[GUIDE] How to root 2015 Philips Android TV

How did rooting process go with your 2015 Philips Android TV?

  • Firmware QV151E - Rooting was successfull

    Votes: 26 41.9%

  • Firmware QV151E - Rooting was not successfull

    Votes: 7 11.3%

  • Firmware QM152E - Rooting was successfull

    Votes: 2 3.2%

  • Firmware QM152E - Rooting was not successfull

    Votes: 14 22.6%

  • Firmware QM151E - Rooting was successfull

    Votes: 3 4.8%

  • Firmware QM151E - Rooting was not successfull

    Votes: 3 4.8%

  • Firmware TPM156E - Rooting was successfull

    Votes: 1 1.6%

  • Firmware TPM156E - Rooting was not successfull

    Votes: 0 0.0%

  • Firmware TPM151E - Rooting was successfull

    Votes: 2 3.2%

  • Firmware TPM151E - Rooting was not successfull

    Votes: 1 1.6%

  • Firmware TPM152E - Rooting was successfull

    Votes: 3 4.8%

  • Firmware TPM152E - Rooting was not successfull

    Votes: 0 0.0%
  • Total voters
    62
Search This thread
By:
Advanced…
ProtoDeVNan0

ProtoDeVNan0

Senior Member
Apr 3, 2013
1,409
6,040
HTC Sensation
Not sure how many people are still interested in "hacking" these TVs but I got this on my 40PFT5500. UBoot access + Android Shell access over UART on the back of the TV .

Short Guide For Interested Ones:
1. Press this combination on latest firmware
Home => 1999 > Back/Return.
2. In SDM mode scroll down to the bottom, find UART Enable and change Off to On.
2. Go up, choose store nvme/tv etc & exit factory.
3. Reboot (I pulled the power cable out too)
4. Connect UART (can be Arduino even) to the back of TV.
5. During boot, spam CTRL + C very fast as soon as You plug in the TV.
6. Enjoy UBoot Access!
7. To access Android Shell or Recovery Shell, spam CTRL + C once You see kernel logs in UART.

And a warning. If You mess up uboot settings, You can pretty quickly brick Your TV so be extremely careful!

Enjoy!
IMG_20211113_021743.jpg
IMG_20211113_024635.jpg
 
intropedro

intropedro

New member
Jun 14, 2015
4
0
www.intropedro.com
ProtoDeVNan0 said:
Not sure how many people are still interested in "hacking" these TVs but I got this on my 40PFT5500. UBoot access + Android Shell access over UART on the back of the TV .

Short Guide For Interested Ones:
1. Press this combination on latest firmware
Home => 1999 > Back/Return.
2. In SDM mode scroll down to the bottom, find UART Enable and change Off to On.
2. Go up, choose store nvme/tv etc & exit factory.
3. Reboot (I pulled the power cable out too)
4. Connect UART (can be Arduino even) to the back of TV.
5. During boot, spam CTRL + C very fast as soon as You plug in the TV.
6. Enjoy UBoot Access!
7. To access Android Shell or Recovery Shell, spam CTRL + C once You see kernel logs in UART.

And a warning. If You mess up uboot settings, You can pretty quickly brick Your TV so be extremely careful!

Enjoy!
View attachment 5457511View attachment 5457513
Click to expand...
Click to collapse
Thank you very much @ProtoDeVNan0 for the information.

I don't know much about what UART is but I understand that it is to activate it on the television and then with a special cable connect it to the television from a device that understands UART and access this mode, right?

And once inside, how is root permission activated?
 
I

iustinteo

Member
May 5, 2012
16
2
Galati
Hello !
1. King ROOT will infect your Android tv, because it is a known malware application that sends all your android data to a site in China for replication. King ROOT, Su binary King ROOT & Purity are not normally removable, but you can delete them and replace them with SuperSu (chainefire) with

Super-Sume Pro.apk from Google PLAY :​

play.google.com

Super-Sume Pro – Aplicații pe Google Play

Acest program va elimina KingRoot și se instalează SuperSU ,. (Nu dezinstalați)
play.google.com play.google.com
King ROOT will root your Android tv, which has a maximum version of 5.0! For versions higher than 5.0 it does not root!

2. The most efficient rooting option remains with TWRP specific to the TV model, with magisk and boot.img extraction from the tv firmware.
If someone managed to root with magisk, give the method here.
The my TV model is:
Philips TV PHL-QM163 Android TV 8.1
 
C

Claufecam

New member
Nov 13, 2019
3
0
ProtoDeVNan0 said:
Not sure how many people are still interested in "hacking" these TVs but I got this on my 40PFT5500. UBoot access + Android Shell access over UART on the back of the TV .

