BOOTMOD - Root your Shield In 1 minute (2015, 2017, & 2019)

Search This thread
By:
Advanced…
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
@topbilal I decided to get the 2017 versions downloading today. I will get them flash ready and added to this thread when complete. It will take a few hours but I'll leave a comment on that thread when it's done. I'll try to get some modded boot's up too for 2017 on this thread after I finish that --note i cannot test these so it will be up to the community to do so.
 
Last edited:
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
Patched bootmods have been added for the 2017 16gb version of the shield. If anyone with one of these devices has the time to test, stock recovery images have been added here for the 2017, dev images too.

Need someone awesome to install stock 9.0.0, do not upgrade yet, run the bootmod patch, install magisk, and then go into the shield settings > About > and locate the upgrade. Select Download Only, do not install it yet.

When it is done you should be able to adb shell ls /data/ota_package and get your package zip name to adb pull for us. If you are able to and need any further guidance pm me.

-----sidenote

i noticed in patching the boots, the 2017 images use AVB 1.0 instead of 2.0 like on the 2019 pro. I theorize that is why the 2017 does not have the additional dtb and vbmeta partitions.
 
Last edited:
  • Like
Reactions: louforgiveno and tnomtlaw
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
I wanted to share something I discovered today that I didn't know about before and this deals with TWRP.

Today I rewrote a GUIDE going over how to install Lineage OS on the shield.

I noticed that TWRP when opened will then establish a root shell with the device named RECOVERY
2.png

So I adb shell ls and noticed that the contents /are not/ the same as what we see in a regular adb shell or in root exploring apps.
1.PNG
In fact, the view we are used to seeing is referred to as "system_root" as listed above. If you were to ls that, you would see your traditional filesystem layout.

So therefore I was not seeing the full picture before... There's files here I pulled that I hadn't read before, I have to sort between the leftover lineage garbage and what not but I will share the native file dump later.

This also makes me wonder if I was trying to flash the "roms" wrong for this device. Maybe a new approach would be to make a modified and preinstalled system_root that could be adb pushed.

Not sure just wanted to share

--edit have to select the MOUNT option in TWRP and then system + vendor to see the full picture, otherwise a lot of empty folders
 
Last edited:
  • Like
Reactions: xene1902, louforgiveno and tnomtlaw
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
will link a google drive entry with a bunch of crap when I am done exploring

Here's a text dump of some of the more interesting ones:
import /init.recovery.logd.rc
import /init.recovery.ldconfig.rc
import /init.recovery.mksh.rc
import /init.recovery.nano.rc
import /init.recovery.usb.rc
import /init.recovery.service.rc
import /init.recovery.vold_decrypt.rc
import /init.recovery.${ro.hardware}.rc

on early-init
# Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls.
write /sys/fs/selinux/checkreqprot 0

# Set the security context for the init process.
# This should occur before anything else (e.g. ueventd) is started.
setcon u:r:init:s0

# Set the security context of /postinstall if present.
restorecon /postinstall

# ueventd wants to write to /acct
mount cgroup none /acct cpuacct
mkdir /acct/uid

start ueventd

service set_permissive /sbin/permissive.sh
oneshot
seclabel u:r:recovery:s0

on init
export PATH /sbin:/system/bin
export LD_LIBRARY_PATH /sbin

export ANDROID_ROOT /system
export ANDROID_DATA /data
export EXTERNAL_STORAGE /sdcard

mkdir /system
mkdir /data
mkdir /cache
mkdir /sideload
mount tmpfs tmpfs /tmp

chown root shell /tmp
chmod 0775 /tmp

write /proc/sys/kernel/panic_on_oops 1
write /proc/sys/vm/max_map_count 1000000

on fs
mount pstore pstore /sys/fs/pstore
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000

on boot
ifup lo
hostname localhost
domainname localdomain

class_start default

# Load properties, pre-Android 6.0
on load_all_props_action
load_all_props

# Load properties, Android 6.0+
on load_system_props_action
load_system_props

# Load properties, Android 6.0+, vendor init lives here
on load_persist_props_action
load_persist_props

on firmware_mounts_complete
rm /dev/.booting

# Mount filesystems and start core system services.
on late-init
trigger early-fs
trigger fs
trigger post-fs
trigger post-fs-data

# Load properties, pre-Android 6.0
trigger load_all_props_action

# Load properties from /system/ + /factory after fs mount. Place
# this in another action so that the load will be scheduled after the prior
# issued fs triggers have completed.
trigger load_system_props_action

# Load properties, Android 6.0+, vendor init lives here
trigger load_persist_props_action

# Remove a file to wake up anything waiting for firmware
trigger firmware_mounts_complete

trigger early-boot
trigger boot

on property:sys.powerctl=*
powerctl ${sys.powerctl}

service ueventd /sbin/ueventd
critical
seclabel u:r:ueventd:s0

service adbd /sbin/adbd --root_seclabel=u:r:su:s0 --device_banner=recovery
disabled
socket adbd stream 660 system system
seclabel u:r:adbd:s0

# Always start adbd on userdebug and eng builds
on property:ro.debuggable=1
#write /sys/class/android_usb/android0/enable 1
#start adbd
setprop service.adb.root 1

# Restart adbd so it can run as root
on property:service.adb.root=1
write /sys/class/android_usb/android0/enable 0
restart adbd
write /sys/class/android_usb/android0/enable 1
on boot
write /sys/class/android_usb/android0/iSerial ${ro.serialno}
write /sys/class/android_usb/android0/iManufacturer ${ro.product.vendor.manufacturer}
write /sys/class/android_usb/android0/iProduct ${ro.product.model}

write /sys/class/android_usb/android0/f_rndis/manufacturer ${ro.product.vendor.manufacturer}
write /sys/class/android_usb/android0/f_rndis/vendorID ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/f_rndis/wceis 1

on fs
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000
write /sys/class/android_usb/android0/f_ffs/aliases adb

on property:sys.usb.config=mtp && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.mtp}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=mtp,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.mtp.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

#USB midi configuration
on property:sys.usb.config=midi && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.midi}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

#USB midi configuration, with adb
on property:sys.usb.config=midi,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.midi.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.rndis}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/bDeviceClass 224
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.rndis.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/bDeviceClass 0
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

