Philips Android TV

Search This thread
I have the 75 inch 75PFL5604 and was just able to unlock the bootloader and such. I hadn't taken any updates before the unlock. Problem is I can't get the tv into preloader mode to dump the full firmware. It's using an MTK Soc. My next step is to possibly tear the tv apart a bit to short some pins to force it into preloader mode, at which point I should be able to dump it with Mtk Client, build a TWRP for it and have a custom recovery on my Android tv. From there I would pry want to do some sort of custom stock rom for it. What do you guys think? Anyone else have this tv and want to coop on a project?
 

Attachments

  • photo_2022-05-07_14-06-14.jpg
    photo_2022-05-07_14-06-14.jpg
    78.3 KB · Views: 167
  • photo_2022-05-07_14-06-21.jpg
    photo_2022-05-07_14-06-21.jpg
    74.1 KB · Views: 165
  • photo_2022-05-07_14-06-30.jpg
    photo_2022-05-07_14-06-30.jpg
    123 KB · Views: 143
  • photo_2022-05-07_14-06-40.jpg
    photo_2022-05-07_14-06-40.jpg
    221.6 KB · Views: 165

BabyPantre

New member
May 24, 2022
2
0
Hi, my Philips displays the logo and nothing else besides the LED blinking about twice a second. I have tried numerous things and I cannot make it work, but I feel somewhat close. Do you know how to fix it?

The facts: the outside sticker says it's a 55PFL6158K/12, however, the mainboard and the remote were replaced some time ago.

I have been able to go into recovery mode where it says this (see the photo):
Code:
PHILIPS/QM16XE_F/QM16XE_F
7.1.2/N2G48H/01610224
user/test-keys
Any button cycles highlight.
Long-press activates.
------
Reboot system now
Apply update from SD card
Wipe cache partition

Now for the speculation: I think (based on what I read in @Toengel 's site and a local technical shop for Phillips that they probably did the "Fusion kit" upgrade when they repaired the board (based on looking at the remote with the Netflix button).

I talked with Phillips and got first the NVM.bin file and later the FUS_QM164E_16.102.24_prod.zip file as well as the upgrade_loader.pkg, upon really insisting that it was probably not the original model board and it was the 55PFL6158S/R1 with a QM16.4 chassis.

Things that I have tried:
  • I tried the autoupgrade for the original model (went to recovery with a single line mount error displayed, IIRC)
  • All the above files for the 55PFL6158S/R1
  • None of the upgrade_loader.pkg are seemingly recognized at all (from Phillips or Toengel's), even a downgrade to QM164E_0.16.56.3_upgrade_loader.zip I got from @Toengel's site does not seem to be picked up for installation.
  • With the autorun.upg files (specially the one) there is some indication that the TV notices them but the only indication is that the logo disappears and eventually
  • I tried wiping the cache partition and that appeared to work without errors when I tried it. I attach a recovery.log file that one of them produced, in case it helps (it has lots of details)
  • I tried to connect via USB and adb says there are no devices connected. I tried the USB3 connector and it charges my laptop but does not seem to connect for data
  • The USB2 connectors are also not responding to adb
  • I tried connecting it via ethernet and my DHCP server does not register any request for IP
  • Because the WiFi was for a different location, it's not connecting here and I am not sure how to change it. I heard here that it's possible to connect adb via network, but only on WiFi, is that correct?
  • I tried various wipedatatool.upg (or some with .zip) for models that looked close, but I never found a wipedatatool for the model of the baseboard. Is there one for this baseboard? I asked Phillips support but they are so so hard to crack and they always say no no no (until I press for more, since my other option is to trash the tv).
  • When I put two USB sticks in at the same time in the USB2 ports, I can see one in the "apply update from SD card" however, nothing works when attempted from there, although maybe I was not exhaustive with that.
  • I have been able to boot to recovery from pressing with DOWN button on the back of the screen, but only once and never again. Any ideas as to how to do this reliably?
I think I tried more things perhaps, but I did not take notes, so maybe I forgot.