Short Guide For Interested Ones:
1. Press this combination on latest firmware
Home => 1999 > Back/Return.
2. In SDM mode scroll down to the bottom, find UART Enable and change Off to On.
2. Go up, choose store nvme/tv etc & exit factory.
3. Reboot (I pulled the power cable out too)
4. Connect UART (can be Arduino even) to the back of TV.
5. During boot, spam CTRL + C very fast as soon as You plug in the TV.
6. Enjoy UBoot Access!
7. To access Android Shell or Recovery Shell, spam CTRL + C once You see kernel logs in UART.

And a warning. If You mess up uboot settings, You can pretty quickly brick Your TV so be extremely careful!

Enjoy!
View attachment 5457511View attachment 5457513
Click to expand...
Click to collapse
Hello Friend. Put the rest of the procedure for us. After accessing Uboot and then what to do to get root?
 
You must log in or register to reply here.

Similar threads

M
Philips Android TV
Replies
3K
Views
1M
Midomad
Midomad
smartcard2
TCL Android TV model 55p8m / Android Recovery TCL/BeyondTV/BeyondTV
Replies
4K
Views
1M
S
SuperDozer
brar.arsh
Sony Android TV Users
Replies
2K
Views
701K
5
55TT55
ovso
  • Poll
[GUIDE] Continuous restart / bootloop fix for Philips Android TV with Wipe Data Tool
Replies
287
Views
282K
Toengel
Toengel
stasiof
TCL 2021 Android TVs (C05/G05/BeyondTV6/BeyondTV4)
Replies
2K
Views
476K
Sage
Sage

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 10
    ovso
    ovso
    PROCEED WITH CARE
    OVERVIEW TABLE - UPDATED FOR APRIL 2016
    Update%2BMaj%2B2016.jpg

    * Comment applicable for TV's with QV15.1E chassis:
    Below guide does not apply for firmwares QV151E_R0.5.38.41, QV151E_R0.5.38.52 because root can be obtained directly under user 0 using KingRoot on them.
    Here you are download links for both firmwares:
    1. QV151E_R0.5.38.41 (Use utility FRD v0.94 for easy download)
    2. QV151E_R0.5.38.52 (Use utility FRD v0.94 for easy download)
    Below guide also does not apply for QV151E_R0.5.38.55 and up, because TP Vision applied necessary android security patches to avoid root...
    Upgrade/Downgrade above mentioned firmware via Android system recovery <3e> menu

    Good news!!! Now we can get full root access on some ABD enabled 2015 Philips Android TV's
    13.jpg

    FULL STEP BY STEP GUIDE:
    A. PREREQUISITES
    1. PC/Mac/Linux computer on the same WiFi / Ethernet network as your TV with functional Android Device Bridge (ADB).
    2. Working TeamViewer on above mentioned computer.
    3. Familiarity with side-loading APK's using ES File Explorer from USB storage and/or v from Google Play or similar.
    4. Readiness and excitement to get your 2015 Philips Android TV to the next level :)

    B. CREATE AND SWITCH TO USER 10
    1. Install Terminal Emulator app from Google Play using computer or other device.
    2. Execute in Terminal Emulator following command: am start --user 0 com.android.settings/.DevelopmentSettings
    3. Enable "Developer options" and enable "USB debugging" in the popped-up window.
    4. Install Android Debug Bridge utility (ADB) on the PC preferably at root folder C:\ADB for easy use.
    5. Run the ADB utility on PC. PC must be on the same network as TV. Make sure adb.exe is not blacklisted in your firewall rules.
    It is better to connect both PC and TV via ethernet cable to the same router instead of WiFi.
    6. Execute following shell command: adb start-server
    7. Execute another shell command: adb connect 10.0.1.2 (IP of your TV)
    8. Execute shell command upon successful connection: adb shell
    9. Create new user under shell by performing following command: pm create-user FREE (any name)
    10. Note or remember what number was assigned with newly created user. Should be user 10.
    11. Switch to the new user profile executing shell command: am switch-user 10 (the number assigned to the profile above)