# Profile for modem testing
on property:sys.usb.config=rndis,acm,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.rndis.acm.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/bDeviceClass 0
write /sys/class/android_usb/android0/f_acm/instances 2
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
#TODO: should this be a new product #
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.ptp}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
#TODO: should this be a new product #
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.ptp.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}
on property:sys.usb.config=none && property:sys.usb.configfs=1
write /config/usb_gadget/g1/UDC "none"
stop adbd
setprop sys.usb.ffs.ready 0
write /config/usb_gadget/g1/bDeviceClass 0
write /config/usb_gadget/g1/bDeviceSubClass 0
write /config/usb_gadget/g1/bDeviceProtocol 0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
rmdir /config/usb_gadget/g1/functions/rndis.gs4
setprop sys.usb.state ${sys.usb.config}

on property:init.svc.adbd=stopped
setprop sys.usb.ffs.ready 0

on property:sys.usb.config=adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "adb"
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=mtp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "mtp"
symlink /config/usb_gadget/g1/functions/mtp.gs0 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "mtp_adb"
symlink /config/usb_gadget/g1/functions/mtp.gs0 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ptp"
symlink /config/usb_gadget/g1/functions/ptp.gs1 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ptp_adb"
symlink /config/usb_gadget/g1/functions/ptp.gs1 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory_adb"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=audio_source && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "audiosource"
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "audiosource_adb"
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory,audio_source && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory_audiosource"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory,audio_source,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=accessory,audio_source,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory_audiosource_adb"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f2
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f3
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=midi && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "midi"
symlink /config/usb_gadget/g1/functions/midi.gs5 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=midi,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=midi,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "midi_adb"
symlink /config/usb_gadget/g1/functions/midi.gs5 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis && property:sys.usb.configfs=1
mkdir /config/usb_gadget/g1/functions/rndis.gs4
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "rndis"
symlink /config/usb_gadget/g1/functions/rndis.gs4 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
mkdir /config/usb_gadget/g1/functions/rndis.gs4
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "rndis_adb"
symlink /config/usb_gadget/g1/functions/rndis.gs4 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}
on boot
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mount configfs none /config
mkdir /config/usb_gadget/g1 0770 shell shell
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/bcdUSB 0x0200
mkdir /config/usb_gadget/g1/strings/0x409 0770
write /config/usb_gadget/g1/strings/0x409/serialnumber ${ro.serialno}
write /config/usb_gadget/g1/strings/0x409/manufacturer ${ro.product.vendor.manufacturer}
write /config/usb_gadget/g1/strings/0x409/product ${ro.product.vendor.model}
mkdir /config/usb_gadget/g1/functions/accessory.gs2
mkdir /config/usb_gadget/g1/functions/audio_source.gs2
mkdir /config/usb_gadget/g1/functions/ecm.ecm0
mkdir /config/usb_gadget/g1/functions/ffs.adb
mkdir /config/usb_gadget/g1/functions/mtp.gs0
mkdir /config/usb_gadget/g1/functions/ncm.ncm0
mkdir /config/usb_gadget/g1/functions/ptp.gs1
mkdir /config/usb_gadget/g1/functions/rndis.gs4
mkdir /config/usb_gadget/g1/configs/b.1 0777 shell shell
mkdir /config/usb_gadget/g1/configs/b.1/strings/0x409 0770 shell shell
write /config/usb_gadget/g1/configs/b.1/MaxPower 2
write /config/usb_gadget/g1/os_desc/b_vendor_code 1
write /config/usb_gadget/g1/os_desc/qw_sign "MSFT100"
symlink /config/usb_gadget/g1/configs/b.1 /config/usb_gadget/g1/os_desc/b.1
mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000

service adb_enable /vendor/bin/adbenable.sh
class core
user root
group root
oneshot

on property:sys.usb.config=none && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0

on property:sys.usb.config=mtp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/functions/mtp.gs0/os_desc/interface.MTP/compatible_id "MTP"
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.mtp}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/functions/mtp.gs0/os_desc/interface.MTP/compatible_id "MTP"
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.mtp.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.config=rndis && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.rndis}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.rndis.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0xEF
write /config/usb_gadget/g1/bDeviceSubClass 0x2
write /config/usb_gadget/g1/bDeviceProtocol 0x1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.config=ptp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ptp}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ptp.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# USB accessory configuration
on property:sys.usb.config=accessory && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x18d1
write /config/usb_gadget/g1/idProduct 0x2d00
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# USB accessory configuration, with adb
on property:sys.usb.ffs.ready=0 && property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x18d1
write /config/usb_gadget/g1/idProduct 0x2d01
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# audio accessory configuration, with adb
on property:sys.usb.ffs.ready=0 && property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.audio_source.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# ncm configuration
on property:sys.usb.config=ncm && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ncm.ncm0 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ncm}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ncm"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=ncm,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ncm,adb && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ncm.ncm0 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ncm.adb}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ncm_adb"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

# ecm configuration
on property:sys.usb.config=ecm && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ecm.ecm0 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ecm}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ecm"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=ecm,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ecm,adb && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ecm.ecm0 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ecm.adb}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ecm_adb"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}
firmware_directories /etc/firmware/ /odm/firmware/ /vendor/firmware/ /firmware/image/

subsystem adf
devname uevent_devname

subsystem graphics
devname uevent_devpath
dirname /dev/graphics

subsystem drm
devname uevent_devpath
dirname /dev/dri

subsystem oncrpc
devname uevent_devpath
dirname /dev/oncrpc

subsystem adsp
devname uevent_devpath
dirname /dev/adsp

subsystem msm_camera
devname uevent_devpath
dirname /dev/msm_camera

subsystem input
devname uevent_devpath
dirname /dev/input

subsystem mtd
devname uevent_devpath
dirname /dev/mtd

subsystem sound
devname uevent_devpath
dirname /dev/snd

# ueventd can only set permissions on device nodes and their associated
# sysfs attributes, not on arbitrary paths.
#
# format for /dev rules: devname mode uid gid
# format for /sys rules: nodename attr mode uid gid
# shortcut: "[email protected]" expands to "/dev/mtd/mtdNN"

