Hi all,
It's been a long time since I released my root guide for Xperia XA and I'm back for the same reasons: I didn't find a way to root my new Smart TV so I worked hard to find the way and now I want to share the answer with you.
## Background
I bough a cheap Smart TV as a replacement of my 15 years old LG TV
used as a monitor for my PC.
It's a 32" TV, manufactured by STRONG, model is SRT 32HC4432, Soc is MSD6683 and codename is "komagome"
The TV have Android TV 9 with only 1GB RAM so it's slooooow and the sound is awfull, I thinked "OK let's root it and tweak it a little". After a long search I found nothing easy and usable for my TV: No "one click" root solution, no factory firmware to extract boot.img and patch it, no TWRP and all guides are outdated for my TV. So I started from scratch (or near).
This guide should works for a lot of TV with MSTAR Soc and Android TV 9.
## Rooting MSTAR TV on Android TV 9 (PIE)
Before proceeding a word of caution (or why you wouldn't like to root your TV):
1. Unlocking your BootLoader will void your warranty.
2. Unlocking your bootloader will wipe the device (factory reset) so make a backup !
3. Disabling dm-verity is a security flaw
3. If you have confidential files in your TV don't unlock your bootloader, as long as your TV is locked your data are officially secured.
4. Opening your TV will void your warranty too.
5. If you brick your TV and you don't have a factory firmware you will no be able to recover it.
6. This guide is not for noob and I will not answer questions like: How to enable ADB? What is UART? How to connect with Putty?
Edit: rooting will break videos on YouTube, Netflix,... Thanks to @dante_ov for the feedback, I will try to find why and fix the problem.
## Requirement
- Adb and Fastboot drivers on your PC
- An USB to serial adapter
- Some solder skills if you are not lucky like me
- Putty software or equivalent
- A USB key (or two)
- Magisk Manager apk
- A file manager app to install apk
- A brain (recommanded)
## Method
1) Unplug the power cord of the TV and remove the back cover of the TV.
2) Connect RX, TX and GND of your adapter on the UART port of the motherboard, DO NOT CONNECT VCC ! On my motherboard it's at the bottom near RCA connectors and I have to solder wires because there is no socket
3) Connect Putty with speed set to 115200
4) Plug the power cord and right after keep pressing Enter on your PC until you see the prompt in the terminal session. For me the prompt is <<M5621>>#
6) We need the partitions info, the command is
copy/paste the result in a text file on your PC and save it, now we can make a backup of all partitions.
7) Format your USB key in FAT32 and plug it on the USB port on the right of the TV, it will be USB 0, if you connect on the bottom USB port it will be USB 2 or 3. Given commands will be for USB 0.
8) Enter command
9) For root we only need the recovery partition but to be safe make a backup of all partitions. Be carefull with userdata partition because of FAT32 limitations, size limit is 4GB. You can skip it if you don't care about your user data.
You have to backup partitions one by one because the commands with
The command looks like:
For [offset/partitionname] we use the name of the partition and for [dumpsize] we use length, both values obtained at step 6. [binname] is the name of the created file on the USB key.
For sample:
after the dump, if like me you have an error
10) Now that you have all partitions enter
Unplug the key and copy the content in a safe place
11) We have to unlock the bootloader by entering
12) We have to disable dm-verity to avoid bootloop, command is
13) Unplug/replug the tv and boot normally, you should see the annoying message " /!\ Your bootloader is unlocked ... " and the wipe data processing screen right after. Wait and follow the setup wizard, enable ABD on the TV then install Magisk Manager app.
13) Rename recovery.bin to recovery.img, copy it on the USB key and plug it on the bottom port of the TV.
14) Open Magisk Manager and patch recovery.img, don't uncheck recovery setting box.
15) On your computer, pull the patched recovery with ADB, it should be in /storage/emulated/0/Download/Magisk_patched_XXX.img
Then copy it on the USB key from the PC and rename it recovery2.bin
I have to do like this because I can't simply copy/paste from internal storage to USB (permission denied)
16) Plug the key on the right side of the tv and do step 4 again
17) We will flash the patched recovery on the recovery partition and on boot too !