    C. GET ROOT PRIVILEGES UNDER USER 10
    12. Execute shell command to enter security settings of newly create user 10:
    am start --user 10 com.android.settings/.SecuritySettings
    13. Enable installation from unknown sources using slider in the menu.
    14. Install rooting app KingRoot v4.8.0 (update to v4.8.1 later within app) under "User 10" and apply root. Navigate through app from PC via QuickSupport TeamViewer application because remote control does not work in it.
    15. Exit KingRoot app and execute it again. This time KingRoot will deploy as system application. It can take few more attempts for KingRoot to deploy as system app so be patient. Note: TV may restart itself when root privileges are granted.
    16. Install app Root Explorer v3.3.8. Use its re-mounting function by pressing R/W button to gain full read/write access to all files. Install also app Purify v1.2.0.120 which will help us!
    17. Edit following XML file: /data/system/users/0/package-restrictions.xml using built in "Text Editor" under Root Explorer.
    18. Remove line related to Root Explorer <pkg name="com.speedsoftware.rootexplorer" stopped="true" /> also lines <pkg name="com.kingstudio.purify"> plus <pkg name="com.kingouser.com"> and save file. This will allow Root Explorer and Purify to run under "User 0".

    D. GET ROOT PRIVILEGES UNDER USER 0
    19. Switch from "User 10" to "User 0" executing ADB command: am switch-user 0 . If you've at this point lost access and can not perform switch via ADB install app adbWireless v1.5.4 from USB stick, allow root access and re-enable ADB. It also works via Ethernet cable. If you are still not rooted and end up in "User 10 trap" focus on getting root privileges. Uninstall + re-install KingRoot + switch to user 0.
    20. Restart the TV by unplugging / re-plugging power cord.
    21. Re-run KingRoot under "User 0" so it can fully deploy as system app. If you do not see the KingRoot app listed anywhere press gear button on remote and go to Setup/General Settings/Android settings/Device/Apps/System apps and open it from there. Afterwards the KingRoot app will be listed among other sideloaded apps.

    E. ENABLE INSTALLATION FROM UNKNOWN SOURCES UNDER USER 0
    22. Install app Settings Database Editor v2016.01.26 from Google Play from your PC, run it, grant root privileges when prompt and edit value "install_non_market_apps" under secure tab from "0" to "1". Alternatively set root privileges to it via ADB by running ADB command: pm grant by4a.setedit android.permission.WRITE_SECURE_SETTINGS
    23. Edit 0.xml located in /data/system/users/ under line <restrictions no_install_unknown_sources="true" /> and change value "true" to "false" using text editor within Root Explorer.
    24. Disable "Google Play Services" and "Google Play Store" apps under Auto-start tab in KingRoot app. Alternatively run app Purify v1.2.0.120 and set "Google Play Services" and "Google Play Store" apps to Auto-kill+Block Start under Purify Apps tab. Other words make sure "Google Play Services" and "Google Play Store" are not on whitelist.
    25. Restart the TV by unplugging / re-plugging power cord.
    26. Enjoy the root and install any APK under "User 0" you like. :cool:. Installation of apps via ADB will also work from here. "User 10" may be deleted at this point using ADB command: pm remove-user 10
    27. Attention: If you (or Android system) open "Google Play Services" and/or "Google Play Store" apps than installation of apps from unknown sources will be disabled so go back and start from point 23...

    F. TIPS AND TRICKS
    1. Find attached below all needed APK's that worked for me. (Except ES File Explorer - no more quota)
    2. If wanted you can install BusyBox Installer v1.4 and select BusyBox version v1.20.
    3. Launcher that I use in the screenshot picture is TV Launcher v3.0.20. Below is attached APK for it. No root required for this launcher, however uninstall Leanback Launcher updates under system apps otherwise you'll be not able to select "Home App" yourself...
    4. I've changed resolution of the UI from 1080p to 1440p. Looks great and so far no issues with it. 2160p does not work steadily (not supported in Lollipop)... Use ADB shell command: wm size 2560x1440 ... To go back use ADB shell command: wm size reset
    5. Great app called Root Booster can be found here
    6. You can replace KingRoot with SuperSU following this guide. It worked on my 49PUS7150/12, but TV restarted around 3 times. I've used the tool v2.4...
    7. You can make your life much easier with Total Commander with Android ADB plugin
    Let us know the tricks you tried.

    G. ROOT - PROS AND CONS
    PROS:
    1. Install apps requiring root access
    2. Make TV more reliable and faster by deleting obsolete system apps (even preinstalled ones)
    3. Improve boot time and increase TV responsiveness by removing bloatware
    4. Manage processor and Android system performance
    5. Install a better web browser
    6. Use an iphone/ipad/mac based airmouse/remote mouse in this browser
    7. Tweak and test 4K posiblities
    CONS:
    1. Potential loss of warranty if not un-rooted before hard brick...

    H. GUIDE IS FULLY TESTED AND WORKING on following 2015 Philips Android TV's:
    1. 49PUS7150/12 - QV151E - Version: 000.005.038.028, Date published: 2015-12-16
    2. PUS7600/12
    3. 49PUK7150/12
    4. 55PUS7150/12
    5. 55PUS7100/12
    Let us know if you are successful

    I. GUIDE UNFORTUNATELY DOES NOT WORK YET on following 2015 Philips Android TV's due to dm-verity safe boot enabled:
    1. 5500 series
    2. 50PUT6400
    3. 48PUS7100/78 - error message: device '(null)' not found
    4. 55PUK6400 - QM152E - Version: 000.005.101.047
    Let us know if you are stuck

    J. WISH LIST
    1. Enable mouse pointer - Enabled since March 2016 firmwares
    2. Enable 4K video content from YouTube
    3. Enable oscam server
    Let us know your wish

    K. TROUBLESHOOTING IN CASE OF ISSUES
    1. Follow this thread: [GUIDE] Continuous restart / bootloop fix for Philips Android TV with Wipe Data Tool
    Let us know if you experience any issues.


    QV151E NOTE: Rooting was possible prior to QV151E_R0.5.38.068 firmware. In this particular firmware there were Google security patches applied to avoid this rooting method. Even if you downgrade to prior firmware versions, you will no longer succeed with this rooting method.

    @7100p, @Tomzzz4pda - Thanks for great contribution to make this guide reality :) !!!
    View
    4
    P
    puh6400
    I saw couple of comments regarding unsuccessful adb attempts to 6400 series (XXpuh6400/88 - QM15.2E LA)
    Because I also arrived here after many-many googleing on same issue without success, let me share how I managed to solve it by myself finally.

    First, about the problem: whatever I tried, after connecting with adb from PC to TV, the TV didn't list under "adb devices" and so I didn't succeed in sending any adb command to TV.
    Even thought after issuing "adb connect 192.168.0.xxx" and getting "connected" from adb, all command ended up in "error: device '(null)' not found"
    Believe me this was not for simple reasons like firewall..., I tried lots of things through several days.

    I thought my TV's debugging was somehow blocked (although debugging was ON in developers menu).
    So I started to think how could I unblock debugging.
    I got an idea about trying adb debugging while TV was in service menu (you know when you enter for example "0 + 6 + 2 + 5 + 9 + 6 + Info" from remote)
    Edit2: It looks like simply entering to service menu is not enough, you need to give a test-reboot (in Sw maintenance/Sw events menu)

    And really, this unblocked the debugging!
    Or maybe it has applied some extra access right across the system, because since that I have been successfully doing every adb command on TV even without the service menu trick.
    So this service menu trick needs to be executed one time only.
    Edit1: after wiping with wipedatatool, I had to repeat the trick, because I was unable to ADB again.

    This way I could for example reboot to recovery to be able to install old SW (5.234.14), as the latest SWs are horrible (5.255.90 and 5.255.114 both have horrible lipsync issue)
    But I was also able to execute the rooting process up to user 10 creation and access right setting. I didn't go further, as I didn't want to root my TV, but at least this looked promising.

    Post it here if this helps the rooting of QM15.2E LA, I'm interested in the real impacts of this trick. Maybe it's just a strange coincident :)
    I appreciate a "Thanks" also, if this is really a useful tip :)
    View
    3
    P
    psyalemao
    Hello,

    Is there a way to unpack the *.pkg file of the firmware upgrade for the TV like this tool here: https://forum.xda-developers.com/android/software/tools-mstar-android-tv-firmware-tools-t3559227, but for philips TV's, so in a way that maybe could extract the boot/kernel/ramdisk.img to patch with magisk or use the universal no dm-verify from here: https://forum.xda-developers.com/android/software/universal-dm-verity-forceencrypt-t3817389 and then repack again and flash?

    Thanks in advance for reply.
    View
    2
    ovso
    ovso
    Jan63 said:
    Unfortunately it doesn`t work. :( It says "E:failed to mount /sdcard (Invalid argument)")
    Should the file be in ZIP format?
    Click to expand...
    Click to collapse
    You need to unzip the ZIP file and copy UPG file to the root of the USB...
    View
    2
    ovso
    ovso
    Jan63 said:
    Doesn`t work / the same error :(
    Click to expand...
    Click to collapse
    Than it means that there is a problem with the USB that you are using. Make sure it is formated in FAT32...
    View

New posts