[TOOL] BOOTMOD - For Flashing Root and Stock Images, Automatic APK Installation, APK Removal, File Pushing, File Pulling, and More. (All Models)

Search This thread
By:
Advanced…
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
@topbilal I decided to get the 2017 versions downloading today. I will get them flash ready and added to this thread when complete. It will take a few hours but I'll leave a comment on that thread when it's done. I'll try to get some modded boot's up too for 2017 on this thread after I finish that --note i cannot test these so it will be up to the community to do so.
 
Last edited:
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
Patched bootmods have been added for the 2017 16gb version of the shield. If anyone with one of these devices has the time to test, stock recovery images have been added here for the 2017, dev images too.

Need someone awesome to install stock 9.0.0, do not upgrade yet, run the bootmod patch, install magisk, and then go into the shield settings > About > and locate the upgrade. Select Download Only, do not install it yet.

When it is done you should be able to adb shell ls /data/ota_package and get your package zip name to adb pull for us. If you are able to and need any further guidance pm me.

-----sidenote

i noticed in patching the boots, the 2017 images use AVB 1.0 instead of 2.0 like on the 2019 pro. I theorize that is why the 2017 does not have the additional dtb and vbmeta partitions.
 
Last edited:
  • Like
Reactions: louforgiveno and tnomtlaw
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
I wanted to share something I discovered today that I didn't know about before and this deals with TWRP.

Today I rewrote a GUIDE going over how to install Lineage OS on the shield.

I noticed that TWRP when opened will then establish a root shell with the device named RECOVERY
2.png

So I adb shell ls and noticed that the contents /are not/ the same as what we see in a regular adb shell or in root exploring apps.
1.PNG
In fact, the view we are used to seeing is referred to as "system_root" as listed above. If you were to ls that, you would see your traditional filesystem layout.

So therefore I was not seeing the full picture before... There's files here I pulled that I hadn't read before, I have to sort between the leftover lineage garbage and what not but I will share the native file dump later.

This also makes me wonder if I was trying to flash the "roms" wrong for this device. Maybe a new approach would be to make a modified and preinstalled system_root that could be adb pushed.

Not sure just wanted to share

--edit have to select the MOUNT option in TWRP and then system + vendor to see the full picture, otherwise a lot of empty folders
 
Last edited:
  • Like
Reactions: xene1902, louforgiveno and tnomtlaw
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
will link a google drive entry with a bunch of crap when I am done exploring

Here's a text dump of some of the more interesting ones:
import /init.recovery.logd.rc
import /init.recovery.ldconfig.rc
import /init.recovery.mksh.rc
import /init.recovery.nano.rc
import /init.recovery.usb.rc
import /init.recovery.service.rc
import /init.recovery.vold_decrypt.rc
import /init.recovery.${ro.hardware}.rc

on early-init
# Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls.
write /sys/fs/selinux/checkreqprot 0

# Set the security context for the init process.
# This should occur before anything else (e.g. ueventd) is started.
setcon u:r:init:s0

# Set the security context of /postinstall if present.
restorecon /postinstall

# ueventd wants to write to /acct
mount cgroup none /acct cpuacct
mkdir /acct/uid

start ueventd

service set_permissive /sbin/permissive.sh
oneshot
seclabel u:r:recovery:s0

on init
export PATH /sbin:/system/bin
export LD_LIBRARY_PATH /sbin

export ANDROID_ROOT /system
export ANDROID_DATA /data
export EXTERNAL_STORAGE /sdcard

mkdir /system
mkdir /data
mkdir /cache
mkdir /sideload
mount tmpfs tmpfs /tmp

chown root shell /tmp
chmod 0775 /tmp

write /proc/sys/kernel/panic_on_oops 1
write /proc/sys/vm/max_map_count 1000000

on fs
mount pstore pstore /sys/fs/pstore
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000

on boot
ifup lo
hostname localhost
domainname localdomain

class_start default

# Load properties, pre-Android 6.0
on load_all_props_action
load_all_props

# Load properties, Android 6.0+
on load_system_props_action
load_system_props

# Load properties, Android 6.0+, vendor init lives here
on load_persist_props_action
load_persist_props

on firmware_mounts_complete
rm /dev/.booting

# Mount filesystems and start core system services.
on late-init
trigger early-fs
trigger fs
trigger post-fs
trigger post-fs-data

# Load properties, pre-Android 6.0
trigger load_all_props_action

# Load properties from /system/ + /factory after fs mount. Place
# this in another action so that the load will be scheduled after the prior
# issued fs triggers have completed.
trigger load_system_props_action

# Load properties, Android 6.0+, vendor init lives here
trigger load_persist_props_action

# Remove a file to wake up anything waiting for firmware
trigger firmware_mounts_complete

trigger early-boot
trigger boot

on property:sys.powerctl=*
powerctl ${sys.powerctl}

service ueventd /sbin/ueventd
critical
seclabel u:r:ueventd:s0

service adbd /sbin/adbd --root_seclabel=u:r:su:s0 --device_banner=recovery
disabled
socket adbd stream 660 system system
seclabel u:r:adbd:s0

# Always start adbd on userdebug and eng builds
on property:ro.debuggable=1
#write /sys/class/android_usb/android0/enable 1
#start adbd
setprop service.adb.root 1

# Restart adbd so it can run as root
on property:service.adb.root=1
write /sys/class/android_usb/android0/enable 0
restart adbd
write /sys/class/android_usb/android0/enable 1
on boot
write /sys/class/android_usb/android0/iSerial ${ro.serialno}
write /sys/class/android_usb/android0/iManufacturer ${ro.product.vendor.manufacturer}
write /sys/class/android_usb/android0/iProduct ${ro.product.model}

write /sys/class/android_usb/android0/f_rndis/manufacturer ${ro.product.vendor.manufacturer}
write /sys/class/android_usb/android0/f_rndis/vendorID ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/f_rndis/wceis 1

on fs
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000
write /sys/class/android_usb/android0/f_ffs/aliases adb

on property:sys.usb.config=mtp && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.mtp}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=mtp,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.mtp.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

#USB midi configuration
on property:sys.usb.config=midi && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.midi}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

#USB midi configuration, with adb
on property:sys.usb.config=midi,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.midi.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.rndis}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/bDeviceClass 224
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.rndis.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/bDeviceClass 0
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