/dev/null 0666 root root
/dev/zero 0666 root root
/dev/full 0666 root root
/dev/ptmx 0666 root root
/dev/tty 0666 root root
/dev/random 0666 root root
/dev/urandom 0666 root root
# Make HW RNG readable by group system to let EntropyMixer read it.
/dev/hw_random 0440 root system
/dev/ashmem 0666 root root
/dev/binder 0666 root root
/dev/hwbinder 0666 root root
/dev/vndbinder 0666 root root

/dev/pmsg0 0222 root log

# the msm hw3d client device node is world writable/readable.
/dev/msm_hw3dc 0666 root root

# gpu driver for adreno200 is globally accessible
/dev/kgsl 0666 root root

# kms driver for drm based gpu
/dev/dri/* 0666 root graphics

# these should not be world writable
/dev/diag 0660 radio radio
/dev/diag_arm9 0660 radio radio
/dev/ttyMSM0 0600 bluetooth bluetooth
/dev/uhid 0660 uhid uhid
/dev/uinput 0660 system bluetooth
/dev/alarm 0664 system radio
/dev/rtc0 0640 system system
/dev/tty0 0660 root system
/dev/graphics/* 0660 root graphics
/dev/msm_hw3dm 0660 system graphics
/dev/input/* 0660 root input
/dev/v4l-touch* 0660 root input
/dev/eac 0660 root audio
/dev/cam 0660 root camera
/dev/pmem 0660 system graphics
/dev/pmem_adsp* 0660 system audio
/dev/pmem_camera* 0660 system camera
/dev/oncrpc/* 0660 root system
/dev/adsp/* 0660 system audio
/dev/snd/* 0660 system audio
/dev/mt9t013 0660 system system
/dev/msm_camera/* 0660 system system
/dev/akm8976_daemon 0640 compass system
/dev/akm8976_aot 0640 compass system
/dev/akm8973_daemon 0640 compass system
/dev/akm8973_aot 0640 compass system
/dev/bma150 0640 compass system
/dev/cm3602 0640 compass system
/dev/akm8976_pffd 0640 compass system
/dev/lightsensor 0640 system system
/dev/msm_pcm_out* 0660 system audio
/dev/msm_pcm_in* 0660 system audio
/dev/msm_pcm_ctl* 0660 system audio
/dev/msm_snd* 0660 system audio
/dev/msm_mp3* 0660 system audio
/dev/audience_a1026* 0660 system audio
/dev/tpa2018d1* 0660 system audio
/dev/msm_audpre 0660 system audio
/dev/msm_audio_ctl 0660 system audio
/dev/htc-acoustic 0660 system audio
/dev/vdec 0660 system audio
/dev/q6venc 0660 system audio
/dev/snd/dsp 0660 system audio
/dev/snd/dsp1 0660 system audio
/dev/snd/mixer 0660 system audio
/dev/smd0 0640 radio radio
/dev/qmi 0640 radio radio
/dev/qmi0 0640 radio radio
/dev/qmi1 0640 radio radio
/dev/qmi2 0640 radio radio
/dev/bus/usb/* 0660 root usb
/dev/mtp_usb 0660 root mtp
/dev/usb_accessory 0660 root usb
/dev/tun 0660 system vpn

# CDMA radio interface MUX
/dev/ts0710mux* 0640 radio radio
/dev/ppp 0660 radio vpn

# sysfs properties
/sys/devices/platform/trusty.* trusty_version 0440 root log
/sys/devices/virtual/input/input* enable 0660 root input
/sys/devices/virtual/input/input* poll_delay 0660 root input
/sys/devices/virtual/usb_composite/* enable 0664 root system
/sys/devices/system/cpu/cpu* cpufreq/scaling_max_freq 0664 system system
/sys/devices/system/cpu/cpu* cpufreq/scaling_min_freq 0664 system system

# DVB API device nodes
/dev/dvb* 0660 root system
These entries seem useful for my adbd project, maybe it will be useful for the other projects going on

---side note
in the decompiled adbd binary, it is refering to a "log" that it is reading from to determine whether or not adb can be run as root. The init.rc script linked above talks about a logd.rc but it is not actually located in the root with the other files. Maybe it is hidden somewhere?
some more metions of logd from the init.rc located in /system_root/system/
1672324550617.png
1672431103524.png
 
Last edited:
Z

zzattack

Senior Member
May 24, 2009
104
13
Applied this approach to my 2019. AI upscaling doesn't appear to get blocked, but I can't say I've ever consciously seen it in action. Can't really get it to state that its actively upscaling any content however.

Unfortunately, any mention of dolby vision is removed from the display settings. There's no grayed out options either. Must have to do with the bootloader unlock. Anyone know if this can be restored by some zygisk, unsf, shamiko or magiskhide combination?
 
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
@zzattack zygisk and magiskhide were tried without any luck, unfortunately. " unsf, shamiko " I hadn't heard of these so not sure on that, maybe you can check for us? There's some folks working in the background dissembling and attempting to modify certain binaries (myself included but paused to work on other projects to learn more so i can contribute more here) but no new news as of yet. Just know folks are still looking into it and hopefully more news will be released in the future.
 
Last edited:
Z

zzattack

Senior Member
May 24, 2009
104
13
UNSF is just universal safety net fix. Shamiko is similar but from Chinese origin and to me a little vague in how it works.
Just now I'm noticing the rooted shield does not wake from standby either. Remote remains off and the only way to get it out of sleep is a power cycle. That's kind of a deal-breaker. Anyone else experience this?
 
  • Like
Reactions: xene1902
D

dib_

Member
Jan 22, 2023
8
0
Is there any troubleshooting guide? I think I flashed the bootmod.img fine but now ADB doesn't connect at the bootloader menu

adb: error: failed to get feature set: no devices/emulators found

And rebooting the Shield it says "Your devices software can't be checked for corruption. Please lock the bootloader." and hangs at the NVIDIA screen. Do I start all this over from scratch?
 
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
@dib_ adb needs the adbd binary modified, that is being worked on. The bootloader screen is normal. Because your bootloader is unlocked. If you are completely stuck there just flash the stock firmware back, and honestly I would suggest you stay on stock until the community makes more progress.

This is where the device is at. Magisk works, modules work, stock apps work. No upscaler, no adb root (adb itself works), no dolby vision, all being worked on.

