Hisense 4K ATV4 Rooting

[$cronos_]

The Hisense 4K ATV4 runs Android 9 Pie. I got into Developer Options and enabled ADB. Unfortunately, the bootoader isn't unlockable, but I think that you might be able to root it using KingoRoot, or even install apps from ADB.

Specs:
Storage: 4 GB
RAM: 1 GB
Processor: ARM Cortex A55

 

[jerrydevis]

Same problem, my tv is not unlockable. It goes all black when i run "adb reboot bootloader", I can not find OEM
Unlock option under Developer Options!

 

[$cronos_]

Same problem, my tv is not unlockable. It goes all black when i run "adb reboot bootloader", I can not find OEM
Unlock option under Developer Options!

if you use mtkclient does it unlock?

 

[jerrydevis]

if you use mtkclient does it unlock?

Nope,I can not boot into fastboot mode! It only restarts the TV!

 

[chris1892006]

U can unlock it, my Hisense 43A6H is unlocked. After u get a usb male to male type a cable hook it up only 1 port communicates with the tv on my tv. Find out which one it is and it may require a reboot of the tv to get communication via adb initially then adb reboot bootloader then it reboots go to device manager install the bootloader interface driver for the device that shows up. Then run fastboot flashing unlock. That's as far as I have gotten, so do a fastboot reboot.

That's as far as I have gotten, I haven't been able to root it. I have the boot.img and i patched it with a lot of magisk versions and flashed to fastboot flash boot_b boot.img as fastboot flash boot boot.img & fastboot flash boot_a boot.img both basically brick the tv.

Before u continue call up Hisense and get your firmware and to recover rename the file from

usb_9612us_no_tvcertificate_user.pkg

to

usb_9612us_no_tvcertificate.pkg

Place the file only in the root of the fat32 flash drive unplug the tv and plug in the flash drive into ideally the port that communicates with the pc and hold power on the remote and plug in the tv... It will begin to recover the Hisense tv.

 

[jerrydevis]

U can unlock it, my Hisense 43A6H is unlocked. After u get a usb male to male type a cable hook it up only 1 port communicates with the tv on my tv. Find out which one it is and it may require a reboot of the tv to get communication via adb initially then adb reboot bootloader then it reboots go to device manager install the bootloader interface driver for the device that shows up. Then run fastboot flashing unlock. That's as far as I have gotten, so do a fastboot reboot.

That's as far as I have gotten, I haven't been able to root it. I have the boot.img and i patched it with a lot of magisk versions and flashed to fastboot flash boot_b boot.img as fastboot flash boot boot.img & fastboot flash boot_a boot.img both basically brick the tv.

Before u continue call up Hisense and get your firmware and to recover rename the file from

usb_9612us_no_tvcertificate_user.pkg

to

usb_9612us_no_tvcertificate.pkg

Place the file only in the root of the fat32 flash drive unplug the tv and plug in the flash drive into ideally the port that communicates with the pc and hold power on the remote and plug in the tv... It will begin to recover the Hisense tv.

I've tried 7-8 times running "adb reboot bootloader" with different ports, It goes all black and in PC's device manager, there's nothing!

if you want root privileges you can try connecting to shell via UART, I've heard that you'll be directly provided with root privileges on some hisense tv!

 

[chris1892006]

@jerrydevis Hi thx for the reply yes adb reboot bootloader goes to a black screen, thats the bootloader interface of Hisense. Test out different USB ports for detection, use your headphones if needed and make sure u hear the ding. I had a hard time getting my tv to connect hundreds of times of testing until I got it down. On my tv there are 2x usb 2.0 ports, 1 of which communicates with the tv which is the one furthest from the screen in the back, not the one closest to the screen as they are stacked usb ports. If you need some pics to help, I can help.

I left the fastboot driver I have had tremendous success with. For general adb access use the adb-setup.1.4.3.exe to install the general google driver for adb composite interface or whatever its called... lol

Let's Team Up & Root Our TVs Together!

 

[jerrydevis]

@jerrydevis Hi thx for the reply yes adb reboot bootloader goes to a black screen, thats the bootloader interface of Hisense. Test out different USB ports for detection, use your headphones if needed and make sure u hear the ding. I had a hard time getting my tv to connect hundreds of times of testing until I got it down. On my tv there are 2x usb 2.0 ports, 1 of which communicates with the tv which is the one furthest from the screen in the back, not the one closest to the screen as they are stacked usb ports. If you need some pics to help, I can help.

I left the fastboot driver I have had tremendous success with. For general adb access use the adb-setup.1.4.3.exe to install the general google driver for adb composite interface or whatever its called... lol

Let's Team Up & Root Our TVs Together!

Thnx for amazing guidance & necessary files, I'll try it and let you know very very soon!

 

[jerrydevis]

@jerrydevis Hi thx for the reply yes adb reboot bootloader goes to a black screen, thats the bootloader interface of Hisense. Test out different USB ports for detection, use your headphones if needed and make sure u hear the ding. I had a hard time getting my tv to connect hundreds of times of testing until I got it down. On my tv there are 2x usb 2.0 ports, 1 of which communicates with the tv which is the one furthest from the screen in the back, not the one closest to the screen as they are stacked usb ports. If you need some pics to help, I can help.

I left the fastboot driver I have had tremendous success with. For general adb access use the adb-setup.1.4.3.exe to install the general google driver for adb composite interface or whatever its called... lol

Let's Team Up & Root Our TVs Together!

Any way to get through this?

Edit: Done Successfully after restarting TV.

 

[chris1892006]

Great job buddy so did u unlock it?

 

[jerrydevis]

Yes, I did

 

[chris1892006]

Great job. Hopefully @theydream has time to help us all out. Good luck all! theydream determined I & possibly we have A/B partition scheme i think is the right terminology. So I tried this command but no dice. I patched my boot.img with almost all magisk & even a modded magisk and all no dice.

fastboot flash boot_b boot.img