# Profile for modem testing
on property:sys.usb.config=rndis,acm,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.rndis.acm.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/bDeviceClass 0
write /sys/class/android_usb/android0/f_acm/instances 2
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
#TODO: should this be a new product #
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.ptp}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp,adb && property:sys.usb.configfs=0
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor ${ro.vendor.nv.usb.vid}
#TODO: should this be a new product #
write /sys/class/android_usb/android0/idProduct ${ro.vendor.nv.usb.pid.ptp.adb}
write /sys/class/android_usb/android0/functions ${sys.usb.config}
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}
on property:sys.usb.config=none && property:sys.usb.configfs=1
write /config/usb_gadget/g1/UDC "none"
stop adbd
setprop sys.usb.ffs.ready 0
write /config/usb_gadget/g1/bDeviceClass 0
write /config/usb_gadget/g1/bDeviceSubClass 0
write /config/usb_gadget/g1/bDeviceProtocol 0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
rmdir /config/usb_gadget/g1/functions/rndis.gs4
setprop sys.usb.state ${sys.usb.config}

on property:init.svc.adbd=stopped
setprop sys.usb.ffs.ready 0

on property:sys.usb.config=adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "adb"
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=mtp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "mtp"
symlink /config/usb_gadget/g1/functions/mtp.gs0 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "mtp_adb"
symlink /config/usb_gadget/g1/functions/mtp.gs0 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ptp"
symlink /config/usb_gadget/g1/functions/ptp.gs1 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ptp_adb"
symlink /config/usb_gadget/g1/functions/ptp.gs1 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory_adb"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=audio_source && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "audiosource"
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "audiosource_adb"
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory,audio_source && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory_audiosource"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=accessory,audio_source,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=accessory,audio_source,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "accessory_audiosource_adb"
symlink /config/usb_gadget/g1/functions/accessory.gs2 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/audio_source.gs3 /config/usb_gadget/g1/configs/b.1/f2
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f3
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=midi && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "midi"
symlink /config/usb_gadget/g1/functions/midi.gs5 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=midi,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=midi,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "midi_adb"
symlink /config/usb_gadget/g1/functions/midi.gs5 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis && property:sys.usb.configfs=1
mkdir /config/usb_gadget/g1/functions/rndis.gs4
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "rndis"
symlink /config/usb_gadget/g1/functions/rndis.gs4 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
mkdir /config/usb_gadget/g1/functions/rndis.gs4
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "rndis_adb"
symlink /config/usb_gadget/g1/functions/rndis.gs4 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}
on boot
mkdir /dev/usb-ffs 0770 shell shell
mkdir /dev/usb-ffs/adb 0770 shell shell
mount configfs none /config
mkdir /config/usb_gadget/g1 0770 shell shell
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/bcdUSB 0x0200
mkdir /config/usb_gadget/g1/strings/0x409 0770
write /config/usb_gadget/g1/strings/0x409/serialnumber ${ro.serialno}
write /config/usb_gadget/g1/strings/0x409/manufacturer ${ro.product.vendor.manufacturer}
write /config/usb_gadget/g1/strings/0x409/product ${ro.product.vendor.model}
mkdir /config/usb_gadget/g1/functions/accessory.gs2
mkdir /config/usb_gadget/g1/functions/audio_source.gs2
mkdir /config/usb_gadget/g1/functions/ecm.ecm0
mkdir /config/usb_gadget/g1/functions/ffs.adb
mkdir /config/usb_gadget/g1/functions/mtp.gs0
mkdir /config/usb_gadget/g1/functions/ncm.ncm0
mkdir /config/usb_gadget/g1/functions/ptp.gs1
mkdir /config/usb_gadget/g1/functions/rndis.gs4
mkdir /config/usb_gadget/g1/configs/b.1 0777 shell shell
mkdir /config/usb_gadget/g1/configs/b.1/strings/0x409 0770 shell shell
write /config/usb_gadget/g1/configs/b.1/MaxPower 2
write /config/usb_gadget/g1/os_desc/b_vendor_code 1
write /config/usb_gadget/g1/os_desc/qw_sign "MSFT100"
symlink /config/usb_gadget/g1/configs/b.1 /config/usb_gadget/g1/os_desc/b.1
mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000

service adb_enable /vendor/bin/adbenable.sh
class core
user root
group root
oneshot

on property:sys.usb.config=none && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0

on property:sys.usb.config=mtp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/functions/mtp.gs0/os_desc/interface.MTP/compatible_id "MTP"
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.mtp}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=mtp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/functions/mtp.gs0/os_desc/interface.MTP/compatible_id "MTP"
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.mtp.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.config=rndis && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.rndis}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=rndis,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.rndis.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0xEF
write /config/usb_gadget/g1/bDeviceSubClass 0x2
write /config/usb_gadget/g1/bDeviceProtocol 0x1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.config=ptp && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ptp}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ptp,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 1
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ptp.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# USB accessory configuration
on property:sys.usb.config=accessory && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x18d1
write /config/usb_gadget/g1/idProduct 0x2d00
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# USB accessory configuration, with adb
on property:sys.usb.ffs.ready=0 && property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=accessory,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x18d1
write /config/usb_gadget/g1/idProduct 0x2d01
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# audio accessory configuration, with adb
on property:sys.usb.ffs.ready=0 && property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=audio_source,adb && property:sys.usb.configfs=1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.audio_source.adb}
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xc0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3

# ncm configuration
on property:sys.usb.config=ncm && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ncm.ncm0 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ncm}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ncm"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=ncm,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ncm,adb && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ncm.ncm0 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ncm.adb}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ncm_adb"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

# ecm configuration
on property:sys.usb.config=ecm && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ecm.ecm0 /config/usb_gadget/g1/configs/b.1/f1
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ecm}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ecm"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}

on property:sys.usb.ffs.ready=0 && property:sys.usb.config=ecm,adb && property:sys.usb.configfs=1
start adbd

on property:sys.usb.ffs.ready=1 && property:sys.usb.config=ecm,adb && property:sys.usb.configfs=1
rm /config/usb_gadget/g1/configs/b.1/f1
rm /config/usb_gadget/g1/configs/b.1/f2
rm /config/usb_gadget/g1/configs/b.1/f3
symlink /config/usb_gadget/g1/functions/ecm.ecm0 /config/usb_gadget/g1/configs/b.1/f1
symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f2
write /config/usb_gadget/g1/os_desc/use 0
write /config/usb_gadget/g1/idVendor 0x${ro.vendor.nv.usb.vid}
write /config/usb_gadget/g1/idProduct 0x${ro.vendor.nv.usb.pid.ecm.adb}
write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "ecm_adb"
write /config/usb_gadget/g1/configs/b.1/bmAttributes 0xe0
write /config/usb_gadget/g1/bDeviceClass 0x0
write /config/usb_gadget/g1/bDeviceSubClass 0x0
write /config/usb_gadget/g1/bDeviceProtocol 0x0
write /config/usb_gadget/g1/UDC ${sys.usb.controller}
setprop sys.usb.state ${sys.usb.config}
firmware_directories /etc/firmware/ /odm/firmware/ /vendor/firmware/ /firmware/image/

subsystem adf
devname uevent_devname

subsystem graphics
devname uevent_devpath
dirname /dev/graphics

subsystem drm
devname uevent_devpath
dirname /dev/dri

subsystem oncrpc
devname uevent_devpath
dirname /dev/oncrpc

subsystem adsp
devname uevent_devpath
dirname /dev/adsp

subsystem msm_camera
devname uevent_devpath
dirname /dev/msm_camera

subsystem input
devname uevent_devpath
dirname /dev/input

subsystem mtd
devname uevent_devpath
dirname /dev/mtd

subsystem sound
devname uevent_devpath
dirname /dev/snd

# ueventd can only set permissions on device nodes and their associated
# sysfs attributes, not on arbitrary paths.
#
# format for /dev rules: devname mode uid gid
# format for /sys rules: nodename attr mode uid gid
# shortcut: "mtd@NN" expands to "/dev/mtd/mtdNN"

/dev/null 0666 root root
/dev/zero 0666 root root
/dev/full 0666 root root
/dev/ptmx 0666 root root
/dev/tty 0666 root root
/dev/random 0666 root root
/dev/urandom 0666 root root
# Make HW RNG readable by group system to let EntropyMixer read it.
/dev/hw_random 0440 root system
/dev/ashmem 0666 root root
/dev/binder 0666 root root
/dev/hwbinder 0666 root root
/dev/vndbinder 0666 root root

/dev/pmsg0 0222 root log

# the msm hw3d client device node is world writable/readable.
/dev/msm_hw3dc 0666 root root

# gpu driver for adreno200 is globally accessible
/dev/kgsl 0666 root root

# kms driver for drm based gpu
/dev/dri/* 0666 root graphics

# these should not be world writable
/dev/diag 0660 radio radio
/dev/diag_arm9 0660 radio radio
/dev/ttyMSM0 0600 bluetooth bluetooth
/dev/uhid 0660 uhid uhid
/dev/uinput 0660 system bluetooth
/dev/alarm 0664 system radio
/dev/rtc0 0640 system system
/dev/tty0 0660 root system
/dev/graphics/* 0660 root graphics
/dev/msm_hw3dm 0660 system graphics
/dev/input/* 0660 root input
/dev/v4l-touch* 0660 root input
/dev/eac 0660 root audio
/dev/cam 0660 root camera
/dev/pmem 0660 system graphics
/dev/pmem_adsp* 0660 system audio
/dev/pmem_camera* 0660 system camera
/dev/oncrpc/* 0660 root system
/dev/adsp/* 0660 system audio
/dev/snd/* 0660 system audio
/dev/mt9t013 0660 system system
/dev/msm_camera/* 0660 system system
/dev/akm8976_daemon 0640 compass system
/dev/akm8976_aot 0640 compass system
/dev/akm8973_daemon 0640 compass system
/dev/akm8973_aot 0640 compass system
/dev/bma150 0640 compass system
/dev/cm3602 0640 compass system
/dev/akm8976_pffd 0640 compass system
/dev/lightsensor 0640 system system
/dev/msm_pcm_out* 0660 system audio
/dev/msm_pcm_in* 0660 system audio
/dev/msm_pcm_ctl* 0660 system audio
/dev/msm_snd* 0660 system audio
/dev/msm_mp3* 0660 system audio
/dev/audience_a1026* 0660 system audio
/dev/tpa2018d1* 0660 system audio
/dev/msm_audpre 0660 system audio
/dev/msm_audio_ctl 0660 system audio
/dev/htc-acoustic 0660 system audio
/dev/vdec 0660 system audio
/dev/q6venc 0660 system audio
/dev/snd/dsp 0660 system audio
/dev/snd/dsp1 0660 system audio
/dev/snd/mixer 0660 system audio
/dev/smd0 0640 radio radio
/dev/qmi 0640 radio radio
/dev/qmi0 0640 radio radio
/dev/qmi1 0640 radio radio
/dev/qmi2 0640 radio radio
/dev/bus/usb/* 0660 root usb
/dev/mtp_usb 0660 root mtp
/dev/usb_accessory 0660 root usb
/dev/tun 0660 system vpn

# CDMA radio interface MUX
/dev/ts0710mux* 0640 radio radio
/dev/ppp 0660 radio vpn

# sysfs properties
/sys/devices/platform/trusty.* trusty_version 0440 root log
/sys/devices/virtual/input/input* enable 0660 root input
/sys/devices/virtual/input/input* poll_delay 0660 root input
/sys/devices/virtual/usb_composite/* enable 0664 root system
/sys/devices/system/cpu/cpu* cpufreq/scaling_max_freq 0664 system system
/sys/devices/system/cpu/cpu* cpufreq/scaling_min_freq 0664 system system

# DVB API device nodes
/dev/dvb* 0660 root system
These entries seem useful for my adbd project, maybe it will be useful for the other projects going on

---side note
in the decompiled adbd binary, it is refering to a "log" that it is reading from to determine whether or not adb can be run as root. The init.rc script linked above talks about a logd.rc but it is not actually located in the root with the other files. Maybe it is hidden somewhere?
some more metions of logd from the init.rc located in /system_root/system/
1672324550617.png
1672431103524.png
 
Last edited:
Z

zzattack

Senior Member
May 24, 2009
107
15
Applied this approach to my 2019. AI upscaling doesn't appear to get blocked, but I can't say I've ever consciously seen it in action. Can't really get it to state that its actively upscaling any content however.

Unfortunately, any mention of dolby vision is removed from the display settings. There's no grayed out options either. Must have to do with the bootloader unlock. Anyone know if this can be restored by some zygisk, unsf, shamiko or magiskhide combination?
 
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
@zzattack zygisk and magiskhide were tried without any luck, unfortunately. " unsf, shamiko " I hadn't heard of these so not sure on that, maybe you can check for us? There's some folks working in the background dissembling and attempting to modify certain binaries (myself included but paused to work on other projects to learn more so i can contribute more here) but no new news as of yet. Just know folks are still looking into it and hopefully more news will be released in the future.
 
Last edited:
Z

zzattack

Senior Member
May 24, 2009
107
15
UNSF is just universal safety net fix. Shamiko is similar but from Chinese origin and to me a little vague in how it works.
Just now I'm noticing the rooted shield does not wake from standby either. Remote remains off and the only way to get it out of sleep is a power cycle. That's kind of a deal-breaker. Anyone else experience this?
 
  • Like
Reactions: xene1902
D

dib_

Member
Jan 22, 2023
8
0
Is there any troubleshooting guide? I think I flashed the bootmod.img fine but now ADB doesn't connect at the bootloader menu

adb: error: failed to get feature set: no devices/emulators found

And rebooting the Shield it says "Your devices software can't be checked for corruption. Please lock the bootloader." and hangs at the NVIDIA screen. Do I start all this over from scratch?
 
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
@dib_ adb needs the adbd binary modified, that is being worked on. The bootloader screen is normal. Because your bootloader is unlocked. If you are completely stuck there just flash the stock firmware back, and honestly I would suggest you stay on stock until the community makes more progress.

This is where the device is at. Magisk works, modules work, stock apps work. No upscaler, no adb root (adb itself works), no dolby vision, all being worked on.

We can always use more people able to help troubleshoot and work on things like the upscaler, adbd, etc, but this method isn't perfect. It just works better than the dev root images from nvidia minus the adb limitations

@zzattack the sleep trouble haven't heard of.
 
Last edited:
D

dib_

Member
Jan 22, 2023
8
0
I think I made progress, I installed a firmware from scratch because I don't think the patched one here was compatible with what I had on the machine, even though it said the same version.
 
Last edited:
Manzing

Manzing

Senior Member
Oct 8, 2012
243
104
Hi, thanks @jenneh for your tutorial. I just got a 2017 Shield TV and flashed 8.2.3 stock version, then successfully rooted it with your instructions.
I just cannot install safety net package in Magisk as I am unable to select the file, I can't understand why. Using remote or controller, no way to move selection in any folder... only an empty "recent files" screen is displayed.
Is there any other way to do it ? Don't really want to install TWRP for it.
I managed to dump the OTA file, it should be 9.1 version as displayed on ATV.

In my case it was located in /data/data/com.nvidia.ota/app_download/ (for 8.2.3 version)
With 9.1+ version, OTA package is located in /data/ota_package

Do you want the untouched boot.img ?

I can upload it somewhere if you like.
 
Last edited:
  • Love
Reactions: jenneh
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
Manzing said:
Hi, thanks @jenneh
I just cannot install safety net package in Magisk as I am unable to select the file, I can't understand why. Using remote or controller, no way to move selection in any folder... only an empty "recent files" screen is displayed.
Is there any other way to do it ?
Click to expand...
Click to collapse
For me personally I always had to use a mouse to be able to select the correct downloads folder. It's inconvenient but it is the only way I know of. (Plug in mouse, go to the menu on the left and somewhere in there you click on Download folder and you can access and install your modules.. idk what it is with magisk going to a different dl folder?)

I would absolutely love a copy of the 9.1 I really appreciate your time! You are amazing :DDDD

PS Thank You for Providing us the Pathing for the OTA on the 2017 that is so helpful;
 
  • Like
Reactions: Manzing
Manzing

Manzing

Senior Member
Oct 8, 2012
243
104
jenneh said:
For me personally I always had to use a mouse to be able to select the correct downloads folder. It's inconvenient but it is the only way I know of. (Plug in mouse, go to the menu on the left and somewhere in there you click on Download folder and you can access and install your modules.. idk what it is with magisk going to a different dl folder?)

I would absolutely love a copy of the 9.1 I really appreciate your time! You are amazing :DDDD

PS Thank You for Providing us the Pathing for the OTA on the 2017 that is so helpful;
Click to expand...
Click to collapse

Thanks, I solved my issue with the following adb command :
Code: 
adb shell pm uninstall -k --user 0 com.android.documentsui
It removed the android's stock file app and then Magisk asked for another file manager to load the file.
EDIT : I don't recommend to do this as it will cause some issue, please use a USB mouse as suggested by Jenneh.
With a decent file manager it is much better :)

I sent you a MP with a link for 9.1 boot.img.
 
Last edited:
  • Love
Reactions: jenneh
F

fonicmaxxim

New member
Feb 2, 2023
3
1
This seems quite interesting, but I wonder what one would actually do with root on the Shield TV. I know this allows for full access to everything, but what can I really do with that, i.e. what are the use cases?

I would mainly be interested in debloating the stock firmware (i.e. remove unneeded apps like Plex, Google Music, telemetry stuff, ...). Has anyone done that? Also, is there a way to improve the stock's performance and make it less laggy?
 
jenneh

jenneh

Senior Member
Mar 26, 2014
793
610
Nvidia Shield TV & TV Pro (2019)
Google Pixel 8 Pro
@fonicmaxxim Some things you can do on root as opposed to stock include the ability to pull system files that would normally not be pullable and sometimes not even readable. This also allows you to adb shell ls (view contents) of the file system.

Why this matters is it helps you to see the whole picture of the apks, files, and what not running in the background that you may indeed play around with and remove. That may be hidden otherwise.

So on Stock Root or the Dev Root you may dd the system partition to the sdcard (or any partition to the sd) and then adb pull it so you have a backup and a visual guide (think of it like the gui version of the adb shell ls XD)

Having this visual reference on my main pc makes it easier on me to see what folders / files I want to try to remove.

Removing things is easy in android, rm -R insert/path/here

So you can make a script on the side to test things like make a batch full of items to delete and test and see if you broke anything. Or you can adb shell and rm one by one, the choice is yours!

If you did break something, then no worries because you already pulled the system files, you could adb push them back, and if you Really broke things you can always just flash back. Nvidia did a really good job sandboxing us so we can't do anything to where we can't flash back.

an example -- haven't tried removing this yet
adb shell rm -R system/vendor/app/QuadDSecurityService

Working on a script that I can share and explain in further detail later just in the middle of a project with kali linux arm on the phone. Was able to get it running beautifully thanks to mr david bomball haha. It is a fantastic project to help learn linux if anyone is interested. Lots of little problems to solve, terminal using, and well, just fun~! see here note it is not for the faint of heart and takes up lots of time and space. PS this Will Not work on the shield as is, would have to figure out how to get it to go on external storage.
 
Last edited:
  • Like
Reactions: Manzing, fonicmaxxim and louforgiveno
Manzing

Manzing

Senior Member
Oct 8, 2012
243
104
fonicmaxxim said:
This seems quite interesting, but I wonder what one would actually do with root on the Shield TV. I know this allows for full access to everything, but what can I really do with that, i.e. what are the use cases?

I would mainly be interested in debloating the stock firmware (i.e. remove unneeded apps like Plex, Google Music, telemetry stuff, ...). Has anyone done that? Also, is there a way to improve the stock's performance and make it less laggy?
Click to expand...
Click to collapse

If you just want to clean your system without risk, you can enable USB debugging in developer options (usng network is more practical as you don't have to plug a cable)
Then using ADB you disable all the package you don't need.

For example, I stick to the 8.2.3 version and I don't want to be bothered by the com.nvidia.ota app keeping telling me the 9.1 update is available. So I disabled it. You can re-enable it if necessary.
Be careful to know what you're doing and double check the name of the package you want to disable by checking the app properties (the package name is displayed) before proceeding.

you have some info here:

How To Disable Any System App Bloatware On Android Without Root (xda-developers.com)

If you are sure, you can uninstall the app.
 
  • Like
Reactions: fonicmaxxim and jenneh
F

fonicmaxxim

New member
Feb 2, 2023
3
1
@jenneh That's kind of what I meant: root on the Shield is certainly very interesting from a developer's view, but is it also useful for normal users? One thing I could think of would be disabling/remapping that damned Netflix button for good (Button Mapper kind of works for that, but not reliably).

@Manzing Thanks, good advice, I'll look into that!
 
  • Like
Reactions: jenneh
You must log in or register to reply here.

Similar threads

jenneh
Root Nvidia Shield TV Pro 2019 Version
Replies
104
Views
41K
H
Holdor
jenneh
2015, 2017, & 2019 Nvidia Shield TV Firmware Repo & Source Code Repo
Replies
50
Views
19K
jenneh
jenneh
M
How to Root and install Magisk on NSTV 2019 Pro v8.2.0
Replies
94
Views
23K
M
mrhamed
Jubeldum
Possible Hope for a Nvidia Shield TV (2024) since Nintendo Switch Sequel rumored for 2024?
Replies
0
Views
5K
Jubeldum
Jubeldum
T
HOWTO: Install developer image for 2019 shield tv pro !READ WARNING!
Replies
3
Views
6K
elliwigy
elliwigy

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 1
    codezjx
    codezjx
    Great tools and easy to use, thansk!
    Works on Shield TV 2017, OS version: 9.1.1
    View
    1
    G
    grievous2004
    jenneh said:
    Hi,

    Sorry for not responding sooner, I was hoping to be able to have an answer to your previous question when building the update, but I ran into complications personally in trying to edit the build.prop using the stock root. This Post offers hope that one could edit their props in order to gain functionality but the trouble is the system is read/only with this stock root. A developer root would over come this, but I am more interested in how @Jdorman12 edited their props? Hopefully this will notify them? I know there are magisk modules available, but if @Jdorman12 can let us know if their 8.2.2 was stock root or developer root, and whether they used modules or what exactly they used to edit the props, that would be tremendously helpful.

    I am personally just trying to get the update done for BOOTMOD for both the 2017 and 2019 versions and then I need to update another thread before I can try to figure out the build.prop edits, but will definitely try to confirm sooner if we hear back!
    Click to expand...
    Click to collapse
    Hi,

    thanks a lot for all the hard work and support!

    Concerning the read/only issue, what I usually do is booting into TWRP recovery (without flashing it) and then you're able to mount the system partition. Maybe it's overkill but it works (at least on the 2015 model) :)

    Has anyone actually tested the build prop edits? I don't own a Shield tv model with upscaling and I cannot justify upgrading if the feature is broken with unlocked bootloader.

    Btw, I own a 2015 16GB model and created patched boot images for 9.0, 9.1 and 9.1.1, let me know if you still need them, I can share (but reading the OP it looks like you just got one yourself).
    View
    1
    downie154
    downie154
    Thank you so much for your advice it has really been so helpful. I managed to get Nvidia shield back up and running.
    would you know is there a way to get the full play store active on the shield 2017. the android tv store is limited . it sucks .

    jenneh said:
    View attachment 6093931
    This is normal when the device is in the bootloader menu. This is just telling us that you are still running an adb server and are still connected with your shield, but since the device is in the bootloader menu, it will say it is offline.

    This second image View attachment 6093932
    Shows that you successfully erased the boot image and were able to flash whatever boot image you selected. The error shown at the end is normal, it will appear for everyone, or at least it does for me on all 4 of my shields, all different models, its like the reset goes through too fast for fastboot to post whatever the developers initially intended for it to show. So, I know you mentioned something about fastboot not showing in your device manager, but if you didn't have your drivers installed, then this picture would not be possible, it would present a different error that would tell you no device found, waiting for device. So as far as I can tell you should be set, as soon as you flash the correct boot image. If for some reason you were on a firmware other than 8.2.3, 9, 9.1, or 9.1.1, then you may need to reflash to either 8.2.3 or 9 and if you choose you can update your fw to 9.1.1 and then run bootmod again.

    The 2017 firmwares are available here and on nvidias gameworks site https://xdaforums.com/t/2015-2017-2019-nvidia-shield-tv-firmware-repo-source-code-repo.4495713/
    Click to expand...
    Click to collapse
    View
    1
    downie154
    downie154
    jenneh said:
    That's a great question. I can't look into it for a few days but I'll try to see what all is possible there and shoot you a comment when I know better
    Click to expand...
    Click to collapse
    Thank you for going out of your way to help me. its very much appreciated
    View
  • 17
    jenneh
    jenneh
    Hello Friends,

    Today I am releasing a tool called BOOTMOD, that is able to help users to easily root their Nvidia Shield (all models). This tool is a single executable that contains everything you need to gain a stock root and more. (Adb, fastboot, the usb drivers). Note that you do not need to be rooted to make use of BOOTMOD'S adb features like the no-code automatic apk installation, non-system apk uninstallation, file pushing, file pulling, and opening an adb shell.

    The first time you run BOOTMOD, it will automatically build everything it needs in C:\BOOTMOD. It will then open an adb server for you, load the main menu, then display your connected device. When you close BOOTMOD, it will automatically kill the adb server for us, ensuring no servers are left running. The guide below will show you the rest of the features.