(I will explain why later)
Commands are:
18) unplug/plug the power cord and boot normally
19) YOU ARE ROOTED !
20) Hit the thank button on this post
## Unroot
You can unroot the device by flashing the stock boot and recovery with commands from step 17.
You can enable dm-verity again with
You can relock the bootloader with
## Conclusions and comments
If you are familiar with MSTAR devices you noticed that I didn't used special tools and keys, all ways used before are not working anymore, upgrade packages are differents too. Now they are in pkg format so it's not possible to extract boot, recovery, system, ... like before (or I missed the way)
I found a factory firmware for the KIVI 32f710kw who is the copy of my TV but I wasn't able to unpack it.
SPI and TFTP ways are not possible on my TV (as I tried).
An other big change is that the TV uses "system as root" to work so the ramdisk is in system partition and not in the boot that's why I flashed the patched recovery on boot too on step 17.
You can flash only on recovery partition but each time you shutdown (not standby) the TV you will have to reboot to recovery to trigger the root as explained in Magisk documentation.
I don't know if UART through HDMI is working on power on to do the same without opening the TV, I can enable it in the factory menu within Android but I don't have the adapter to try.
## What next ?
Now that I have root and disabled dm-verity I'm free to edit factory configs to enable some features, add the missing HDCP2 key and tweak the firmware.
An other good thing will be to try firmwares from differents TV and GSI Roms
because YES my TV is "Treble enabled"
Have a nice day and good luck !
It's been a long time since I released my root guide for Xperia XA and I'm back for the same reasons: I didn't find a way to root my new Smart TV so I worked hard to find the way and now I want to share the answer with you.
## Background
I bough a cheap Smart TV as a replacement of my 15 years old LG TV
used as a monitor for my PC.It's a 32" TV, manufactured by STRONG, model is SRT 32HC4432, Soc is MSD6683 and codename is "komagome"
The TV have Android TV 9 with only 1GB RAM so it's slooooow and the sound is awfull, I thinked "OK let's root it and tweak it a little". After a long search I found nothing easy and usable for my TV: No "one click" root solution, no factory firmware to extract boot.img and patch it, no TWRP and all guides are outdated for my TV. So I started from scratch (or near).
This guide should works for a lot of TV with MSTAR Soc and Android TV 9.
## Rooting MSTAR TV on Android TV 9 (PIE)
Before proceeding a word of caution (or why you wouldn't like to root your TV):
1. Unlocking your BootLoader will void your warranty.
2. Unlocking your bootloader will wipe the device (factory reset) so make a backup !
3. Disabling dm-verity is a security flaw
3. If you have confidential files in your TV don't unlock your bootloader, as long as your TV is locked your data are officially secured.
4. Opening your TV will void your warranty too.
5. If you brick your TV and you don't have a factory firmware you will no be able to recover it.
6. This guide is not for noob and I will not answer questions like: How to enable ADB? What is UART? How to connect with Putty?
Edit: rooting will break videos on YouTube, Netflix,... Thanks to @dante_ov for the feedback, I will try to find why and fix the problem.
## Requirement
- Adb and Fastboot drivers on your PC
- An USB to serial adapter
- Some solder skills if you are not lucky like me
- Putty software or equivalent
- A USB key (or two)
- Magisk Manager apk
- A file manager app to install apk
- A brain (recommanded)
## Method
1) Unplug the power cord of the TV and remove the back cover of the TV.
2) Connect RX, TX and GND of your adapter on the UART port of the motherboard, DO NOT CONNECT VCC ! On my motherboard it's at the bottom near RCA connectors and I have to solder wires because there is no socket
3) Connect Putty with speed set to 115200
4) Plug the power cord and right after keep pressing Enter on your PC until you see the prompt in the terminal session. For me the prompt is <<M5621>>#
6) We need the partitions info, the command is
mmc partcopy/paste the result in a text file on your PC and save it, now we can make a backup of all partitions.
