Shield Android TV rooted

Search This thread

teletype

Member
May 31, 2015
23
50
0
I just managed to get TWRP running on the new Shield console, and installed SuperSU successfully. Two caveats: the display is upside down, and the USB host ports don't work. I had to plugin a mouse via an OTG cable in order to interact with it. ETA: That's only an issue when booted to TWRP. Everything's working fine in the stock ROM after rooting.

Procedure:
- enable developer tools / USB debugging
- adb push supersu.zip /sdcard
- adb reboot bootloader
- fastboot oem unlock
- fastboot boot twrp-2.8.6.0-shieldtv-unofficial.img
- unplug USB cable, connect mouse via USB, install SuperSU

TWRP boot image is attached. Off to explore...

EDIT: by request, some more detailed instructions:

  • On the Shield device, head to Settings -> About, and click "Build number" 7 times. This will enable Android's Developer options.
  • Go to Settings -> Developer options, and enable USB debugging.
  • Install the ADB/fastboot drivers and utilities if you don't already have them. When "adb devices" shows your Shield, you're good to go.
  • Download and extract recovery.zip from this thread.
  • Head to the SuperSU forum and download the latest version.
  • Open a command prompt and navigate to the directory where you downloaded everything. (Google this for your OS if you don't know how).
  • With the Shield still booted, run "adb push supersu.zip /sdcard" (change supersu.zip to appropriate file name). This will upload the SuperSU update zip to your device, which you'll install from TWRP.
  • If that worked fine, run "adb reboot bootloader". Your device should shut down, and display the Fastboot screen after a few seconds.
  • FOLLOW THE NEXT THREE INSTRUCTIONS AT YOUR OWN RISK. This WILL wipe all your user data, back it up with ADB first if you want to preserve it. DISCLAIMER #2: I have no idea if there are any DRM keys or anything that get wiped when this is done (this was the case on my Xperia Z3 Compact). I will say that Grid streaming still works fine after doing this.
  • This step will unlock your bootloader to enable booting unsigned images.
  • Run "fastboot devices" and make sure your Shield is visible.
  • Run "fastboot oem unlock" and follow the prompts on the screen. Your bootloader is now unlocked.
  • Now, boot the TWRP image with: "fastboot boot twrp-2.8.6.0-shieldtv-unofficial.img" - Note: I used this instead of "fastboot flash" so I could keep the stock recovery around, to grab an image of it after rooting.
  • You should now see a TWRP recovery menu (upside down for now).
  • Connect a keyboard or mouse via OTG cable, and select "Install", navigate to your SuperSU zip, select it, and follow the prompts.
  • Click "reboot" and you should now be rooted.
 

Attachments

  • recovery.zip
    12.4 MB · Views: 16,285
Last edited:

Steel01

Recognized Developer
Dec 14, 2008
1,262
2,804
143
I'm starting dev work on this as well. Can you try the flipped screen flag and see if it that fixes the display? That's required to make the tablet work correctly. I preordered the pro edition, so I can't test anything for almost another two weeks. Hopefully someone will be able to get the normal usb ports working, since it'll be much easier to use those for a mouse/keyboard.
 

FreeEmulator

New member
Jun 1, 2015
4
1
0
Thanks for posting this. I've got my NVIDIA Shield Android TV coming on Wednesday, so I'll give this a try. I had a USB OTG cable, but lost it several months ago so I ordered another one of those as well. Just to clarify... the 2 USB 3.0 ports will work after rooting when you boot back to stock, right?

Also, this works on the latest 1.1 OTA update too, correct?

Sorry to ask this as it is super n00bish, but could someone explain to me step-by-step directions for rooting this or perhaps link to a guide that uses this same procedure? I know the main steps are listed in the OP, but I'm not really sure how to use adb to push supersu.zip, reboot into bootloader, fastboot, etc.

Lastly, what will be the process of upgrading via OTA updates in the future after I root it? Will I need to unroot one way or another (instructions or a link to a guide would be great), or will OTA updates work just fine?

Once again, sorry for all the n00b questions. I just want to make sure I don't do something stupid to mess the device up...
 
Last edited:

teletype

Member
May 31, 2015
23
50
0
Thanks for posting this. I've got my NVIDIA Shield Android TV coming on Wednesday, so I'll give this a try. I had a USB OTG cable, but lost it several months ago so I ordered another one of those as well. Just to clarify... the 2 USB 3.0 ports will work after rooting when you boot back to stock, right? Also, this works on the latest 1.1 OTA update too, correct?

Also, sorry to ask this as it is super n00bish, but could someone explain to me step-by-step directions for rooting this or perhaps link to a guide that uses this same procedure? I know the main steps are listed in the OP, but I'm not really sure how to use adb to push supersu.zip, reboot into bootloader, fastboot, etc.

Yup, everything works normally after rooting. These issues only exist in TWRP because I did an extremely quick and dirty build (extracted a Shield Tablet TWRP and replaced the kernel). I'll work on fixing them soon, unless someone beats me to it. Thanks for the tip on the screen flipping, Steel01.

I've updated the OP with some more detailed instructions.

ETA: I can't see OTAs being a problem. In theory, they could check if an su binary is installed and deny the update until you remove it, but if they're allowing oem unlock, I can't see why they'd do that. And you could just remove it anyway. You will have to re-root after each OTA update.
 
Last edited:
  • Like
Reactions: FreeEmulator

FreeEmulator

New member
Jun 1, 2015
4
1
0
Yup, everything works normally after rooting. These issues only exist in TWRP because I did an extremely quick and dirty build (extracted a Shield Tablet TWRP and replaced the kernel). I'll work on fixing them soon, unless someone beats me to it. Thanks for the tip on the screen flipping, Steel01.

I've updated the OP with some more detailed instructions.

ETA: I can't see OTAs being a problem. In theory, they could check if an su binary is installed and deny the update until you remove it, but if they're allowing oem unlock, I can't see why they'd do that. And you could just remove it anyway. You will have to re-root after each OTA update.

Awesome, thank you so much for the info and instructions. :good: I should be good to go now once everything arrives on Wednesday.
 

mtbowl

Member
Sep 25, 2014
7
2
0
Twrp for forge?

Is there any skilled folks out the with a forge tv? I'm in need of some kind of recovery for this. I'm a bit of a noob so compiling it on my own is kinda greek to me
 
  • Like
Reactions: patt2k

Failrunner

Senior Member
Aug 19, 2012
121
17
0
Yeah so go to links with viruses in them and then waste time removing them. You know there are website without a million links to viruses all over them that can be used. It's always nice not to have to play guess which download link isn't a virus. -_-
 
  • Like
Reactions: ElwOOd_CbGp

Luxferro

Senior Member
Nov 19, 2009
1,510
433
0
Long Island, NY
ETA: I can't see OTAs being a problem. In theory, they could check if an su binary is installed and deny the update until you remove it, but if they're allowing oem unlock, I can't see why they'd do that. And you could just remove it anyway. You will have to re-root after each OTA update.

Actually rooting will likely break OTA updates. Since lollipop, Google has moved to block level OTA updates. That means it doesn't just patch individual files, it patches at the block level. So if there is a change to /system the OTA won't update.

The same seems to apply to the Shield TV. Here's the updater-script from the current OTA:

Code:
(!less_than_int(1432624016, getprop("ro.build.date.utc"))) || abort("Can't install this package (Tue May 26 00:06:56 PDT 2015) over newer build (" + getprop("ro.build.date") + ").");
getprop("ro.product.device") == "foster" || abort("This package is for \"foster\" devices; this is a \"" + getprop("ro.product.device") + "\".");
show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/platform/sdhci-tegra.3/by-name/APP", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/platform/sdhci-tegra.3/by-name/LNX");
show_progress(0.200000, 10);
nv_copy_blob_file("blob", "/staging");
nv_copy_blob_file("bmp.blob", "/bmps");

But borked OTA shouldn't be much of an issue, since Nvidia is releasing the fastboot factory images: https://developer.nvidia.com/shield-open-source The text is there now for them, but they aren't up yet. So you can always revert to stock, then OTA update.
 

Steel01

Recognized Developer
Dec 14, 2008
1,262
2,804
143
Wait... What? You got one of of the tablet twrps to boot on the console? I'm shocked that worked. Didn't think it what that easy to get 32-bit mode. Anyways, that's why it's upside down, because that flag is set for the tablet. As soon as a console section opens up here and on androidfilehost, I'll post my builds. I have cm, twrp, and multirom compiling, but I can't test them until next week, when Amazon ships the pro, so they might not even boot.
@agrabren: Oh my goodness, the wipe takes that long? What's it doing? US Government certified nuking? And people complain about multi minute cache wipes on the tablet now. What am I going to be hearing in a couple weeks for this? :p

Actually, since you're around again... Do you still have the CM files you made for the portable? I'm still interested in what you did to make the cwm recovery work as well as it did.
 

FreeEmulator

New member
Jun 1, 2015
4
1
0
One more quick question for now... once rooted, does anyone know how I would go about locking the GPU clock speed / frequency at its highest setting (which if I've read correctly is 1 GHz)? I'd like to be able to flip the lock on only while testing out some pretty hardware intensive emulator games (the Dolphin GameCube/Wii emulator, which I was told by a developer of the emulator to try to lock the maximum GPU clock speed to ensure best performance). Thanks again for all the help, you guys are great.
 

Luxferro

Senior Member
Nov 19, 2009
1,510
433
0
Long Island, NY
Tested out the pro console on my side (Got it early due to reasons).
It refuses to mount any partitions, so it is impossible to root.

It's probably because the partition layout/names are different for the internal 500GB drive. If you poke around you can probably find the info, or just dump your boot.img, decompile it and look for the fstab file. It will look similar to the below (that is for the ADT-1).

Code:
# Android fstab file.
#<src>                                                  <mnt_point>         <type>    <mnt_flags and options>                               <fs_mgr_flags>
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK


/dev/block/platform/sdhci-tegra.3/by-name/system      /system             ext4      ro                                                    wait
/dev/block/platform/sdhci-tegra.3/by-name/cache       /cache              ext4      noatime,nosuid,nodev,nomblk_io_submit,errors=panic    wait,check
/dev/block/platform/sdhci-tegra.3/by-name/userdata    /data               ext4      noatime,nosuid,nodev,nomblk_io_submit,errors=panic    wait,check,encryptable=/dev/block/platform/sdhci-tegra.3/by-name/crypto
/dev/block/platform/sdhci-tegra.3/by-name/misc        /misc               emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/boot        /boot               emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/recovery    /recovery           emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/DTB         /dtb                emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/staging     /staging            emmc      defaults                                              defaults
/dev/block/platform/sdhci-tegra.3/by-name/sysdata     /sysdata            emmc      defaults                                              defaults
 

patt2k

Senior Member
Mar 22, 2009
3,390
546
0
Someone skilled do this also for Forge anyways hopefully XDA adds Android TV forums.

Keep up the good work even though I don't own the Shield.
 

Luxferro

Senior Member
Nov 19, 2009
1,510
433
0
Long Island, NY
Someone skilled do this also for Forge anyways hopefully XDA adds Android TV forums.

Keep up the good work even though I don't own the Shield.

The forge has a locked bootloader. Sure, you can root it (supposedly), then replace the recovery, but you'll never be able to use fastboot until it's unlocked.


BTW, the Nvidia Shield TV factory images are up now :victory:
 

Top Liked Posts

  • There are no posts matching your filters.
  • 27
    I just managed to get TWRP running on the new Shield console, and installed SuperSU successfully. Two caveats: the display is upside down, and the USB host ports don't work. I had to plugin a mouse via an OTG cable in order to interact with it. ETA: That's only an issue when booted to TWRP. Everything's working fine in the stock ROM after rooting.

    Procedure:
    - enable developer tools / USB debugging
    - adb push supersu.zip /sdcard
    - adb reboot bootloader
    - fastboot oem unlock
    - fastboot boot twrp-2.8.6.0-shieldtv-unofficial.img
    - unplug USB cable, connect mouse via USB, install SuperSU

    TWRP boot image is attached. Off to explore...

    EDIT: by request, some more detailed instructions:

    • On the Shield device, head to Settings -> About, and click "Build number" 7 times. This will enable Android's Developer options.
    • Go to Settings -> Developer options, and enable USB debugging.
    • Install the ADB/fastboot drivers and utilities if you don't already have them. When "adb devices" shows your Shield, you're good to go.
    • Download and extract recovery.zip from this thread.
    • Head to the SuperSU forum and download the latest version.
    • Open a command prompt and navigate to the directory where you downloaded everything. (Google this for your OS if you don't know how).
    • With the Shield still booted, run "adb push supersu.zip /sdcard" (change supersu.zip to appropriate file name). This will upload the SuperSU update zip to your device, which you'll install from TWRP.
    • If that worked fine, run "adb reboot bootloader". Your device should shut down, and display the Fastboot screen after a few seconds.
    • FOLLOW THE NEXT THREE INSTRUCTIONS AT YOUR OWN RISK. This WILL wipe all your user data, back it up with ADB first if you want to preserve it. DISCLAIMER #2: I have no idea if there are any DRM keys or anything that get wiped when this is done (this was the case on my Xperia Z3 Compact). I will say that Grid streaming still works fine after doing this.
    • This step will unlock your bootloader to enable booting unsigned images.
    • Run "fastboot devices" and make sure your Shield is visible.
    • Run "fastboot oem unlock" and follow the prompts on the screen. Your bootloader is now unlocked.
    • Now, boot the TWRP image with: "fastboot boot twrp-2.8.6.0-shieldtv-unofficial.img" - Note: I used this instead of "fastboot flash" so I could keep the stock recovery around, to grab an image of it after rooting.
    • You should now see a TWRP recovery menu (upside down for now).
    • Connect a keyboard or mouse via OTG cable, and select "Install", navigate to your SuperSU zip, select it, and follow the prompts.
    • Click "reboot" and you should now be rooted.
    7
    Quick warning for Pro owners: OEM Unlock takes about 92 minutes. Just be warned and ready for it...
    4
    Well, life has finally caught up to me. I need to take a break for a couple weeks. I may work on some small stuff during that time, but I won't be making any big pushes for anything. If somebody else wants to pick up and finish sooner, everything I've done is on Github. The patches against multirom are here (of interest are the ones with aarch64 in the name) and the repo can be used to build cm, twrp, and multirom (only twrp working, of course). The cm-12.1-mrom branch of the foster kernel has the attempt at a kexec patch. Don't know if it works because multirom hasn't worked right yet. Last I tried, the fdt patch didn't compile, so that might need reverted and fixed. CM is like I mentioned last post, no change there. And somehow, the twrp recovery image needs to slim down 3-4 MB. Probably easiest to trim the kernel and split the defconfig for cm and twrp.
    4
    Doh instructions mean touch button on the shield itself lmao - I was thinking it was the controller smh. in the end i just hardware rebooted back into fastboot mode and now im trying to flash zulus custom system img to console. Not sure what step i missed as I followed instructions to a T just seems like after unlocking bootloader it was done for some reason.

    @zulu99 - I dled your system img of 125 mb and when i go to flash it only appears to be writing smaller size 64578 kb / 23221 kb).

    target reported max download size of 67108864 bytes
    erasing 'system'...
    OKAY [ 0.405s]
    sending sparse 'system' (64578 KB)...
    OKAY [ 1.563s]
    writing 'system'...
    OKAY [ 3.630s]
    sending sparse 'system' (23221 KB)...
    OKAY [ 0.583s]
    writing 'system'...
    OKAY [ 0.864s]
    finished. total time: 7.045s

    Also, when i follow your instructions for ./fastboot -w it just hangs there and does nothing (should it take 30+ min?).

    @op - I also tried booting and flashing twrp recovery linked in your first post and was unable to get into recovery using either method.

    I think imma just try and go back to the stock ota since not having much luck does anyone have any ideas how to flash that back via fastboot? Lollipop roms look much different so all Im seeing is a boot.img and this dat file which looks it probably has everything in due to its size but not sure what to do with it.

    The rar file is 245MB and when you extract the system.img the size of system.img is 665MB

    I think you have problem with your pc / usb otg cable, specially if the command fastboot -w, that just clear user data , not work.

    On shield is just little hard to go in bootloader mode:

    HW method:
    Disconnect power cable
    Insert USB OTG cable and make sure to connect other end to a host PC
    Connect power cable to SHIELD
    Quickly start pressing power button for ~3 seconds
    Do not hold the button and connect power supply afterwards
    HDMI TV should be always connected to SHIELD

    The first day was hard to go in fastboot, wont to others devices, but after 2 or 3 times, all is simple and work well.
    I flashed my Shield millions times.


    So. The the important fact is that with full android firmware the device became really useful. Work very well and the hardware is strong.
    Specially you can have all android apps without limitations directly from Google Play.

    For the controller i can use it wired but with the trick above i can use it also from my couch. Tested many things and all work very well.

    But i repeat, this is just the start.

    https://goo.gl/ko3G4m

    I hope to see a specific thread for this device in xda forum so i can help better.
    3
    Not really sure where to put this since there's no Shield TV section but once you root it you can enable hardware mpeg-2 decoding pretty easily

    In an adb shell run the following:
    su -
    mount -oremount,rw /system

    download /system/etc/media_codecs.xml

    Add the following to the <decoders></decoders> section:
    HTML:
            <MediaCodec name="OMX.Nvidia.mpeg2v.decode" type="video/mpeg2">
                <Feature name="adaptive-playback" />
            </MediaCodec>

    Re-upload the file to the device replacing the current one. Reboot the device and mpeg-2 decoding will be enabled. You can also do this for vc1 by adding the following:
    HTML:
            <MediaCodec name="OMX.Nvidia.vc1.decode" type="video/vc1">
                <Feature name="adaptive-playback" />
            </MediaCodec>


    Your first version I used adb shell and just manually installed su from twrp so unsure if it worked as I don't have the proper cable for mouse control :(
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone