[PATCHED BOOT.IMGs] Achieve Root on STOCK Firmware and Keep Stock APPs (2017 & 2019)

[jenneh]

Hello Friends~!

We now have a working method to achieve ROOT on STOCK Firmware!

Spoiler: GUIDE

HOW TO ROOT:
If you are already running the STOCK firmware version you want to ROOT, Skip to step 2.
(For instance If you are running stock 9.1 or 9.1.1 already, skip to step 2)

STEP 1:
Select a STOCK firmware from this THREAD, and fully install it.

STEP 2:
Download the BOOT MOD that correlates to your installed STOCK firmware.

Spoiler: BOOT MODS

If you want to build your own "Boot Mod" the instructions are HERE

Spoiler: 2019 PRO (16 GB MODEL)

Spoiler: 9.1.1

9.1.1.zip

drive.google.com

Spoiler: 9.1

9.1.zip

drive.google.com

Spoiler: 9.0

bootmod.zip

drive.google.com

Spoiler: 8.2.3

8.2.3.zip

drive.google.com

Spoiler: 2017 (16 GB MODEL)

Need someone to volunteer and obtain the 9.1 and 9.1.1 ota boots for us please!

Spoiler: 9.0

9.0.0-bootmod.zip

drive.google.com

Spoiler: 8.2.3

8.2.3-bootmod.zip

drive.google.com

If you want me to add more, let me know.

STEP 3:
Boot your shield into the Bootloader menu. Requires an unlocked bootloader See the PREREQUISITES section in this THREAD for how to do so. Unlocking your bootloader WILL erase your data

STEP 4:
Run .bootmod.bat - this will go through and erase the old boot.img partition, flash the new one, and reboot for us.
Code for reference:

fastboot erase boot
fastboot flash boot bootmod.img
fastboot reboot

STEP 5:
Download Magisk Delta HERE and name it simply "delta" if you plan to use ADB to install MIRROR

STEP 6:
Install Magisk Delta either through adb (Or install using a usb drive, network drive, or file sharing app.):

adb install delta.apk

Magisk Delta is located in Settings on the shield, apps > system apps.

Now Opening Magisk Delta will trigger this alert:

STEP 7:
Open Magisk Delta and hit the settings button at the top right

Enable ZYGISK:

Reboot Once Again and you will Now have root!

PLAYSTORE FIX IF YOUR PLAYSTORE IS MISSING APPS

STEP 1:
Download the safetynet module HERE and name it safety. MIRROR
Do whatever you have to, to get the module to your download folder.
If using adb:

adb push safety.zip /sdcard/Download

STEP 2:
Open Magisk and select the Modules button at the bottom right. The puzzle piece!
Select add a install from storage, navigate to Download, and install safety.zip, then reboot.

STEP 3:
MAGISK HIDE SETTINGS-
In magisk, under Settings, enable MagiskHide. Now select Configure MagiskHide

Click to show system apps

Then check all the settings for Google Services Framework

Then check everything under Google Play Services EXCEPT GMS <3 Thank You Noot Noot~!

Now go into the SHIELD'S Settings > APPS > and force stop and Clear Data for Google Play Services, Google Services Framework, and the Google Play Store. Reboot.

You will now have Root and still be able to use apps and features that you shouldn't be able to thanks to the safetynet bypass and magiskhide settings. Normally with root we cannot install Disney +, but as you see, we Sure Can Now~! ;-)

Remember that you can turn the safetynet module off, which may be needed to do so you can run adb as root or perform other root operations

THIS METHOD REQUIRES A FIX SO ONE COULD RUN ADB AS ROOT, I AM WORKING ON THAT FIX NOW. FOR THOSE THAT NEED <---Probably just me! =]