I used to do some Android dev and I am technical. However, I am not sure if I can get any "pacakge" to reinstall the system or clean it up. Or even see console logs through adb or something.

Any advice on how to save this system and TV will be appreciated!! Thanks in advance!!

Update: I opened the back and saw a sticker on the board that says 42PFL6008S/R1 which confirms the suspicion it is an /R1 upgrade. Photo attached. However, since it appears that has the same firmware, it does not change things much, perhaps?
Dear Ihama,

i've ran in to the exact same problem as you have. I also took my TV apart and it showed the exact same motherboard as shown on your pictues. I've got my hands on a rare file that alot of companies don't want to share because they aren't allowed to by Phillips! still, after alot of calls and emails i've managed to get my hands on the original file! https://drive.google.com/u/0/uc?id=1YrX4JSqeSebYe9yMN77nC1frpbF2bHig&export=download please let me know if it worked for you!
 

Liki86

New member
May 30, 2022
3
0
hello I have a TV 65PUS8545 and I have a problem with the remote control, my voice search is not working. Restarting the TV failed and pairing failed. Tried to replace the batteries but again without success. Has anyone else encountered this problem
 

Liki86

New member
May 30, 2022
3
0
Здраво,

морате да упарите даљински да би РЦ радио (због тога што микрофон ради са БТ). Мислим да можете "ресетовати" РЦ у подешавањима ТВ-а.

Тоенгел@Алек
Све сам тако радио, али ништа не помаже, само преко телефона и апк гоогле тв-а ради наредба гласовне претраге. Зар није могуће до новог даљинског ажурирања
 

Liki86

New member
May 30, 2022
3
0
Све сам тако радио, али ништа не помаже, само преко телефона и апк гоогле тв-а ради наредба гласовне претраге. Зар није могуће до новог даљинског ажурирања
I did everything like that, but nothing helps, only over the phone and apk google tv does the voice search command. Isn't it possible until a new remote update
 

tlc76

Senior Member
Dec 8, 2006
69
62
Bucharest
Hello @Toengel,

I have a 49PUS7100/12 tv and I installed the latest firmware from your website, version QV151E_000.006.172.000.
After the upgrade, each time I turn on the TV the sound is interrupted and the pitch of the voices is higher than normal.
As a temporary fix, I turn off the TV plug, turn it back on and the TV is working correctly until the next soft power off.

I tried to install the latest official firmware (QV151E_R0.5.38.219) but unfortunately I cannot do it because of the Marvell chipset (no upgrade_package available for this model).

Is there any chance you could look into the problem and maybe compile a fix (a newer version that can be installed via the normal USB upgrade process)?

thanks a lot,
Cristian
Hi Alex,

I couldn't find a fix for this issue and the TV is really annoying to use - everytime I turn it on, the sound is laggy/interrupted and the voice pitch is higher than normal, so I have to do a "cold restart" (basically unplug/replug the TV from the 220V wall socket).

I cannot force a downgrade and I cannot update the firmware (as I am already on the latest version, the one with HEVC x265 codec, QV151E_000.006.172.000).

Is there any chance that I could go back to the previous firmware (QV151E_R0.5.38.219) that worked fine?

many thanks,
Cristian
 

Toengel

Senior Member
Oct 26, 2017
342
160
toengel.net
Hi,

1) Disconnected the TV from power
2) Press the local joystick downwards (keep it pressed) and connect the TV to power
3) Keep the joystick still pressed for about 5 seconds before you release
4) TV start up with the recovery screen

Install the old version via "apply update via SD" - when everything worked, make a factory reset!