7) Format your USB key in FAT32 and plug it on the USB port on the right of the TV, it will be USB 0, if you connect on the bottom USB port it will be USB 2 or 3. Given commands will be for USB 0.
8) Enter command
usb reset 0 to initialize the key9) For root we only need the recovery partition but to be safe make a backup of all partitions. Be carefull with userdata partition because of FAT32 limitations, size limit is 4GB. You can skip it if you don't care about your user data.
You have to backup partitions one by one because the commands with
emmcbin without comments and mmc dd mmc2usb to make a full backup corrupt the dump or the USB key The command looks like:
emmcbin [usbportnum] [pad] [binname] [offset/partitionname] [dumpsize]For [offset/partitionname] we use the name of the partition and for [dumpsize] we use length, both values obtained at step 6. [binname] is the name of the created file on the USB key.
For sample:
emmcbin 0 0 recovery.bin recovery 65536after the dump, if like me you have an error
** Bad Signature on 0:37: expected 0x5840, got 0x0000
[do_emmc_mkbin]: check bininfo of part 37 failed ignore it10) Now that you have all partitions enter
usb stopUnplug the key and copy the content in a safe place
11) We have to unlock the bootloader by entering
avbab set_device_state 0setenv devicestate unlocksaveenv12) We have to disable dm-verity to avoid bootloop, command is
avbab disable-verity 13) Unplug/replug the tv and boot normally, you should see the annoying message " /!\ Your bootloader is unlocked ... " and the wipe data processing screen right after. Wait and follow the setup wizard, enable ABD on the TV then install Magisk Manager app.
13) Rename recovery.bin to recovery.img, copy it on the USB key and plug it on the bottom port of the TV.
14) Open Magisk Manager and patch recovery.img, don't uncheck recovery setting box.
15) On your computer, pull the patched recovery with ADB, it should be in /storage/emulated/0/Download/Magisk_patched_XXX.img
Then copy it on the USB key from the PC and rename it recovery2.bin
I have to do like this because I can't simply copy/paste from internal storage to USB (permission denied)
16) Plug the key on the right side of the tv and do step 4 again
17) We will flash the patched recovery on the recovery partition and on boot too !
(I will explain why later)
Commands are:
usb reset 0
usb_partial_upgrade_to_emmc recovery2.bin recovery
usb_partial_upgrade_to_emmc recovery2.bin boot18) unplug/plug the power cord and boot normally
19) YOU ARE ROOTED !
20) Hit the thank button on this post
## Unroot
You can unroot the device by flashing the stock boot and recovery with commands from step 17.
You can enable dm-verity again with
avbab enable-verity commandYou can relock the bootloader with
avbab set_device_state 1 command## Conclusions and comments
If you are familiar with MSTAR devices you noticed that I didn't used special tools and keys, all ways used before are not working anymore, upgrade packages are differents too. Now they are in pkg format so it's not possible to extract boot, recovery, system, ... like before (or I missed the way)
I found a factory firmware for the KIVI 32f710kw who is the copy of my TV but I wasn't able to unpack it.
SPI and TFTP ways are not possible on my TV (as I tried).
An other big change is that the TV uses "system as root" to work so the ramdisk is in system partition and not in the boot that's why I flashed the patched recovery on boot too on step 17.
You can flash only on recovery partition but each time you shutdown (not standby) the TV you will have to reboot to recovery to trigger the root as explained in Magisk documentation.
I don't know if UART through HDMI is working on power on to do the same without opening the TV, I can enable it in the factory menu within Android but I don't have the adapter to try.
## What next ?
Now that I have root and disabled dm-verity I'm free to edit factory configs to enable some features, add the missing HDCP2 key and tweak the firmware.
An other good thing will be to try firmwares from differents TV and GSI Roms
because YES my TV is "Treble enabled"
Have a nice day and good luck !
Last edited:
