Philips Android TV

Search This thread
By:
Advanced…
M

Matt17000

Senior Member
May 26, 2010
82
8
Hi Guy,

I recently buy a Android TV Philips PUS7909. It's an android tv based with 4.2.2 on board, unfortunatly Philips make the choice to block LOTS of android function...

I can't install unallowed apps, enabling dev mod....

I just want to know if someone here have this tv, or another philips android tv, and if someone can root it etc etc :D

Yes i know, it's not even christmas , but maybe someone can do amazing thing on android tv, specially on xda !
 
M

mc4ren

Senior Member
Dec 17, 2007
62
4
I too have a PUS7909/12 Android TV and I was disappointed by several things, one of them being unable to install most of Store apps. Rooting would be great as at least it would allow to install .apk files.
 
M

Matt17000

Senior Member
May 26, 2010
82
8
New update for this tv soon :

The new Firmware will soon be live.

AND1E_0.9.32.118 (Date published: 2014-11-21)
• HDMI EDID adaptions for Full HD <-> Ultra HD interoperability ( DISCONNECT HDMI cables before starting the upgrade)
• 3D fixes

Maybe we can do something with the update files.....
 
M

mc4ren

Senior Member
Dec 17, 2007
62
4
Should Philips provide the source code of its Android implementation? Are they under the obligation to provide it?
 
  • Like
Reactions: numa001
T

tontsa74

New member
Feb 14, 2013
4
3
Matt17000 said:
Hi Guy,

I recently buy a Android TV Philips PUS7909. It's an android tv based with 4.2.2 on board, unfortunatly Philips make the choice to block LOTS of android function...

I can't install unallowed apps, enabling dev mod....

I just want to know if someone here have this tv, or another philips android tv, and if someone can root it etc etc :D

Yes i know, it's not even christmas , but maybe someone can do amazing thing on android tv, specially on xda !
Click to expand...
Click to collapse

Hi,
I read one comment from Finnish netshop, it's for 55pus8809 model:

1. Install "Developer Tools" from play shop
2. Choose "Developer settings"
3. Switch developer options "on"
4. And "Show more apps in Google Play"
5. Reboot TV

Install "Set orientation" from play to orientation problems, switch "Landscapen" on.

I don't have Philips TV, but planning to buy one :)
Here is link to source, I don't know how it works...

verkkokauppa.com/fi/product/16035/dxskv/Philips-55PUS8809-55-Smart-Android-4K-Ultra-HD-3D-LED-televi#BVRRWidgetID

Lähetetty minun Nexus 5 laitteesta Tapatalkilla
 
  • Like
Reactions: xodeus and Blackdragon77
M

mc4ren

Senior Member
Dec 17, 2007
62
4
I tried this, and it's true that some more apps are shown. Would be great to load apk files, but there is no "unknown sources" option...
 
Burn2Hell

Burn2Hell

Senior Member
Jul 29, 2011
127
18
Tilburg
I have the Philips 48PFS8109.

Developer options are enabled, but there is just no way to enable 'unknown sources'.
With the Google Search function the Settings options is not showing (it works on phones if you search settings)
Not a single application is compatible that gives me a shortcut to settings.

If i try to install an .apk file i get the message you need to go to settings and allow it. There is an Settings and Cancel, but if i press on settings nothing happens.


Does someone know a way to call up the settings menu with Therminal Emulator?

I already updated the tv but do you guys think its possible to just add an .apk file in the .upg file?
I can change the .upg to .zip and add an app in the system folder.
 
Last edited:
C

christian_cvi

Member
Dec 1, 2014
5
19
Steps for install any APK in 2014 Philips Android TV AND1E

Hello,

For install any application in 2014 Philips Android TV AND1E :

1º You must download "Developer Settings" from "Google Play" and enable "Usb Debugging" in "Developer options".
2º Connect ADB via WIFI -> adb start-server" , adb connect IP:5555
3º Install APK -> adb install "app.apk" (download apk from google play with evozzi apk downloader in web or in chrome extension)

I've tried it in 55PUS8909 and it works!.

I've tried for root framaroot, towelroot and vroot and exploits not run.
I've tried all for "Unknown Sources" and nothing.

sorry for my english....thanks, regards!
 
  • Like
Reactions: SigmundDroid, dumitrudan608, Xtrap0 and 8 others
C

christian_cvi

Member
Dec 1, 2014
5
19
Updated -- Enable "Unknown Sources" in Philips Android TV

Hi, to enable Unknown Sources:

Download "QuickShortCutMaker" from Google Play with "evozi apk downloader".
Install application via ADB WIFI (previous post).
Search Activities - Settings - Security
Press with Remote Pointer in Security and press in "Try" and this launch security activity to enable option.

Regards ;)
 
  • Like
Reactions: filippo62, vagedis, Xtrap0 and 5 others
M

mc4ren

Senior Member
Dec 17, 2007
62
4
I'm eager to try that! I have the TV disconnected right now, but that's something to try. Thanks for sharing that info
 
  • Like
Reactions: lscshareware
G

gotohosting

New member
Dec 3, 2014
1
0
christian_cvi said:
Hello,

For install any application in 2014 Philips Android TV AND1E :

1º You must download "Developer Settings" from "Google Play" and enable "Usb Debugging" in "Developer options".
2º Connect ADB via WIFI -> adb start-server" , adb connect IP:5555
3º Install APK -> adb install "app.apk" (download apk from google play with evozzi apk downloader in web or in chrome extension)

I've tried it in 55PUS8909 and it works!.

I've tried for root framaroot, towelroot and vroot and exploits not run.
I've tried all for "Unknown Sources" and nothing.
Click to expand...
Click to collapse

Thanks for sharing! Working like a charm! :good:
Tested on Philips 49PUS7909/12
 
M

mc4ren

Senior Member
Dec 17, 2007
62
4
christian_cvi said:
Hi, to enable Unknown Sources:

Download "QuickShortCutMaker" from Google Play with "evozi apk downloader".
Install application via ADB WIFI (previous post).
Search Activities - Settings - Security
Press with Remote Pointer in Security and press in "Try" and this launch security activity to enable option.

Regards ;)
Click to expand...
Click to collapse

This also works! Thanks so much
Tested on 49PUS7909/12
 
S

snoerenberg

Member
Jan 19, 2009
10
3
Hi,
that sounds good :)

I had a look into the updater-binary (firmware/manual/ambilight-fix update zip file) and the firmware is, as we already know, encrypted.
When you have a look with IDA Demo (hex-rays.com) you can see that the encryption key is taken from: "/res/keyfile.txt" which must remain somewhere on the TV.

AES-256-CBC is used and the key/IV is somehow, depends on the content of the keyfile.txt, MD5 sum of the content lines (e.g. one for key, one for IV).
 
  • Like
Reactions: fritzfs and ivantomas
M

Matt17000

Senior Member
May 26, 2010
82
8
O M F G

I was on vacation for two weeks and i don't check this topic and what the hell is going on !

What a surprise for me to see what you do here !

Thanks a lot guys !

-----EDIT-------

The method to allow unknow source and install apk via adb working, thank you !

Tryed to install xbmc/ kodi but the launch and just crash, so bad. But that sound good !

-----EDIT 2------

There is a bluetooth option..... i can't connect my dualshock 3 on the tv because we need root for sixaxis controller app..... let's go to install some emulator !

------EDIT 3------

So... After some test, i was able to connect the duaslhock 3 controller in usb, BUT not all touch is recognised. So i can't play Mario Bros on Retroarch. I think i need another controller.

Kodi v14 lastest nightly boot but crash at home screen.

That's all for the moment !
 
Last edited:
L

lazik

Senior Member
Mar 11, 2007
214
38
PLandia
Tested some apps.
AngryBirds - not working
World Of Tanks Blitz - works OK
QuickPic - works OK

Antutu score 22200 but all graphic test is in resolution 1280x720 :(

Towellroot and framaroot like mentioned above want work. and root is most important ...

More investigations:
recovery mode on TV have only 2 options:
- restart system
- update system from sdcard

From:
- adb reboot download
- adb reboot recovery
is possible to do this steps?

->adb push busybox /data/local/tmp
->adb push su /data/local/tmp
->adb push Superuser.apk /data/local/tmp

adb shell
->chmod 755 /data/local/tmp/su
->chmod 755 /data/local/tmp/busybox
->chmod 644 /data/local/tmp/Superuser.apk

and copy above files to:
/system/bin
/system/app
???????
 
Last edited:
M

Matt17000

Senior Member
May 26, 2010
82
8
Just installed Twitch and it's working great. But it's only stremead in full hd, so it's not very good on the screen, but it's work !

Someone have try to install a video player that can handle 4K files ?
 
Burn2Hell

Burn2Hell

Senior Member
Jul 29, 2011
127
18
Tilburg
I have the '48PFS8109/12' and tryed also some things.
- 13.2 Gotham XBMC (kodi) not working, my tv starts the app and after a few seconds the app crashs and the tv volume goes to 60.
- Kodi 14.0 “Helix” – RC 2 not working, my tv starts the app and after a few seconds the app crashs and the tv volume goes to 60.
- Kodi 14.0 “Helix” – Nightly not working, my tv starts the app and after a few seconds the app crashs and the tv volume goes to 60.

I use 'MX Player' with the DTS codec, i don't know if that player can handle 4K, i know that they say KODI can do 4K.
 
You must log in or register to reply here.

Similar threads

smartcard2
TCL Android TV model 55p8m / Android Recovery TCL/BeyondTV/BeyondTV
Replies
4K
Views
993K
L
lexus46
brar.arsh
Sony Android TV Users
Replies
2K
Views
694K
oldman20
oldman20
ovso
  • Poll
[GUIDE] Continuous restart / bootloop fix for Philips Android TV with Wipe Data Tool
Replies
287
Views
275K
Toengel
Toengel
ovso
  • Poll
[GUIDE] How to root 2015 Philips Android TV
Replies
324
Views
194K
C
Claufecam
stasiof
TCL 2021 Android TVs (C05/G05/BeyondTV6/BeyondTV4)
Replies
2K
Views
444K
V
vdelibertad

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 13
    kalinskym
    kalinskym
    Guys! To disable Philips Collections bar or also known as Philips Apps Tray at top of Android TV leanback launcher. All you have to do is find leanbackcustomizer in System Apps or Running Apps and turn off its notifications which can be turned off at button of the menu when you click on the service.

    I couldn't find a single source which mentioned these steps to take to disable Philips bloatware. I figured these out on own. I am not aware of any other methods that has the same results.

    Enjoy your less of a pain Android TV by Philips

    Hope this helps.

    ---------- Post added at 02:03 AM ---------- Previous post was at 01:56 AM ----------

    To disable recommendations, disable org.droidtv.nett_launcherapp in system apps or running apps. Hope this also helps debloat your Philips Android TV to a manageable level. However, this doesn't get rid of the recommendations field only apps that shows up.
    View
    11
    M
    mr_purple
    firmware decryption + rooting attempts

    #################################
    WARNING: don't look at the following information nor try to use any of it if you have no clue about linux or android as it is most likely that you are going to break your expensive gadget. For every one else: don't blame philips if you brick your device -> think before actually trying. If you post about vulnerabilities and stuff better cover your ass - who knows what the legal department of philips thinks about your cool stuff.
    #################################

    So as you decided to ignore my warning, here we go:

    I already spent plenty of time researching the internals of the device in order to get root privileges. Unluckily without the final breakthrough - but at least I found out some very interesting details.

    You might ask what those extended privileges should be good for? Well in my eyes android - a project available as open source with uncountable possibilities for developers and users - should not be closed down by profit oriented manufacturers. As those are often forcing the users into their own "crappy" software without given them any chance to escape. I like to develop at system base, use the underlying linux tools and most important check what the manufacturer does (behind my back) in my own living room. Hell I bought this expensive device and have no idea and can't nearly control what is sent to Philips nor Google.

    1. I wrote a tool to decrypt the official firmware. It was created via reverse-engineering the "upgrade.bin" arm-file (thanks for the trace, snoerenberg).

    Some interesting details about the used cryptography:
    - openssl library functions
    - used algorithm: aes-256 in CBC mode
    - the encryption key is generated via "EVP_BytesToKey" using only the first 127 byte of the keyfile + an eight byte salt found near the beginning of every input file

    Source-Code: attachment or pastebin_com / z3nA2r3J
    maybe mirroring this paste and the source would be a good idea (Google for the HASH if link is down)

    The decrypted firmware archive contains the following files:

    boot.img.zip: kernel + initrd + ramdisk (unknown file format)
    bootloader.zip: bootloader (unknown file format)
    tzk_normal.img.zip: ? maybe recovery (unknown file format)

    user_setting.zip: content of /user_setting
    system.img.zip: content of /system (ext4-img)
    firmware.img.zip: content of /firmware (ext4-img)

    BackEndBin.zip, EdidBin.zip, fpgaUhdBin.zip, RougeBin.zip: different binary files - supposedly firmware for these components

    As you see I was not able to extract the most interesting part (kernel + ramdisk) - Hopefully some android experts could help!

    The current and some older firmware files could be downloaded at philips_samipupu_com (thanks for hosting)

    2. General information:
    - Kernel version: Linux version 3.4.70+ ([email protected]) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Fri Nov 14 01:52:21 IST 2014
    - Kernel cmd-line: androidboot.hardware=AND1E quiet lpj=11935744 root=/dev/ram0 androidboot.console=ttyS0 console=ttyS0,115200 init=/init vmalloc=448M quiet macaddr=00:00:00:00:00:00 emmc_ts.dev_id=1 emmc_ts.size=16777216 emmc_ts.erasesize=524288 emmc_ts.writesize=512
    - lsmod:
    usb8797 359014 3 - Live 0x00000000
    usb97mlan 290809 1 usb8797, Live 0x00000000 (P)
    mbtusbchar 52685 0 - Live 0x00000000
    usbfwdnld 8530 0 - Live 0x00000000
    fusion 96777 0 - Live 0x00000000 (O)
    tpvinput 7132 2 - Live 0x00000000 (O)
    trcext 333860 0 - Live 0x00000000 (O)
    gal3d 161434 16 - Live 0x00000000
    amp_core 72528 2 - Live 0x00000000 (O)
    tzlogger 1199 0 - Live 0x00000000 (O)
    tzd 32013 30 amp_core,tzlogger, Live 0x00000000 (O)

    3. The trcext module seems to be very interesting as a short look with a disassembler revealed that it might be able to read and manipulate process memory of any process. Maybe someone good at kernel-drivers could take a look?

    4. There are two world-readable directories containing very interesting information:
    - /data/debugdump: stack-traces, process-lists, short memory excerpts based on crashes of the native binaries (could be very helpful for exploiting)
    - /data/anr: davlik crash-dumps of android applications

    5. There are 3 SGUID and 1 SUID binaries (visible):
    -rwxr-s--- root inet 5500 netcfg
    -rwxr-sr-x root net_raw 26072 ping
    -rwsr-s--- root shell 9464 run-as

    6. The recovery menu which could be used to install a "new" firmware if the device does not boot properly could be reached via the following steps:
    - unplug the power
    - press and hold the joypad on the backside of the TV downwards
    - replug
    - release the joypad after 10 sec

    7. There is a Customer-Service-Menu at “123654” which contains read only information about the current firmware and so one. However there is also the real service menu (062?96i) which could be used for much more things. But you need to be really careful with this, i already managed to break booting without changing something important.

    8. The settings-app calls the "su" command inside of CSMActivity. If this is no obsolete debug code (i was not able to trigger this part yet) than there could be a "su" inside /sbin. The Manifest also shows this strange "org.droidtv.tv.tv_power_system_access" permission. Therefore i tried to write my own app with the same permission and call "su" which did however not work out (even if I use the same namespace org.droidtv.?)

    9. Every time you pop in an usb stick android creates an backup folder on it. The filenames are "hidden" via base64 and there are some junk bytes at the beginning of the files which you need to crop in order to read them. However the content is quite boring mostly some sqlite3 databases with configuration parameters.

    10. By default the usb sticks you plug in is read-only for user apps. However there is in option in the settings to re-format it. This will result in an XFS formatted, read-write mounted stick where you could even outsource your apps.

    11. There is a soap (http) service running on port 1925 which is used by the philips remote app and allows different things for example starting one of the installed apps. More details could be found if you decompile the XTV-App.


    Hope some of you guys could do something fancy with those information.
    @snoerenberg(xda): did you manage to send commands over your cable yet - If you do rooting should be quite easy from this point (maybe /system/bin/run-as).

    Cheers,
    5003b4d49cbf7916123271b7b1918f123cca0c09bf1428f4398257751ac6570c

    ps: some of the information were dumped on an older firmware and some with the current one
    View
    11
    C
    christian_cvi
    Steps for install any APK in 2014 Philips Android TV AND1E

    Hello,

    For install any application in 2014 Philips Android TV AND1E :

    1º You must download "Developer Settings" from "Google Play" and enable "Usb Debugging" in "Developer options".
    2º Connect ADB via WIFI -> adb start-server" , adb connect IP:5555
    3º Install APK -> adb install "app.apk" (download apk from google play with evozzi apk downloader in web or in chrome extension)

    I've tried it in 55PUS8909 and it works!.

    I've tried for root framaroot, towelroot and vroot and exploits not run.
    I've tried all for "Unknown Sources" and nothing.

    sorry for my english....thanks, regards!
    View
    9
    Toengel
    Toengel
    Hi,

    Android TV 8 (Oreo) is coming to Philips TV: https://toengel.net/philipsblog/2018/06/27/philips-2014-2018er-tvs-erhalten-android-tv-8-oreo/

    [email protected]
    View
    8
    ovso
    ovso
    [GUIDE] How to root 2015 Philips Android TV

    [GUIDE] How to root 2015 Philips Android TV moved to separate thread here

    Please vote regardless you were successful with rooting or not...
    View

New posts