga
RootCheck has been know to return a false negative. And are you talking about the Superuser in Magisk or a separate program? Because a separate program won't recognize Magisk's binaries.
I think it was a true negative. I couldn't do anything that I couldn't already do.

I was able to flash my head unit one last time before that damn little microSD card disappeared somewhere (taking all my updates with it). It's slid into the back of the car seat and now I have to wait for Amazon to deliver another (or choose to lose all my Nintendo Switch game data).
=> I changed a script to copy the su/busybox binaries to /system/xbin/ and chmod them to be executable.

I have not tested to see whether it worked or not.
 

buffaloquinn

Senior Member
I think it was a true negative. I couldn't do anything that I couldn't already do.

I was able to flash my head unit one last time before that damn little microSD card disappeared somewhere (taking all my updates with it). It's slid into the back of the car seat and now I have to wait for Amazon to deliver another (or choose to lose all my Nintendo Switch game data).
=> I changed a script to copy the su/busybox binaries to /system/xbin/ and chmod them to be executable.

I have not tested to see whether it worked or not.
That sucks. I've always got at least a half dozen SD cards floating around. I use them in USB readers as flash drives and a number of my laptops have built in SD readers as well.
I'm going to drag one of my laptops out to the car this morning to try my luck at ADB.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    I spent the better part of 4 hours today setting up the connection between my new ATOTO S8 Pro and my laptop. After getting USB debugging working, and a functional adb shell, I pulled off everything that I could copy with the limited permissions I had.

    To be clear, I have NOT rooted the headunit. I'm a little leery about doing it, as I don't want to break anything, and as of right now, there is no way to restore the headunit back to factory like you would with, say, a Pixel phone.

    BUT, for those of you who are curious here is my compressed system dump (or rather, adb pull) of everything I could get my hands on while in a factory state.


    https://drive.google.com/file/d/13llpDmcNc5pyKbOIePn1hdDYxXd5iPeP/view?usp=sharing


    INTERESTING TIDBITS:
    * There is a "fastboot mode". Accessed by the usual "adb reboot fastboot" (still seeing what I can do with it)
    * After around 6m 30s, fastboot mode will automatically reboot the unit back into the OS. Fastboot activity MAY reset the idle timer, not sure yet.

    * There is NO "recovery mode". "adb reboot recovery" simply reboots the unit. May or may not be a recovery like most phones. Still digging.
    * Seems the bootloader is unlockable. I have not done it though. You can activate the "bootloader unlock" option in developer options.
    * To access Developer Options, you do the usual button mashing on "About", but to access the actual menu, you need a play store program that will take you directly to it.
    * The ONLY USB connection that USB debugging works on is USB1 --> Phone Link. For it to work, you need to change the "computer connection" to whatever the SECOND option is (I'm not translating it)
    * File down the very end, outer part of the wire harness clip, and it will go in all the way and latch like it's supposed it. Just needs to clear the casing by 1/16" or less. EASY FIX!


    If I find any more interesting things while I have this, I'll update the information here. If YOU decide to root yours, let me know how it goes. I don't have another $340 to spare to buy another one. I'm poor. lol
    1
    We you or anyone able to root this device?
    As far as I know, no one has rooted this device. Having bricked a much cheaper unit attempting root, I'm reluctant to be the first one to try on this one.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone