Rooting/Hacking Hisense A6G M7322 Based Android TV

Search This thread

nxb

Senior Member
Aug 19, 2010
141
21
I have 2 of these with Android 9. A 50 and a 60. They use the android home launcher and so display ads, etc.

Specs:
Mstar M7322
2gb Ram
4GB storage
Mali GPU

Right now:

Adb can be entered over wireless. Most apps can be user disabled/uninstalled.
App List: https://pastebin.com/GL8b00s6
Apps to Disable: https://pastebin.com/ngM3Gy8g
You can use termux with ADB addon to use ADB right from the TV with BT keyboard.
Android launcher contains the input switcher so hard to replace but this one works: https://forum.xda-developers.com/t/app-android-tv-projectivy-launcher.4436549/
Can only use VPN based firewall. Can't use my VPN.
Can't be trusted on network.
Remote has a microphone (hi Orwell!).
Bromite/VLC/Kodi/etc all run.
No [email protected] 4:4:4 beyond 8bit.

Issues:

* USB adb works with a male to male cable. Bought one on ebay.
* There is no service jack/socket or service manual I could find to get the bootloader console.
* On reddit someone used a raspi zero?
https://www.reddit.com/r/AndroidTV/comments/pyo4sk/_/hfqvua9 * Cannot list MTD partitions on ADB without root.
* Supposedly unlockable from bootloader/fastboot but beware:
https://forum.xda-developers.com/t/android-tv-stuck-on-black-bootloader.3803695/
* No firmware updates to dissect.

Service Mode (Mstar Service Menu):
Menu -> Sound -> Advaned -> Balance -> Type '1' '9' '6' '9'

How to disable an app without root:

Code:
pm disable-user --user 0 com.hisense.tv.ota
pm uninstall --user 0 com.hisense.tv.ota
pm disable-user com.hisense.tv.ota

Board info?!
In app manager system info the mainboard identifies as MSD6886. This one is slightly different in terms of port layout as if it was the upgrade version. But that board has a service manual and bootloader/layout stuff applies. https://www.manualslib.com/products/Hisense-Msd6886-10481497.html

The uart on that board is the headphone jack which isn't present on this TV. Maybe it has to be soldered.

TV Source code from Hisense:


Has anyone gotten any farther with this or any other mstar based TVs? Tried more malwareish programs like kingroot? What's worth trying next?

If the bootloader can be unlocked a backup could be made and it might just be a matter of adding magisk binary for all of that receiver/service disabling goodness.

Maybe one day we can compile a rom for it.
 
Last edited:
  • Like
Reactions: chris1892006

Oswald Boelcke

Senior Moderator / Moderator Committee
Staff member
Has anyone gotten any farther with this or any other mstar based TVs? Tried more malwareish programs like kingroot? What's worth trying next?
Hello and good afternoon, @nxb

Prior to your next posting please read the guidances that are stuck on top of every forum like
and the others. I've moved the thread to Android Q&A.

Thanks for your cooperation!
Regards
Oswald Boelcke
Senior Moderator
 

nxb

Senior Member
Aug 19, 2010
141
21
I have simply copied where similar threads were posted:


This is definitely not help/troubleshooting and Q&A.
 

nxb

Senior Member
Aug 19, 2010
141
21
Did unlocking reset to factory defaults? I should unlock mine now that its not going to brick.

We can try to boot generic recoveries through fastboot until we get one that works and then dump the MTD partitions, edit and flash back.

 

chris1892006

Senior Member
Jun 29, 2018
186
17
I have a Hisense 43A6H and its bootloader unlocked it was easy just had to load the drivers in bootloader mode and fastboot flashing unlock worked and yes IT WIPES THE TV but patching my boot.img never works, well it patches successful on some but not all magisk versions and flashing is a success in bootloader fastboot but it did not root the tv so its not working for some reason on my tv, as its android 11.
 

Top Liked Posts