[email protected]
 

djtaotao

New member
Dec 2, 2010
1
0
Hello,

Can you please help me to disable HDR for Phillips Ambilight 43pus8106/12? Is it possible via secret service menu? How can I acces this menu? I have tride some codes from internet but no success...
 

tlc76

Senior Member
Dec 8, 2006
69
62
Bucharest
Hi,

1) Disconnected the TV from power
2) Press the local joystick downwards (keep it pressed) and connect the TV to power
3) Keep the joystick still pressed for about 5 seconds before you release
4) TV start up with the recovery screen

Install the old version via "apply update via SD" - when everything worked, make a factory reset!

[email protected]
Thanks a lot, it worked flawlessly!
You are a life saver!
I checked the new firmware version and it has been downgraded to QV151E_R0.5.38.219.

many thanks once again!
Cristian
 

Attachments

  • IMG_20220704_005853.jpg
    IMG_20220704_005853.jpg
    1.5 MB · Views: 57
  • IMG_20220704_005940.jpg
    IMG_20220704_005940.jpg
    1.4 MB · Views: 58
  • IMG_20220704_010112.jpg
    IMG_20220704_010112.jpg
    1.2 MB · Views: 57

suji01

New member
Oct 5, 2017
2
0
Hello all,

Facing 2 issues with my new Philips android tv 70PUT7906.
1 - Internet speed through ethernet is below 100 Mbps even though I get close to 300 Mbps through Wifi.
2 - TV hangs when using USB ethernet adaptor..

Software version TPM215E_R,001.001.220.202
 

AmateurPAL

Member
Mar 28, 2021
11
0
Hi all,

Is there any chance of getting Android 10 or 11 update for Philips 50PUT8215/94 or 8200 series in general? It has the TPM191E firmware and TPM20.1A LA chassis. No response from their customer care email.
 
Last edited:

Jamjaw

New member
Jul 14, 2022
1
0
Hi all - looking for help. Our TV 43pus7303, got stuck in Philips boot logo last night. Have tried upgrade.pkg but no dice, shows updating software but after reboot it just shows faint coloured dots. I suspect we have a broken
 

pythonimus

Senior Member
May 1, 2015
78
8
Hiho, I hope anyone knows about my problem.

I bought a 65PUS8505 and have questions regarding the settings.
All settings I change in "Android settings" get reset after 1-2 days. Screensaver, TV name, ..., whatever. If I change anything here, after the TV stays some time in standby or get powercycled is reset to default again.

Does anyone know of a solution to this? Philips support is ultimately useless and has only advised me to install the latest software update again and reset the TV to factory settings (which I did, did not work obviously...).
 

Tomcatdc

New member
Jul 20, 2022
1
0
Hi, recently my 65PUS7601 decided not to start anymore.
After power-on the PHILIPS shield logo under the screen lights up, red LED blinks softly while OS is booting, stops normally after a while, no LED Level 1 errors.
But - no backlight (BL), no PHILIPS logo on the screen, no picture, no Ambilight!

I could attribute backlight fault to BL controller and/or LEDs, but why no Ambilight at the same time? Ambilight is powered separately, from mainboard itself, right?
I've run service updates (upgrade_loader.pkg and autorun_*.upg) with different versions, same behaviour - USB stick LED blinks for about 20 minutes, then PHILIPS shield turns off, then on, the TV goes to standby. After power-cycle everything is the same - no picture, no ambilight.

Since the recovery.log (attached) is being written, basically Android is alive on the board, I presume? What should I look for in that log?
Tried to Set Option Code - seems to react normally (?), after some delay shield goes off then on, etc. But still no picture, no Ambilight.

Checked Pin 2 (BL on/off) on the main connector from SSB to PSU - it remains low. Have pulled it up - after that had power on both BL LED driver boards (approx. 18V) but still no backlight.
The BL LED drivers are being controlled via small flat cable coming from mainboard - means no signal?

I'm going to get the boot log with SERV.U serial port but have to find a suitable connector first...

Maybe meanwhile someone has an idea what's going on and where to check else?

Thanks!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    hola atravieso el mismo problema, lograste solucionar el tuyo,
    Podrías ayudarme por favor?
    Google Translation:
    Hello, I'm going through the same problem, did you manage to solve yours? Could you help me please?
    Please use English on XDA
  • 13
    Guys! To disable Philips Collections bar or also known as Philips Apps Tray at top of Android TV leanback launcher. All you have to do is find leanbackcustomizer in System Apps or Running Apps and turn off its notifications which can be turned off at button of the menu when you click on the service.

    I couldn't find a single source which mentioned these steps to take to disable Philips bloatware. I figured these out on own. I am not aware of any other methods that has the same results.

    Enjoy your less of a pain Android TV by Philips

    Hope this helps.

    ---------- Post added at 02:03 AM ---------- Previous post was at 01:56 AM ----------

    To disable recommendations, disable org.droidtv.nett_launcherapp in system apps or running apps. Hope this also helps debloat your Philips Android TV to a manageable level. However, this doesn't get rid of the recommendations field only apps that shows up.
    11
    firmware decryption + rooting attempts

    #################################
    WARNING: don't look at the following information nor try to use any of it if you have no clue about linux or android as it is most likely that you are going to break your expensive gadget. For every one else: don't blame philips if you brick your device -> think before actually trying. If you post about vulnerabilities and stuff better cover your ass - who knows what the legal department of philips thinks about your cool stuff.
    #################################

    So as you decided to ignore my warning, here we go:

    I already spent plenty of time researching the internals of the device in order to get root privileges. Unluckily without the final breakthrough - but at least I found out some very interesting details.

    You might ask what those extended privileges should be good for? Well in my eyes android - a project available as open source with uncountable possibilities for developers and users - should not be closed down by profit oriented manufacturers. As those are often forcing the users into their own "crappy" software without given them any chance to escape. I like to develop at system base, use the underlying linux tools and most important check what the manufacturer does (behind my back) in my own living room. Hell I bought this expensive device and have no idea and can't nearly control what is sent to Philips nor Google.

    1. I wrote a tool to decrypt the official firmware. It was created via reverse-engineering the "upgrade.bin" arm-file (thanks for the trace, snoerenberg).

    Some interesting details about the used cryptography:
    - openssl library functions
    - used algorithm: aes-256 in CBC mode
    - the encryption key is generated via "EVP_BytesToKey" using only the first 127 byte of the keyfile + an eight byte salt found near the beginning of every input file

    Source-Code: attachment or pastebin_com / z3nA2r3J
    maybe mirroring this paste and the source would be a good idea (Google for the HASH if link is down)

    The decrypted firmware archive contains the following files:

    boot.img.zip: kernel + initrd + ramdisk (unknown file format)
    bootloader.zip: bootloader (unknown file format)
    tzk_normal.img.zip: ? maybe recovery (unknown file format)

    user_setting.zip: content of /user_setting
    system.img.zip: content of /system (ext4-img)
    firmware.img.zip: content of /firmware (ext4-img)

    BackEndBin.zip, EdidBin.zip, fpgaUhdBin.zip, RougeBin.zip: different binary files - supposedly firmware for these components

    As you see I was not able to extract the most interesting part (kernel + ramdisk) - Hopefully some android experts could help!

    The current and some older firmware files could be downloaded at philips_samipupu_com (thanks for hosting)

    2. General information:
    - Kernel version: Linux version 3.4.70+ ([email protected]) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Fri Nov 14 01:52:21 IST 2014
    - Kernel cmd-line: androidboot.hardware=AND1E quiet lpj=11935744 root=/dev/ram0 androidboot.console=ttyS0 console=ttyS0,115200 init=/init vmalloc=448M quiet macaddr=00:00:00:00:00:00 emmc_ts.dev_id=1 emmc_ts.size=16777216 emmc_ts.erasesize=524288 emmc_ts.writesize=512
    - lsmod:
    usb8797 359014 3 - Live 0x00000000
    usb97mlan 290809 1 usb8797, Live 0x00000000 (P)
    mbtusbchar 52685 0 - Live 0x00000000
    usbfwdnld 8530 0 - Live 0x00000000
    fusion 96777 0 - Live 0x00000000 (O)
    tpvinput 7132 2 - Live 0x00000000 (O)
    trcext 333860 0 - Live 0x00000000 (O)
    gal3d 161434 16 - Live 0x00000000
    amp_core 72528 2 - Live 0x00000000 (O)
    tzlogger 1199 0 - Live 0x00000000 (O)
    tzd 32013 30 amp_core,tzlogger, Live 0x00000000 (O)

    3. The trcext module seems to be very interesting as a short look with a disassembler revealed that it might be able to read and manipulate process memory of any process. Maybe someone good at kernel-drivers could take a look?

    4. There are two world-readable directories containing very interesting information:
    - /data/debugdump: stack-traces, process-lists, short memory excerpts based on crashes of the native binaries (could be very helpful for exploiting)
    - /data/anr: davlik crash-dumps of android applications

    5. There are 3 SGUID and 1 SUID binaries (visible):
    -rwxr-s--- root inet 5500 netcfg
    -rwxr-sr-x root net_raw 26072 ping
    -rwsr-s--- root shell 9464 run-as

    6. The recovery menu which could be used to install a "new" firmware if the device does not boot properly could be reached via the following steps:
    - unplug the power
    - press and hold the joypad on the backside of the TV downwards
    - replug
    - release the joypad after 10 sec

    7. There is a Customer-Service-Menu at “123654” which contains read only information about the current firmware and so one. However there is also the real service menu (062?96i) which could be used for much more things. But you need to be really careful with this, i already managed to break booting without changing something important.

    8. The settings-app calls the "su" command inside of CSMActivity. If this is no obsolete debug code (i was not able to trigger this part yet) than there could be a "su" inside /sbin. The Manifest also shows this strange "org.droidtv.tv.tv_power_system_access" permission. Therefore i tried to write my own app with the same permission and call "su" which did however not work out (even if I use the same namespace org.droidtv.?)

    9. Every time you pop in an usb stick android creates an backup folder on it. The filenames are "hidden" via base64 and there are some junk bytes at the beginning of the files which you need to crop in order to read them. However the content is quite boring mostly some sqlite3 databases with configuration parameters.

    10. By default the usb sticks you plug in is read-only for user apps. However there is in option in the settings to re-format it. This will result in an XFS formatted, read-write mounted stick where you could even outsource your apps.

    11. There is a soap (http) service running on port 1925 which is used by the philips remote app and allows different things for example starting one of the installed apps. More details could be found if you decompile the XTV-App.


    Hope some of you guys could do something fancy with those information.
    @snoerenberg(xda): did you manage to send commands over your cable yet - If you do rooting should be quite easy from this point (maybe /system/bin/run-as).

    Cheers,
    5003b4d49cbf7916123271b7b1918f123cca0c09bf1428f4398257751ac6570c

    ps: some of the information were dumped on an older firmware and some with the current one
    11
    Steps for install any APK in 2014 Philips Android TV AND1E

    Hello,

    For install any application in 2014 Philips Android TV AND1E :

    1º You must download "Developer Settings" from "Google Play" and enable "Usb Debugging" in "Developer options".
    2º Connect ADB via WIFI -> adb start-server" , adb connect IP:5555
    3º Install APK -> adb install "app.apk" (download apk from google play with evozzi apk downloader in web or in chrome extension)

    I've tried it in 55PUS8909 and it works!.

    I've tried for root framaroot, towelroot and vroot and exploits not run.
    I've tried all for "Unknown Sources" and nothing.

    sorry for my english....thanks, regards!
    8
    [GUIDE] How to root 2015 Philips Android TV

    [GUIDE] How to root 2015 Philips Android TV moved to separate thread here

    Please vote regardless you were successful with rooting or not...