We can always use more people able to help troubleshoot and work on things like the upscaler, adbd, etc, but this method isn't perfect. It just works better than the dev root images from nvidia minus the adb limitations

@zzattack the sleep trouble haven't heard of.
 
Last edited:
D

dib_

Member
Jan 22, 2023
8
0
I think I made progress, I installed a firmware from scratch because I don't think the patched one here was compatible with what I had on the machine, even though it said the same version.
 
Last edited:
Manzing

Manzing

Senior Member
Oct 8, 2012
243
103
Hi, thanks @jenneh for your tutorial. I just got a 2017 Shield TV and flashed 8.2.3 stock version, then successfully rooted it with your instructions.
I just cannot install safety net package in Magisk as I am unable to select the file, I can't understand why. Using remote or controller, no way to move selection in any folder... only an empty "recent files" screen is displayed.
Is there any other way to do it ? Don't really want to install TWRP for it.
I managed to dump the OTA file, it should be 9.1 version as displayed on ATV.

In my case it was located in /data/data/com.nvidia.ota/app_download/ (for 8.2.3 version)
With 9.1+ version, OTA package is located in /data/ota_package

Do you want the untouched boot.img ?

I can upload it somewhere if you like.
 
Last edited:
  • Love
Reactions: jenneh
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
Manzing said:
Hi, thanks @jenneh
I just cannot install safety net package in Magisk as I am unable to select the file, I can't understand why. Using remote or controller, no way to move selection in any folder... only an empty "recent files" screen is displayed.
Is there any other way to do it ?
Click to expand...
Click to collapse
For me personally I always had to use a mouse to be able to select the correct downloads folder. It's inconvenient but it is the only way I know of. (Plug in mouse, go to the menu on the left and somewhere in there you click on Download folder and you can access and install your modules.. idk what it is with magisk going to a different dl folder?)

I would absolutely love a copy of the 9.1 I really appreciate your time! You are amazing :DDDD

PS Thank You for Providing us the Pathing for the OTA on the 2017 that is so helpful;
 
  • Like
Reactions: Manzing
Manzing

Manzing

Senior Member
Oct 8, 2012
243
103
jenneh said:
For me personally I always had to use a mouse to be able to select the correct downloads folder. It's inconvenient but it is the only way I know of. (Plug in mouse, go to the menu on the left and somewhere in there you click on Download folder and you can access and install your modules.. idk what it is with magisk going to a different dl folder?)

I would absolutely love a copy of the 9.1 I really appreciate your time! You are amazing :DDDD

PS Thank You for Providing us the Pathing for the OTA on the 2017 that is so helpful;
Click to expand...
Click to collapse

Thanks, I solved my issue with the following adb command :
Code: 
adb shell pm uninstall -k --user 0 com.android.documentsui
It removed the android's stock file app and then Magisk asked for another file manager to load the file.
EDIT : I don't recommend to do this as it will cause some issue, please use a USB mouse as suggested by Jenneh.
With a decent file manager it is much better :)

I sent you a MP with a link for 9.1 boot.img.
 
Last edited:
  • Love
Reactions: jenneh
F

fonicmaxxim

New member
Feb 2, 2023
3
1
This seems quite interesting, but I wonder what one would actually do with root on the Shield TV. I know this allows for full access to everything, but what can I really do with that, i.e. what are the use cases?

I would mainly be interested in debloating the stock firmware (i.e. remove unneeded apps like Plex, Google Music, telemetry stuff, ...). Has anyone done that? Also, is there a way to improve the stock's performance and make it less laggy?
 
jenneh

jenneh

Senior Member
Mar 26, 2014
744
511
Razer Phone 2
Nvidia Shield TV & TV Pro (2019)
@fonicmaxxim Some things you can do on root as opposed to stock include the ability to pull system files that would normally not be pullable and sometimes not even readable. This also allows you to adb shell ls (view contents) of the file system.

Why this matters is it helps you to see the whole picture of the apks, files, and what not running in the background that you may indeed play around with and remove. That may be hidden otherwise.

So on Stock Root or the Dev Root you may dd the system partition to the sdcard (or any partition to the sd) and then adb pull it so you have a backup and a visual guide (think of it like the gui version of the adb shell ls XD)

Having this visual reference on my main pc makes it easier on me to see what folders / files I want to try to remove.

Removing things is easy in android, rm -R insert/path/here

So you can make a script on the side to test things like make a batch full of items to delete and test and see if you broke anything. Or you can adb shell and rm one by one, the choice is yours!

If you did break something, then no worries because you already pulled the system files, you could adb push them back, and if you Really broke things you can always just flash back. Nvidia did a really good job sandboxing us so we can't do anything to where we can't flash back.

an example -- haven't tried removing this yet
adb shell rm -R system/vendor/app/QuadDSecurityService

Working on a script that I can share and explain in further detail later just in the middle of a project with kali linux arm on the phone. Was able to get it running beautifully thanks to mr david bomball haha. It is a fantastic project to help learn linux if anyone is interested. Lots of little problems to solve, terminal using, and well, just fun~! see here note it is not for the faint of heart and takes up lots of time and space. PS this Will Not work on the shield as is, would have to figure out how to get it to go on external storage.
 
Last edited:
  • Like
Reactions: Manzing, fonicmaxxim and louforgiveno
Manzing

Manzing

Senior Member
Oct 8, 2012
243
103
fonicmaxxim said:
This seems quite interesting, but I wonder what one would actually do with root on the Shield TV. I know this allows for full access to everything, but what can I really do with that, i.e. what are the use cases?

I would mainly be interested in debloating the stock firmware (i.e. remove unneeded apps like Plex, Google Music, telemetry stuff, ...). Has anyone done that? Also, is there a way to improve the stock's performance and make it less laggy?
Click to expand...
Click to collapse

If you just want to clean your system without risk, you can enable USB debugging in developer options (usng network is more practical as you don't have to plug a cable)
Then using ADB you disable all the package you don't need.

For example, I stick to the 8.2.3 version and I don't want to be bothered by the com.nvidia.ota app keeping telling me the 9.1 update is available. So I disabled it. You can re-enable it if necessary.
Be careful to know what you're doing and double check the name of the package you want to disable by checking the app properties (the package name is displayed) before proceeding.

you have some info here:

How To Disable Any System App Bloatware On Android Without Root (xda-developers.com)

If you are sure, you can uninstall the app.
 
  • Like
Reactions: fonicmaxxim and jenneh
F

fonicmaxxim

New member
Feb 2, 2023
3
1
@jenneh That's kind of what I meant: root on the Shield is certainly very interesting from a developer's view, but is it also useful for normal users? One thing I could think of would be disabling/remapping that damned Netflix button for good (Button Mapper kind of works for that, but not reliably).

@Manzing Thanks, good advice, I'll look into that!
 
  • Like
Reactions: jenneh
You must log in or register to reply here.

Similar threads

jenneh
Root Nvidia Shield TV Pro 2019 Version
Replies
103
Views
31K
jenneh
jenneh
M
How to Root and install Magisk on NSTV 2019 Pro v8.2.0
Replies
94
Views
21K
M
mrhamed
jenneh
2015, 2017, & 2019 Nvidia Shield TV Firmware Repo & Source Code Repo
Replies
42
Views
9K
jenneh
jenneh
T
HOWTO: Install developer image for 2019 shield tv pro !READ WARNING!
Replies
3
Views
5K
elliwigy
elliwigy
M
How to skip(bypass) Google sign-in NSTV Pro 2019 with any firmware versions!
Replies
29
Views
6K
P
Peternvidia

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 1
    S
    Starz04
    legend0s said:
    Thanks for your reply!


    I don't like all the launcher apps. So, i hope that it is possible to disable the discover tab and/or disable the ads in the future.

    PS:
    I have the 2019 version.
    Click to expand...
    Click to collapse
    Hello mate. it is actually possible to downgrade Shield 2019 to OS 8.2.3. I used this guide and it worked flawlessly: https://florisse.nl/shield/

    Obviously huge thanks to the guy who created it as it saves people so much research and trial + error. Basically alot of time saved.

    Using this tweak guide, I've deleted close to everything from google and Nvidia (bloatware + data collecting) on the 2019 Shield TV: https://florisse.nl/shield-tweaks/

    I've removed the Play Store and Google Play Services, ATV Core Services, ATV Remote Service, Backdrop, Basic Daydreams, Chromecast and many other things.

    I don't use Netflix, Amazon Prime Video, Plex etc. So everything was removed from the Shield.

    This is my ADB batch file to uninstall pretty much everything unneeded:

    Code: 
    adb shell pm uninstall -k --user 0 com.google.android.speech.pumpkin & adb shell pm uninstall -k --user 0 com.google.android.tts & adb shell pm uninstall -k --user 0 com.google.android.videos & adb shell pm uninstall -k --user 0 com.google.android.tvrecommendations & adb shell pm uninstall -k --user 0 com.google.android.syncadapters.calendar & adb shell pm uninstall -k --user 0 com.google.android.backuptransport & adb shell pm uninstall -k --user 0 com.google.android.partnersetup & adb shell pm uninstall -k --user 0 com.google.android.inputmethod.korean & adb shell pm uninstall -k --user 0 com.google.android.inputmethod.pinyin & adb shell pm uninstall -k --user 0 com.google.android.apps.inputmethod.zhuyin & adb shell pm uninstall -k --user 0 com.google.android.tv & adb shell pm uninstall -k --user 0 com.google.android.tv.frameworkpackagestubs & adb shell pm uninstall -k --user 0 com.google.android.tv.bugreportsender & adb shell pm uninstall -k --user 0 com.google.android.backdrop & adb shell pm uninstall -k --user 0 com.google.android.leanbacklauncher.recommendations & adb shell pm uninstall -k --user 0 com.google.android.feedback & adb shell pm uninstall -k --user 0 com.google.android.leanbacklauncher & adb shell pm uninstall -k --user 0 com.google.android.apps.mediashell & adb shell pm uninstall -k --user 0 com.plexapp.android & adb shell pm uninstall -k --user 0 com.zattoo.player & adb shell pm uninstall -k --user 0 com.nvidia.tegrazone3 & adb shell pm uninstall -k --user 0 com.plexapp.mediaserver.smb & adb shell pm uninstall -k --user 0 com.google.android.play.games & adb shell pm uninstall -k --user 0 com.netflix.ninja & adb shell pm uninstall -k --user 0 com.amazon.amazonvideo.livingroom & adb shell pm uninstall -k --user 0 com.amazon.amazonvideo.livingroom.nvidia & adb shell pm uninstall -k --user 0 com.google.android.youtube.tvmusic & adb shell pm uninstall -k --user 0 com.android.vending & adb shell pm uninstall -k --user 0 com.google.android.gms

    Keep in mind this is an extensive removal of pretty much everything. Payed apps etc. wont work with such cleanup. Most apps however do work- Kodi, Firefox, SmartTube, Speedtest, Fdroid, AdAware, Aurora Store (with private login, if you want to update some apps), Aptoide, Twitch, all sorts of Emulators etc.

    The thing is that Google Play Store automaticall updates itself in the background, even if you disable it (it gets reenabled automatically) and I dont need that. If I want to update something, I will go to Aurora Store or Aptoide and update manually, but I dont want some sheety apps to be doing whatever they want in the background without asking.

    And I didnt install a 3rd party Android Launcher, I use the default one, there are no more ads though after removing like 80% of trash bloatware and adware. The Android TV Home version is 2.1.3-320113730-f and I'm on ShieldOS 8.2.3. No ads to be seen and since even the Nvidia-OTA service was removed, it will never update the Shield by itself or even show a notification that there are updates available- which is exactly how I want it. Everything I need works fine in 8.2.3 and if I ever need an update, I will do it manually.

    Also, while we're at it- it is possible to skip the initial login after factory restore, as seen on the picture attached. Source of it is: https://www.reddit.com/r/ShieldAndroidTV/comments/o8tpkx
    However it is actually not required to downgrade Android TV Home app to version 2.0.10 to remove ads from the home screen. By simply downgrading to ShieldOS 8.2.3 (down from 9.1.1), the ads were removed from the main screen automatically. Then if you do some additional cleanup (like removing ATV Core Services and disabling autoupdate for Apps in Google Play Store), the ads will never show up.
    View
    1
    L
    legend0s
    legend0s said:
    Wow!

    Amazing news!!

    I will give it a try in the next few days.

    Can't wait to downgrade to 8.2.3!

    Thanks for the info! (-;

    Best regards from germany
    Click to expand...
    Click to collapse
    I downgraded my shield 2019 Pro to 8.2.3 today.

    Really easy and absolutely flawlessly! (-:

    Thanks for this magic!!!!

    Best regards!
    View
  • 9
    jenneh
    jenneh
    Hello Friends~!

    We now have a working method to achieve ROOT on STOCK Firmware!

    A script has been made that can boot your shield into the bootloader, erase the old boot, flash the new boot, and install your choice of Magisk apk for you. The script is also able to revert you back to the stock boot image if needed.

    Takes only a minute or two depending if you already have adb installed, fastboot drivers setup, and bootloader unlocked. (The guide will walk you through this if you are new)

    Rooting Your Shield Will Break AI Upscaling and Dolby Vision. You /Cannot/ Lock the bootloader while rooted, you can only Lock the bootloader when you have the stock boot Image installed. This tool simply makes it easier to "Root" and to Revert back to Stock when done, so you can use your AI Enhanced Features again.

    HOW TO ROOT:

    If you are already running the STOCK firmware version you want to ROOT, Skip to step 2.
    You can check your currently installed firmware on the shield by going into Settings, selecting About, then scroll to the bottom.
    9.png

    You will see a section called SHIELD Android TV SW Version, this will show your installed FW

    STEP 1:
    Select a STOCK firmware from this THREAD, and fully install it.

    STEP 2:
    Download the BOOT MOD that correlates to your installed STOCK firmware.
    If you want to build your own "Boot Mod" the instructions are HERE

    9.1.1mods.zip

    drive.google.com drive.google.com

    9.1mods.zip

    drive.google.com drive.google.com

    9.0.0mods.zip

    drive.google.com drive.google.com

    8.2.3mods.zip

    drive.google.com drive.google.com
    Special Thanks to @Manzing for obtaining the 9.1 and 9.1.1 images for us!

    9.1.1mods2017.zip

    drive.google.com drive.google.com

    9.1mods2017.zip

    drive.google.com drive.google.com

    9.0.0mods2017.zip

    drive.google.com drive.google.com

    8.2.3mods2017.zip

    drive.google.com drive.google.com
    Special thanks to @I_did_it_just_tmrrow for taking the time to download from gameworks, patch with magisk, and install the 2015 version, and verified it works HERE as well as they verified the hashes were the same for the boot.img of the 500gb and 16gb boot.img

    9.0.0-2015-MODS.zip

    drive.google.com drive.google.com
    If you want me to add more, let me know.

    STEP 3:
    Make sure you have usb debugging enabled in settings and your shield is ON.
    This adds an additional Minute to setup time 😊😊😊

    Attach a USB-C cable to your shield and plug it into your PC.
    (Use the USB port furthest away from the HDMI Cable)
    7.png

    Go into settings, select device preferences

    8.png


    Select About, then hit the build number 7 times
    9.png


    Back out to device preferences and now select developer options
    10.png


    Then enable USB debugging and Network debugging.
    11.png


    Here's a way to install adb quickly using powershell and chocolatey.

    Open powershell as admin and copy and paste these two lines, one line at a time:
    Code: 
    Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

choco install adb

    That's it!

    Note the ip address and in a terminal on your computer, connect to this ip address.

    Example: adb connect 192.168.0.10:5555
    12.png

    This will prompt the shield to allow for a connection, say yes.

    STEP 4:
    Run your choice of .bootmod, .deltamodonly, or .magiskmodonly. MORE INFO
    Simple 1 min demo:

    How to use the new .bootmod script:

    After Enabling USB Debugging and Wireless debugging, then adb connecting to your device, run the .bootmod script

    SYSTEM MENU.PNG

    If you did everything correctly, your device should be listed, and you may proceed by pressing 1 and enter.

    If you forgot to adb connect you may now do so with option 3, just type in your Shield's IP address.
    ipadd.PNG


    After you select 1 on the main menu, the script will then reboot your device into the bootloader and will wait for you to press a key so the script can run fastboot devices to verify that your device has posted.

    fastboot.PNG

    Wait to press any key until you see your shield's lights come on and then you hear the window's chime on your computer. (see 0:16 in the video) Then Press 1 if your device is listed like above.
    Run option 2 again, in case the script went too fast or you hit a key too quickly.

    If your device is still not showing, make sure you have unlocked the bootloader and installed the fastboot drivers for your device.

    DOWNLOAD:

    Shield Drivers.zip

    drive.google.com drive.google.com

    Now open Device Manager and follow the steps below:
    1.png
    2.PNG
    3.PNG
    4.PNG
    5.PNG
    NOTE THAT UNLOCKING YOUR BOOTLOADER WILL ERASE ALL DATA ON THE DEVICE!

    The shield should now be at the bootloader menu, simply select unlock bootloader
    6.PNG

    flash.PNG

    Now you can select which boot mod you would prefer. The script will erase the old boot image, flash the new one, reset, then the script will pause for us.

    6.png

    When your shield has fully rebooted and is on the main menu, you can press any key in the terminal and the script will finish the magisk installation for us by installing the apk to the device.

    apk.PNG

    If you accidentally pressed a button too quickly, you can always access the apk menu to adb install the Magisk apk.

    FULL RUNDOWN OF V2 CHANGES

    Remember that you can always revert back to the Stock Boot Image and Lock your bootloader (again you can only lock it with a Stock boot flashed) to get your AI Upscaler and Dolby Vision working again when you are done with Root.

    STEP 5:
    Now Opening Magisk will trigger this alert:
    MAGISK APKINSTALL.jpg


    Select OK and after the reboot, your Magisk of Choice will be fully installed!

    6.jpg


    You will now have Root and still be able to use apps and features that you shouldn't be able to. Normally with root (or at least on the Dev Rooted Images) we cannot install Disney +, but as you see, we Sure Can Now~! ;-)

    IF YOUR PLAYSTORE IS MISSING APPS, SEE THIS POST. REQUIRES MAGISK DELTA
    SOURCE CODE --- You may repurpose / share this as you see fit.

    DELTAMODONLY.BAT
    Code: 
    fastboot erase boot
fastboot flash boot bootmod2.img
fastboot reboot

    MAGISKMODONLY.BAT
    Code: 
    fastboot erase boot
fastboot flash boot bootmod1.img
fastboot reboot

    BOOTMOD.BAT ---- There is unused code, the :UNLOCK code will be removed later, it didn't work how I would have liked in testing and I forgot to remove it. It isn't harming anything right now so will remove it with the next update.
    Code: 
    @echo off
title [BOOTMOD]
color 0A
if "%1" neq "" ( goto %1)

:MENU
cls
echo BOOTMOD -- Version 2
echo =========================================
adb devices
echo =========================================
echo 1. Enter Bootloader Menu for Mod Flashing
echo 2. Enter APK Menu
echo 3. ADB Connect
echo 4. Reboot to System
echo 5. HELP
echo 6. EXIT BOOTMOD
echo =========================================
set /p answer= Please Enter your Selection:
if %answer%==1 goto BOOTLOADER
if %answer%==2 goto APK
if %answer%==3 goto ADB
if %answer%==4 goto REBOOT
if %answer%==5 goto HELP
if %answer%==6 goto EXIT
:ADB
cls
set /p answer= Type in SHIELD IP Address:
adb connect %answer%
goto MENU
 
:APK
cls
echo ===========
echo APK MENU
echo ===========
echo 1. Magisk by TopJohnWu
echo 2. Magisk Delta fork by HuskyDG
echo 3. Return to Main Menu
echo ================================
set /p answer= Please Enter your Selection:
if %answer%==1 goto MAGISKAPK
if %answer%==2 goto DELTAAPK
if %answer%==3 goto MENU

:MAGISKAPK
adb install magisk.apk
goto MENU

:DELTAAPK
adb install delta.apk
goto MENU

:HELP
cls
echo Adb must be installed on the computer and USB debugging must be enabled on the Shield.
echo You will need the Fastboot USB drivers installed on your PC.
echo Check the GUIDE on XDA for more help.
echo LINK: https://forum.xda-developers.com/t/bootmod-root-your-shield-in-1-minute-2015-2017-2019.4524873/
echo =====================================================================================
set /p answer=Press 1 to return to Main Menu:
if %answer%==1 goto MENU

:UNLOCK
cls
fastboot oem unlock
echo ==============================================================
echo Use your shield to select yes. Then press any key to continue
echo ==============================================================
pause
set /p answer=Press 1 to Enter Flash Menu or 2 to return to Main Menu:
if %answer%==1 goto FLASH
if %answer%==2 goto MENU

:BOOTLOADER
cls
adb reboot bootloader
pause
cls
echo =====================================================
fastboot devices
echo =====================================================
echo Is your device listed above?
echo =====================================================
set /p answer=Press 1 for yes or 2 for no or 3 for Help:
if %answer%==1 goto FLASH
if %answer%==2 goto BOOTLOADER
if %answer%==3 goto HELP

:FLASH
cls
echo How would you like to flash your boot today? Do you want to include:
echo ====================================================================
echo 1. TopJohnWu's Magisk
echo 2. HuskyDG's Magisk Delta
echo 3. Revert Back To Stock Boot Image
echo 4. Reboot Shield to System
echo 5. Return to Main Menu
echo ====================================
set /p answer=Select a number and press enter:
if %answer%==1 goto MAGISK
if %answer%==2 goto DELTA
if %answer%==3 goto STOCK
if %answer%==4 goto REBOOT
if %answer%==5 goto MENU                                                                                 

:MAGISK
cls
fastboot erase boot
fastboot flash boot bootmod1.img
fastboot reboot
echo =====================================
echo Wait for your Shield to fully Reboot.
echo =====================================
pause
adb install magisk.apk
goto MENU

:DELTA
cls
fastboot erase boot
fastboot flash boot bootmod2.img
fastboot reboot
echo =====================================
echo Wait for your Shield to fully Reboot.
echo =====================================
pause
adb install delta.apk
goto MENU

:STOCK
cls
fastboot erase boot
fastboot flash boot boot.img
echo ================================================================================
echo REMEMBER TO LOCK YOUR BOOTLOADER FOR AI UPSCALING AND DOLBY VISION FUNCTIONALITY
echo ================================================================================
echo 1. Reboot Shield to the System
echo 2. Return to Main Menu
echo =========================
set /p answer=Enter your selection:
if %answer%==1 goto REBOOT
if %answer%==2 goto MENU

:REBOOT
fastboot reboot
goto MENU

:EXIT
exit /b
    Here are the sources for the Magisk apk's and their respective projects, used in making the boot mods.

    Topjohnwu's Magisk APK Direct Download Link (v25.2):

    Github Project Page:

    GitHub - topjohnwu/Magisk: The Magic Mask for Android

    The Magic Mask for Android. Contribute to...
    github.com github.com

    HuskyDG's Forked version of Magisk "Delta" Direct Download Link:

    Github Project Page:

    GitHub - HuskyDG/magisk-files

    Contribute to HuskyDG/magisk-files development...
    github.com github.com

    All original boot images come from NVIDIA's Gameworks:

    Gameworks Download Center

    Get the latest Gameworks software for your...
    developer.nvidia.com developer.nvidia.com
    SPECIAL THANKS TO OUR FRIENDS IN THE XDA COMMUNITY <333
    Thank you to @topjohnwu for making Magisk
    @huskydg For making the forked magisk with magiskhide enabled and other features
    @nooted1 for teaching us about the magisk variant "delta" that has magiskhide still configured inside the apk
    @ajolly for their efforts in educating us about safetynet modules that can be used within magisk
    @louforgiveno for their efforts in reverse engineering apks, determining that it would be better to clear data in the google playstore instead of cache, and providing excellent feedback on pretty much every step of the way.
    @abc1054 for testing the ai upscaler and teaching me how to even use the silly thing.
    @Zer0_rulz for testing the upscaler and teaching us about link2sd and providing a useful idea for studies, to "freeze apps" as opposed to straight deletion in tests. I will use both methods in the future!
    @pinvok3 for their script they made to teach us how to more efficiently locate the apps tied to the ai upscaler and determining the "tvsettings.apk" to potentially be culpable in jailing our upscaler. They also taught me about the dolby vision feature on the shield
    @Renate for allowing me to bother her in the AVB thread while I try to learn how to talk to people like her. haha
    @Manzing for stepping up and being the hero we needed for the 2017 shield community! They were able to locate the correct pathing for the OTA Firmware as well as provide us the stock 9.1 boot and complete OTA!!
    @I_did_it_just_tmrrow For taking the time to verify magisk is able to indeed patch the 2015 version of the Shield HERE and more so they explained the boot images provided on gameworks for the 2015 version have the same hash, therefore a patched boot will work on both the 16gb and 500gb models. Thank you!

    AI UPSCALER FIX:
    THERE'S SOME TROUBLE WITH THE UPSCALER STILL, THE COMMUNITY IS WORKING TOGETHER IN THE COMMENTS BELOW
    Please note that patching the boot with Magisk causes problems like the AI upscaler and Dolby vision being unavailable. You may want to wait for updates unless you have a reason to root with stock but otherwise feel free to join us in troubleshooting!

    NOTE THAT THIS METHOD REQUIRES A FIX SO ONE COULD RUN ADB AS ROOT OUTSIDE OF THE SHELL. (adb shell su works, but not adb root outside of shell) Trying to mod this binary. Bare with me

    Verified Working on the Shield:

    [GUIDE][NO-ROOT] How to install Ubuntu and other Linux Distros on Your Phone or Android TV Box, using Termux

    NOTICE: THIS METHOD IS ONLY FOR NON ROOTED...
    forum.xda-developers.com forum.xda-developers.com
    View
    3
    jenneh
    jenneh
    I wanted to share something I discovered today that I didn't know about before and this deals with TWRP.

    Today I rewrote a GUIDE going over how to install Lineage OS on the shield.

    I noticed that TWRP when opened will then establish a root shell with the device named RECOVERY
    2.png

    So I adb shell ls and noticed that the contents /are not/ the same as what we see in a regular adb shell or in root exploring apps.
    1.PNG
    In fact, the view we are used to seeing is referred to as "system_root" as listed above. If you were to ls that, you would see your traditional filesystem layout.

    So therefore I was not seeing the full picture before... There's files here I pulled that I hadn't read before, I have to sort between the leftover lineage garbage and what not but I will share the native file dump later.

    This also makes me wonder if I was trying to flash the "roms" wrong for this device. Maybe a new approach would be to make a modified and preinstalled system_root that could be adb pushed.

    Not sure just wanted to share

    --edit have to select the MOUNT option in TWRP and then system + vendor to see the full picture, otherwise a lot of empty folders
    View
    3
    P
    pinvok3
    I'm using 8.2.3. The newer 9 versions seem kind of sluggish. But the script should work on 9 regardless.

    Lastly "Or we lost some kind of DRM keys during the boot unlocking phase." Is this something we can obtain with a serial UART or JTAG adapter? I just got mine in and am not afraid to break the shield open here in a few days if there's something that could be obtained and shared there. I am new to all this so I appreciate everyone sharing the things
    Click to expand...
    Click to collapse
    Sorry I have no idea. I've never worked on Android before and I've spent like 30 minutes on this. :D

    Jtag is usually lower level stuff and I'm pretty sure it's undocumented. If it exists even.
    I just remember, that on a previous phone (Sony Xperia) the drm keys were wiped once you unlock the bootloader, resulting in worse Camera image quality.

    Considering that the upscale works correctly after unroot/relocking, I guess this would only be a soft lock. But still could be registered in the hardware somewhere, where we have no access to. Maybe it's still patchable though.
    View
    3
    jenneh
    jenneh
    @pinvok3 Gosh WOW just wow! Thank You for your Amazing Share!! I will absolutely follow your advice and I will get that app pulled now to poke around.

    Are you rolling 8.2.3 or one of the 9's btw??

    Lastly "Or we lost some kind of DRM keys during the boot unlocking phase." Is this something we can obtain with a serial UART or JTAG adapter? I just got mine in and am not afraid to break the shield open here in a few days if there's something that could be obtained and shared there. I am new to all this so I appreciate everyone sharing the things
    View
    3
    P
    pinvok3
    Okay, I'm grasping straws right now, but my shield just crashed after I have started a movie with Dolby Vision enabled. Can someone confirm if Dolby Vision is grayed out (unavailable) on rooted devices but available on nonrooted ones? After this fix I was able to enable Dolby Vision but my system just died with this log:

    12-20 23:12:18.951 3725 3839 E WindowManager: Exception checking for game stream. Exception: android.content.pm.PackageManager$NameNotFoundException: ComponentInfo{com.android.tv.settings/.MainSettings}
    12-20 23:12:18.951 3725 3839 I InputDispatcher: Dropped event because of pending overdue app switch.
    12-20 23:12:18.953 3725 3864 E AudioService: Audioserver died.
    12-20 23:12:18.982 4578 5347 D DolbyAudioService: IMs12 implementation died... Restoring settings after restart
    12-20 23:12:18.983 4578 5347 D DolbyAudioService: Attempting to connect to IMs12
    12-20 23:12:18.992 4578 12382 I DolbyAudioService: Waiting 1 second before attempting to connect to IMs12...
    12-20 23:12:19.037 12385 12385 D audiohalservicemsd: main() Starting [email protected] from vendor/dolby.
    12-20 23:12:19.050 12385 12385 D : Calling decrypt_blob. err(0)
    12-20 23:12:19.056 3432 3432 E Ipprotectd: decrypt_blob: Error during launch operation. err(0xffff0011)
    12-20 23:12:19.056 3432 3432 E Ipprotectd: Error occurred at decryption. err(ffff0011)
    12-20 23:12:19.058 12385 12385 E : Decryption failed
    12-20 23:12:19.058 12385 12385 E : decrypt_blob failed! err(0)
    12-20 23:12:19.058 12385 12385 E : Failed to decrypt.
    12-20 23:12:19.058 12385 12385 E : Failed decrypt .text section.
    12-20 23:12:19.059 12385 12385 F libc : Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x4ec98e90 in tid 12385 (android.hardwar), pid 12385 (android.hardwar)
    12-20 23:12:19.062 12384 12384 I ServiceManagement: Removing namespace from process name [email protected] to [email protected].
    Click to expand...
    Click to collapse

    It seems like some encrypted communication fails which takes the whole system with it. It makes me more suspicious that the bootloader unlock removes/hides/blocks some DRM keys required for AI/Dolby Audio to work. If we could somehow hook into the bootloader unlocking phase to see what's happening ..
    View

New posts