    WARNINGS!!
    Rooting your Shield will break AI Upscaling and Dolby Vision. . Also please be warned that you will lose data any time you go to unlock and relock the bootloader. Basically an auto factory reset will occur when you lock/ unlock, but you can flash the boot images /without/ data loss. (If you know how to fix the AI Upscaler feature, please share!! I had no luck with any of the previously mentioned methods but will continue trying)

    Before you proceed, you will need to connect your Shield to your PC using a usb cable, and have usb debugging enabled on your Shield. Here is a video of this step if you need it.

    You will also need to know what firmware version you are running. Here is a video of this step if you need it.

    1-main-menu.png

    Start with option 0 to download the latest Magisk apk and / or TWRP.
    2-dl-magisk.png


    If you want to download TRWP, you are able to press ctrl + c and click on the link to immediately open it in a browser.
    3-dl-twrp.png


    Here is a video of this step if you need it.
    When you select option 1, the Shield will reboot into the bootloader menu for us. It is at this point that you may unlock your bootloader if you haven't done so already. Unlocking or relocking your bootloader /will/ result in data loss. Last warning, if you do have to unlock your bootloader, you will need to close BOOTMOD after starting the unlock, make sure the shield reboots afterwards,, then sign back into the Shield, and setup usb debugging again. Then you can proceed as normal by running BOOTMOD and selecting this option again.
    6.PNG


    Once your bootloader is unlocked, you may select the firmware version for your Shield. Here is a video of this step if you need it.
    4-root-stock-flash.png


    Then select if you are flashing root or going back to stock.
    5-choice.png


    If your device is not showing at this part, and you have not installed the fastboot drivers, run option 3 for help. Then you may run option 2 again and your device should be showing in the list.
    6-fastboot-devices.png

    When you select option 3, it will open device manager for you, along with instructions on how to add the drivers located in C:\BOOTMOD\BIN to your fastboot device. Here is a video of this step if you need it.

    WRITTEN INSTRUCTIONS:

    In device manager, under "Other devices", right-click the fastboot device. Select update driver. Select browse my computer, then browse to C:\\BOOTMOD\\BIN. Then Select "let me pick from a list of available drivers on my PC. Select "Show All Devices", then select next. Select "have disk", "browse", and open android_winusb.inf. Press "OK". Lastly, select "Android Bootloader Interface" and say yes to the update driver warning. When you are done, you will have a new device "Android Phone" with the Android Bootloader Interface registered to it. You may now close device manager and proceed with your flash.

    Once your device shows in the list and you run option 1, BOOTMOD will erase the stock boot and flash the rooted boot image for us. (Please note there is no data loss during this process. Only data loss is with locking/unlocking the bootloader). Wait for your Shield to fully reboot then press any key to install the magisk apk to the shield. (When the autoplay message appears, your device is ready.)
    FLASHMOD.png


    Then you will need to proceed to open Magisk on the Shield in Settings, under apps. Here is a video of this step if you need it.
    When you select option 2, the Shield will reboot into the bootloader menu for us. It is at this point that you may unlock your bootloader if you haven't done so already. Unlocking or relocking your bootloader /will/ result in data loss. Last warning, if you do have to unlock your bootloader, you will need to close BOOTMOD after starting the unlock, make sure the shield reboots afterwards,, then sign back into the Shield, and setup usb debugging again. Then you can proceed as normal by running BOOTMOD and selecting this option again.
    6.PNG


    Your Shield's device id will not be displayed the first time in the TWRP menu of BOOTMOD, because the Shield has to boot into the bootloader first. Wait for the Shield to boot into the bootloader (you will hear Windows make a chime at this point) then run option 2 to verify your Shield is posting. If it isn't posting and you haven't installed your fastboot drivers, run option 3 then 2 again when complete.

    1707493760225.png

    When you select option 3, it will open device manager for you, along with instructions on how to add the drivers located in C:\BOOTMOD\BIN to your fastboot device. Here is a video of this step if you need it.

    WRITTEN INSTRUCTIONS:

    In device manager, under "Other devices", right-click the fastboot device. Select update driver. Select browse my computer, then browse to C:\\BOOTMOD\\BIN. Then Select "let me pick from a list of available drivers on my PC. Select "Show All Devices", then select next. Select "have disk", "browse", and open android_winusb.inf. Press "OK". Lastly, select "Android Bootloader Interface" and say yes to the update driver warning. When you are done, you will have a new device "Android Phone" with the Android Bootloader Interface registered to it. You may now close device manager and proceed with your flash.

    When your device is showing, and you run option 1, the Shield will immediately boot into TWRP. You will then have access to the Recovery adb shell in BOOTMOD (using option 8).
    twrp.png


    Here is a video of this step if you need it.
    This is just an escape in case one accidentally gets stuck in the bootloader menu. It sends a simple fastboot reboot to push the Shield back to system.
    Option 4 will immediately and automatically install any apk file you have placed inside of C:\BOOTMOD\APKS.
    9-apk-menu.png


    Here is a video of this step if you need it.
    When you run option 5, you will be presented with a list of all of the apks installed on your Shield. You are able to remove any non system app by double left clicking on the item to highlight the line, right click once to copy the line, then right click once again to paste. As long as the package is not a system app, it will immediately remove the selected app for you. Type the word back to exit the menu.
    1707236549063.png


    Here is a video of this step if you need it.
    Running option 6 gives you the ability to push any files in C:\BOOTMOD\PUSH to your Shield. Either immediately to the sdcard/Download folder, or the user's choice.
    10-push-menu.png


    Here is a video of this step if you need it.
    Running option 7 allows you to pull all files individually from sdcard/Download, not just the whole folder. The user may choose to download any file or folder as well. The pulled items will be located in C:\BOOTMOD\PULL
    11-pull-menu.png


    Here is a video of this step if you need it.
    Running option 8 will open an adb shell in a new window. You are able to use su after you have installed Magisk. Remember to grant the shell su in Magisk.There will be a popup you need to accept on the Shield the first time you run su.
    1707236985631.png


    Here is a video of this step if you need it.
    SPECIAL THANKS TO OUR FRIENDS IN THE XDA COMMUNITY <333
    Here is a video of the credits if you would like to see it.
    Thank you to @topjohnwu for making Magisk
    @nooted1 for teaching us about the magisk variant "delta" that has magiskhide still configured inside the apk
    @ajolly for their efforts in educating us about safetynet modules that can be used within magisk
    @louforgiveno for their efforts in reverse engineering apks, determining that it would be better to clear data in the google playstore instead of cache, and providing excellent feedback on pretty much every step of the way.
    @abc1054 for testing the ai upscaler and teaching me how to even use the silly thing.
    @Zer0_rulz for testing the upscaler and teaching us about link2sd and providing a useful idea for studies, to "freeze apps" as opposed to straight deletion in tests. I will use both methods in the future!
    @pinvok3 for their script they made to teach us how to more efficiently locate the apps tied to the ai upscaler and determining the "tvsettings.apk" to potentially be culpable in jailing our upscaler. They also taught me about the dolby vision feature on the shield
    @Renate for allowing me to bother her in the AVB thread while I try to learn how to talk to people like her. haha
    @Manzing for stepping up and being the hero we needed for the 2017 shield community! They were able to locate the correct pathing for the OTA Firmware as well as provide us the stock 9.1 boot and complete OTA!!
    @I_did_it_just_tmrrow For taking the time to verify magisk is able to indeed patch the 2015 version of the Shield HERE and more so they explained the boot images provided on gameworks for the 2015 version have the same hash, therefore a patched boot will work on both the 16gb and 500gb models. Thank you!
    @Sleenie for asking about potential data loss HERE so that tests could be done to determine at what points we actually lose our data. (Only at locking/ unlocking bootloader, in this context.)
    This project was built by me using open source tools. Everything has been published to Github.

    The actual code:

    BOOTMOD/2019_PRECOMPILED_FILES/Bootmod.cpp at main · 01101010110/BOOTMOD

    A tool to help users to root their 2019 & / or...
    github.com github.com

    BOOTMOD/2017_PRECOMPILED_FILES/Bootmod.cpp at main · 01101010110/BOOTMOD

    A tool to help users to root their 2019 & / or...
    github.com github.com

    The main repo:

    GitHub - 01101010110/BOOTMOD: A tool to help users to root their 2019 & / or 2017 Nvidia Shields (2015 coming soon!). Please see the XDA thread below for more depth.

    A tool to help users to root their 2019 & / or...
    github.com github.com

    Nvidia Gameworks (Where the firmware came from and fastboot drivers)

    Gameworks Download Center

    developer.nvidia.com developer.nvidia.com

    If you want to build your own "Boot Mod" the instructions are HERE
    I spent too much time working to get my program to stop being falsely flagged by vendors on Virustotal. You can check the links below for the reports!

    2019 Version:

    VirusTotal

    VirusTotal
    www.virustotal.com www.virustotal.com

    2017 Version:

    VirusTotal

    VirusTotal
    www.virustotal.com www.virustotal.com

    2015 500 GB Version:
    Being falsely flagged by One AI Vendor Company :rolleyes:

    VirusTotal

    VirusTotal
    www.virustotal.com www.virustotal.com

    2015 16 GB Version:
    Being falsely flagged by One AI Vendor Company :rolleyes:

    VirusTotal

    VirusTotal
    www.virustotal.com www.virustotal.com
    If you want to see all the updates to the program explained in great detail, you may see these links:

    FIRST UPDATE NOTES
    These are some items that will be fixed in the second update.

    Edit option number 3 into more of a utility option, to include the ability to wirelessly adb connect to make life easier for the non-rooted folks or people already rooted that don't want to mess with cables.

    Fix the apk installation so the tmp text file does not build where the program is ran at, instead it builds in BOOTMOD/BIN and then autodeletes like it already does.

    Find a way to automate magisk module installation like how we did with apk installation, code for reference:
    magisk --install-module sdcard/Download/MagiskHidePropsConf-v6.1.2.zip
    reboot

    Credit @kurtzyload in the update and in credits for verifying the 500gb working in 2015 and all the other data they shared -- will word this better in the credits just tired rn and dont want to forget

    experiment with building a list of all non system apks that can be uninstalled and make a function to do that in bootmod and test how much it helps the shield's memory. Make it so it shows a succinct menu or summary of the apps that will be removed, and provide the option for the user to easily copy and paste the name of apps they wish to retain, then remove those from the remove list. Set a start word like begin or done.

    Not quite to do with this project, but a disabled-vbmeta was built using the avbtool, and now I need to remember to use brotli to build the 9.1 and 9.1.1 system images and other images included in that zip in .br, then see if they will flash with the disabled vbmeta.

    More will be jotted down as I think of it.
    Rooting our Shields using this method (a "Stock Root") keeps us in a "user" build, as opposed to installing the userdebug "Developer Rooted" images supplied by Nvidia on Gameworks, ensuring that apps like Disney+ still appear natively on the Playstore. The Dev Rooted images are able to be system writable, which is dangerous for normal users, but convenient for devs / tinkerers. Where as a Stock Root will have the system set to read only, requiring the use of Magisk modules or TWRP to edit the system, which is safer for normal users but slightly more obnoxious for anyone wanting to tinker.

    If you want to try the Developer Rooted images you may see this thread:

    2015, 2017, & 2019 (16 GB) Nvidia Shield TV Firmware Repo & Source Code Repo

    Normal Users seeking only Backup Stock Copies...
    xdaforums.com xdaforums.com
    View
    4
    jenneh
    jenneh
    An update has been released and pushed to all the zip files. (These are just QoL things for the BOOTMOD script.) As usual, the OP's guide has been updated again with the new source code and pictures.

    You are now presented with a menu that will show if your device is connected via adb.
    SYSTEM MENU.PNG


    In case you forgot to adb connect, option 3 will allow you to type your ip address and connect to the shield.


    Option 2 will allow you to install just the magisk apk, this will be useful for updates.
    apk.PNG


    Option 1 pushes the shield into the bootloader menu and verifies it is posting before entering the flash menu, like the original version did before.

    "Reboot shield to system" "escapes" have been added to the menu in a couple of places.

    A Friendly reminder was added to the stock boot flash, to re-engage bootloader lock for upscaler, and a pause before system reset to do so.
    View
    4
    J
    Jdorman12
    this is going to be a sloppy post but im busy today, here is some stuff to try, and other ones to play around with
    persist.vendor.tegra.hwc.upscale.modechange.disable
    ro.gfn.upscale.toast=1
    persist.vendor.tegra.hwc.upscale.filter=lanczos
    persist.vendor.tegra.hwc.deepisp.detail=2
    persist.vendor.tegra.deepisp.fps_max=63
    ro.vendor.tegra.AF73C63E=0x80007ffd
    vendor.tegra.0x523dd1=2
    persist.vendor.tegra.hwc.nvimp 31.0
    persist.vendor.tegra.hwc.upscale.gfn= ftrace_enable or imp_enable
    persist.vendor.tegra.hwc.nvdc
    ro.vendor.tegra.hide.modes.sf
    vendor.nvidia.hwc.enable_service
    ro.vendor.tegra.hdmi.limit.clock
    ro.vendor.tegra.hwc.nvimp (check this one)
    persist.vendor.tegra.max_graphics_width
    persist.vendor.tegra.max_graphics_height
    vendor.nvidia.hwc.hdcp_enable
    vendor.nvidia.hwc.imp_enable
    persist.vendor.tegra.hdmi.resolution
    nvidia.hwc.no_vic

    /dev/fb%u /sys/class/graphics/fb%u/device/crc_checksum_latched location of checksum that gets validated


    persist.vendor.tegra.hwc.upscale.modechange.disable

    ro.vendor.tegra.AF73C63E=0x80007ffd
    vendor.tegra.0x523dd1=2

    ro.vendor.tegra.deepisp.cpu_min=-1
    ro.vendor.tegra.deepisp.cpu_max=-1
    ro.vendor.tegra.deepisp.cpu_pri=15
    ro.vendor.tegra.deepisp.gpu_min=1075200
    ro.vendor.tegra.deepisp.gpu_max=-1
    ro.vendor.tegra.deepisp.gpu_pri=15
    ro.vendor.tegra.deepisp.emc_min=106560

    vendor.nvidia.hwc.enable_service ro.vendor.tegra.hdmi.hdr.mode ro.vendor.tegra.tv.dpi ro.vendor.tegra.yuv.emc_min ro.vendor.tegra.hwc.dolbymode.signal_delay hdmi_yuv_force stb_mode yuv_gpu_max
    ro.vendor.tegra.composite.fallb persist.vendor.tegra.gamma_correction 50 ro.vendor.tegra.yuv.gpu_pri ro.vendor.tegra.deepisp.cpu_min persist.vendor.tegra.hdmi.yuv.auxrgb
    ro.vendor.tegra.NV_PROPERTY_AVI_COLORIMETRY_STR hdmi_2020_force
    vendor.nvidia.hwc.no_egl
    persist.vendor.tegra.composite.range
    persist.vendor.tegra.hdmi.hdr.mode
    ro.vendor.tegra.hdmi.yuv.enable
    persist.vendor.tegra.hwc.nvimp 31.0
    persist.vendor.tegra.hwc.upscale.gfn
    persist.vendor.tegra.glc.hybrid_min_4x
    vendor.nvidia.hwc.war_1515812
    vendor.nvidia.hwc.imp_enable


    ro.vendor.tegra.zbc_override
    persist.vendor.tegra.hwc.upscale.modechange.disable
    persist.vendor.tegra.hdmi.hdr.tonemap
    View
    3
    jenneh
    jenneh
    I wanted to share something I discovered today that I didn't know about before and this deals with TWRP.

    Today I rewrote a GUIDE going over how to install Lineage OS on the shield.

    I noticed that TWRP when opened will then establish a root shell with the device named RECOVERY
    2.png

    So I adb shell ls and noticed that the contents /are not/ the same as what we see in a regular adb shell or in root exploring apps.
    1.PNG
    In fact, the view we are used to seeing is referred to as "system_root" as listed above. If you were to ls that, you would see your traditional filesystem layout.

    So therefore I was not seeing the full picture before... There's files here I pulled that I hadn't read before, I have to sort between the leftover lineage garbage and what not but I will share the native file dump later.

    This also makes me wonder if I was trying to flash the "roms" wrong for this device. Maybe a new approach would be to make a modified and preinstalled system_root that could be adb pushed.

    Not sure just wanted to share

    --edit have to select the MOUNT option in TWRP and then system + vendor to see the full picture, otherwise a lot of empty folders
    View
    3
    P
    pinvok3
    Okay, I'm grasping straws right now, but my shield just crashed after I have started a movie with Dolby Vision enabled. Can someone confirm if Dolby Vision is grayed out (unavailable) on rooted devices but available on nonrooted ones? After this fix I was able to enable Dolby Vision but my system just died with this log:

    12-20 23:12:18.951 3725 3839 E WindowManager: Exception checking for game stream. Exception: android.content.pm.PackageManager$NameNotFoundException: ComponentInfo{com.android.tv.settings/.MainSettings}
    12-20 23:12:18.951 3725 3839 I InputDispatcher: Dropped event because of pending overdue app switch.
    12-20 23:12:18.953 3725 3864 E AudioService: Audioserver died.
    12-20 23:12:18.982 4578 5347 D DolbyAudioService: IMs12 implementation died... Restoring settings after restart
    12-20 23:12:18.983 4578 5347 D DolbyAudioService: Attempting to connect to IMs12
    12-20 23:12:18.992 4578 12382 I DolbyAudioService: Waiting 1 second before attempting to connect to IMs12...
    12-20 23:12:19.037 12385 12385 D audiohalservicemsd: main() Starting android.hardware.audio@4.0-service-msd from vendor/dolby.
    12-20 23:12:19.050 12385 12385 D : Calling decrypt_blob. err(0)
    12-20 23:12:19.056 3432 3432 E Ipprotectd: decrypt_blob: Error during launch operation. err(0xffff0011)
    12-20 23:12:19.056 3432 3432 E Ipprotectd: Error occurred at decryption. err(ffff0011)
    12-20 23:12:19.058 12385 12385 E : Decryption failed
    12-20 23:12:19.058 12385 12385 E : decrypt_blob failed! err(0)
    12-20 23:12:19.058 12385 12385 E : Failed to decrypt.
    12-20 23:12:19.058 12385 12385 E : Failed decrypt .text section.
    12-20 23:12:19.059 12385 12385 F libc : Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x4ec98e90 in tid 12385 (android.hardwar), pid 12385 (android.hardwar)
    12-20 23:12:19.062 12384 12384 I ServiceManagement: Removing namespace from process name android.hardware.audio@2.0-service to audio@2.0-service.
    Click to expand...
    Click to collapse

    It seems like some encrypted communication fails which takes the whole system with it. It makes me more suspicious that the bootloader unlock removes/hides/blocks some DRM keys required for AI/Dolby Audio to work. If we could somehow hook into the bootloader unlocking phase to see what's happening ..
    View

New posts