SPECIAL THANKS TO OUR FRIENDS IN THE XDA COMMUNITY <333
@nooted1 for teaching us about the magisk variant "delta" that has magiskhide still configured inside the apk
@ajolly for their efforts in educating us about safetynet modules that can be used within magisk
@louforgiveno for their efforts in reverse engineering apks, determining that it would be better to clear data in the google playstore instead of cache, and providing excellent feedback on pretty much every step of the way.
@abc1054 for testing the ai upscaler and teaching me how to even use the silly thing.
@Zer0_rulz for testing the upscaler and teaching us about link2sd and providing a useful idea for studies, to "freeze apps" as opposed to straight deletion in tests. I will use both methods in the future!
@pinvok3 for their script they made to teach us how to more efficiently locate the apps tied to the ai upscaler and determining the "tvsettings.apk" to potentially be culpable in jailing our upscaler. They also taught me about the dolby vision feature on the shield
@Renate for allowing me to bother her in the AVB thread while I try to learn how to talk to people like her. haha
AI UPSCALER FIX:
THERE'S SOME TROUBLE WITH THE UPSCALER STILL, THE COMMUNITY IS WORKING TOGETHER IN THE COMMENTS BELOW

Please note that this only helps you to patch your boot Easier but this does cause problems as ADB cannot be run as root and the upscaler and Dolby vision have trouble. You may want to wait for updates unless you have a reason to root with stock but otherwise feel free to join us in troubleshooting!

 

[louforgiveno]

This is great news for the Shield...the ai upscaling not working was the main reason i haven't rooted yet. Thank you for your time and efforts getting this together!
Bravo!

 

[jenneh]

@louforgiveno it's only thanks to the Community haha. I was trying to do things in a much more complicated way and thanks to nooted and renate I understand that there is no need to reinvent the wheel and we can use the tools already made. (magisk + safetynet modules shared by ajolly) [still going to do complicated things tho.. got my uart serial adapter in today. idk how to use it but will find out and or bother renate till she blocks me ]

This guide is a good reference to bypassing safetynet

--edit now after rewatching the video a few times I understand what nooted is talking about when they say this
" The Magisk Hide settings need to be set such that everything under Google Play Services is toggled on EXCEPT FOR the GMS one at the top. Also, toggle it on for Google Services Framework."

Thank you again sosososo much @nooted1 I feel so stupid I didn't realize what magisk actually is, or does. You are the reason I learned how to select the boot.img in magisk and tell it to patch it so I can share a modded image. Now I am like a million percent certain we can do something with the system and then we would have a rom after a little customizations!

 

[jenneh]

@louforgiveno 100 Percent Confirmed! Disney + is in the playstore and the ai upscaling is functional without having to relock the boot loader, YAY! Haha. The guide has been updated with the steps. It was super easy thankfully

Now I am going to learn how to get the system pulled with all of this preinstalled so we never have to do this mess. again Idk how or how long it will take but it will happen. At least folks can use this for now

 

[louforgiveno]

@louforgiveno 100 Percent Confirmed! Disney + is in the playstore and the ai upscaling is functional without having to relock the boot loader, YAY! Haha. The guide has been updated with the steps. It was super easy thankfully

Now I am going to learn how to get the system pulled with all of this preinstalled so we never have to do this mess. again Idk how or how long it will take but it will happen. At least folks can use this for now

Nice, that's great news! I'm gonna dig into this over the weekend

 

[jenneh]

HOW TO BUILD YOUR OWN "BOOT MOD":
For anyone who wanted to know how I made the boot mods I shared, so you can make it yourself if you want.

You can take the boot.img provided to us from NVIDIA and push it to your sd card.

adb push boot.img /sdcard/Download

Then use magisk to patch the image. I didn't know what this option Meant until yesterday. Haha

YOU HAVE TO DO THIS ON THE SHIELD. AN EMULATOR WILL NOT WORK; This example uses nox because I didn't feel like recording my TV

Magisk will tell you at the end what it named the file, then you could pull the image, rename it to whatever you like, and share it. (for instance i named mine bootmod.img with a batch to erase and reflash the partition)

This should work for other devices. So that's how you patch a boot now a days I guess? Idk it's how I did it

More documentation on things we can do while modding the boot:

Magisk Tools

The Magic Mask for Android

topjohnwu.github.io

Modding the adbd- a work in progress:

Patching the adb daemon to run as root

How to get root on nontraditional Android devices by patching the adbd binary.

harrisonsand.com

Spoiler: SIDENOTE

A Sidenote. Something funny I discovered. DON'T Do this haha.

IDK why it is but, if you push the build.prop from the ROOT 8.2.3 to the stock version, it crashed it in an interesting way. After reseting, the shield would post to the nvidia logo, make it to the google logo, crash, reboot to nvidia logo then android literally died. Haha.

Whereas, if you sent the STOCK build.prop to the ROOT system, it would not crash, and would instead allow you to do some things you normally couldn't, like download the 9.1 OTA package

 

[ajolly]

Fantastic, glad it worked out. Thanks for testing it!
I mostlly want to go run cf.lumen on my shield to help with sleep.


Btw, I suspect patching the boot.img will work on any device with the same architecture - ie your phoe.

 

[jenneh]

Btw, I suspect patching the boot.img will work on any device with the same architecture - ie your phoe.

And probably QEMU the arm architecture version too! <--Idk how to use the arm qemu yet but I have some videos stored away and some ambitions to build a proper android vm that is arm based and open source, and wont plant crap all over your drive! lol.

this man is a god send but that would be more so if you wanted to do a one for one of a dump. Mine would be based off aosp

 

[ajolly]

And probably QEMU the arm architecture version too! <--Idk how to use the arm qemu yet but I have some videos stored away and some ambitions to build a proper android vm that is arm based and open source, and wont plant crap all over your drive! lol.

this man is a god send

Why do you want that? You’d end up converting arm code to run on x86, way more efficent to just run an x86 version.

But if you really want, its possible - https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html

 

[jenneh]

Why do you want that? You’d end up converting arm code to run on x86, way more efficent to just run an x86 version.

But if you really want, its possible - https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html

I want to do it to know how to, haha. not really for anything practical right now, just for practice. and Thank You so much!!

 

[ajolly]

I want to do it to know how to, haha. not really for anything practical right now, just for practice. and Thank You so much!!

i have not extensively tested it, but it seems like windows subsystem for android (on windows 11) includes an arm emulation layer. Overall its one of the nicest android emulation experiences, at the downside of not supporting all functionality properly - like notifications.

 

[abc1054]

The rooting worked good, but ai upscaling does not work, I have tried your instructions. When I went to test out a video , it would only put it to basic not al-upscaling. I put it to enhance it says yes. But it's same as basic, no change in inhanced. And no to ai-enhanced. I did all the instructions that was given on this site. So I put back my Nvidia shield tv pro back to 9.1.1. thanks for all your hard work. ,. Hope someone figure it out for Ai-enhanced.

 

[jenneh]

The rooting worked good, but ai upscaling does not work, I have tried your instructions. When I went to test out a video , it would only put it to basic not al-upscaling. I put it to enhance it says yes. But it's same as basic, no change in inhanced. And no to ai-enhanced. I did all the instructions that was given on this site. So I put back my Nvidia shield tv pro back to 9.1.1. thanks for all your hard work. ,. Hope someone figure it out for Ai-enhanced.

Your message you mailed said you used 480 p video so no that would not work. I tried the same thing with little house on the prairies and then read an article that said to use 720p or 1080p

 

[abc1054]

Your message you mailed said you used 480 p video so no that would not work. I tried the same thing with little house on the prairies and then read an article that said to use 720p or 1080p

I also tried it on 720p , and 1080p

 

[jenneh]

@abc1054 Not sure then. This is still new so as more people test things and report their results we can work out the kinks. I know some people were waiting till the weekend. Thank you for trying.

 

[abc1054]

I thank everyone that has contributed to this project. Thanks for all your hard work.

 

[abc1054]

I reinstall the Nvidia shield tv pro 9.1.1 and rooted it, everything works but the ai upscaling, and time before I installed 8.2.3. Even checked the safetynet and was all good. So I don't get why Ai upscaling don't work. Did everything in this forum. I'm confused, if someone ever tested it, with upscaling.. it does not work. Sorry. Test it twice now. No go. Video on 720p and 1080p. Thanks again.

 

[abc1054]

I have notice that google play is not certified. With the settings that was given above.

 

[abc1054]

I have notice that google play is not certified. With the settings that was given above.

Google play is uncertified.. but rooted. When tested safety net was passed.. but play store is uncertified.. maybe its the problem of AI up scaling.

 

[Zer0_rulz]

Clean installed 9.0 then manually updated 9.1.1, then did the instruction here, and got this result