Shield TV 7.2 developer update, downgrade and other things

Mogster2K

Senior Member
Jun 25, 2011
311
56
48
In case someone else if already working on a modified system: Please let me know how you made it boot after the changes ;)
I was able to get root thru Magisk on my 2015 (foster) unit, so it should also work on the Pro. I used the Magisk Manager app on my Shield to patch the boot image. (Strangely, patching it on my phone did not work.) I have not heard of any successes with a 2017 darcy unit.

---------- Post added at 05:00 PM ---------- Previous post was at 04:57 PM ----------

Im on 7.1. I have been waiting for 7.2 developer image, which is now out and just noticed 7.2.1 is available OTA. I'm really confused what to do. I want to keep root without bricking my Shield. Should I Stay with what I have as it is running well.

I am not even sure if it is safe trying to update to dev 7.2 image (or if I would want to) by hooking to computer and using ADB Fastboot tools.

Is there any good reason to update to 7.2 or 7.21? and if so how would I go about doing it? Which program is good for flashing developer images or OTA updates. I used to use flash-fire, which seems to be obsolete now and have heard TWRP is incompatible rooting with SU with OREO updates????

Should I play it safe and stay with what I have rather than experiment and end up with a brick? (wouldn't be the first time)

Anyone know if 7.21 is some-kind of bug fix?

Alot of questions but hope someone has some answers.
Thanks for any info.
I would wait it out. 7.2 fixes some things but breaks others. And yes, 7.2.1 was released to fix some bugs in 7.2, notably wireless-AC not working on channels above 50.
 

ACiDxCHRiST

Senior Member
Dec 23, 2010
223
133
0
I used the Magisk Manager app on my Shield to patch the boot image. (Strangely, patching it on my phone did not work.)
topjohnwu specifies that you must patch the boot.img on the same device it is for. It uses processes to patch the image that are different depending on model/version. That is not saying that it is NOT possible to patch a boot.img on a different device, but that it WILL fail to produce a working patched_boot.img if the files/processes that Magisk Manager use differ between the 2 devices.
 
  • Like
Reactions: Mogster2K

ACiDxCHRiST

Senior Member
Dec 23, 2010
223
133
0
@Downunder35m Hey, I figured out why Magisk Manager was creating bootloops when using it to patch the boot.img from v7.2

From your posts, I am betting you're probably already aware of this but I figured I would let you know just in-case. Below is how I got a working v7.2.1 on a 2017 Shield TV rooted with Magisk v18.0

  • Extract boot.img from developer image or full OTA (Partial OTA probably has a complete boot.img in it as well, but I don't ever mess with those)
  • In Magisk Manager check the box for the "Preserve AVB 2.0/dm-verity" option
  • Click Install, and select the boot.img
  • Copy patched_boot.img to PC
  • 'adb reboot bootloader'
  • 'fastboot flash boot patched_boot.img'
  • 'fastboot reboot'

I verified that this works perfectly
 

bp328i

Senior Member
May 22, 2010
2,155
1,195
0
Tampa Bay
@Downunder35m Hey, I figured out why Magisk Manager was creating bootloops when using it to patch the boot.img from v7.2

From your posts, I am betting you're probably already aware of this but I figured I would let you know just in-case. Below is how I got a working v7.2.1 on a 2017 Shield TV rooted with Magisk v18.0

Extract boot.img from developer image or full OTA (Partial OTA probably has a complete boot.img in it as well, but I don't ever mess with those)
In Magisk Manager check the box for the "Preserve AVB 2.0/dm-verity" option
Click Install, and select the boot.img
Copy patched_boot.img to PC
'adb reboot bootloader'
'fastboot flash boot patched_boot.img'
'fastboot reboot'


I verified that this works perfectly
Thanks for posting this!

I can confirm this works on both my Pro and 2017 Shield TV. Both rooted with Magisk v18, both running v7.2.1.
 
  • Like
Reactions: puppinoo

bp328i

Senior Member
May 22, 2010
2,155
1,195
0
Tampa Bay
Where did you get the 7.2.1 boot.img from?
At the very bottom of Developer options I turned on Provide full system upgrades. I flashed 7.2 then download the update (but did not flash it then). It can be found in data/data/com.nivida.ota (it's going to have a long number for the name but it's over 1gb in size) and pulled it out of that. It's just a zip file.

Edit: if you want I can upload the patched boot.img. I have the one for the Pro and the 2017 16gb.
 
Last edited:

iLLNiSS

Senior Member
Aug 5, 2016
62
18
0
At the very bottom of Developer options I turned on Provide full system upgrades. I flashed 7.2 then download the update (but did not flash it then). It can be found in data/data/com.nivida.ota (it's going to have a long number for the name but it's over 1gb in size) and pulled it out of that. It's just a zip file.

Edit: if you want I can upload the patched boot.img. I have the one for the Pro and the 2017 16gb.
Thanks for the info. Sadly I bricked my unit tonight. Accidentally flashed the pro boot to my 16gb unit :(
 

Downunder35m

Senior Member
Jul 23, 2010
205
103
0
@Downunder35m Hey, I figured out why Magisk Manager was creating bootloops when using it to patch the boot.img from v7.2

From your posts, I am betting you're probably already aware of this but I figured I would let you know just in-case. Below is how I got a working v7.2.1 on a 2017 Shield TV rooted with Magisk v18.0

  • Extract boot.img from developer image or full OTA (Partial OTA probably has a complete boot.img in it as well, but I don't ever mess with those)
  • In Magisk Manager check the box for the "Preserve AVB 2.0/dm-verity" option
  • Click Install, and select the boot.img
  • Copy patched_boot.img to PC
  • 'adb reboot bootloader'
  • 'fastboot flash boot patched_boot.img'
  • 'fastboot reboot'

I verified that this works perfectly
Tried that but not all root stuff worked.
For example my adblocker fails to get root despite being granted.
But will test again on a really clean and fresh install.

@ iLLNISS: I agree with Mogster2k.
Even if the image sizes are totally wrong the normal flash process can't break the partitions.
And unless there was a true bootloader included all is good :)
 

nanerasingh

Senior Member
Feb 25, 2011
50
3
0
On 7.2.1 2017 16GB MODEL.
How to downgrade to 7.1 or 7.2? i saw 1st post but its quite complicated writeup, can you give me steps to downgrade from 7.2.1 to 7.1?
i worried if i follow wrong step and may cause booloader bricked .Thanks
 

Downunder35m

Senior Member
Jul 23, 2010
205
103
0
@ nanerasingh: Just follow the 3rd post, I changed it just for this ;)

Little update on the latest experiments:
First off my friend Whiteak found a nice pure Android release for the 7.2, so no TV stuff at all, just pure Android.
Once either of us has tried and tested it a link will follow.
Took a break from the firmware modding itself and instead tried Magisk again directly, here are the results of my tests:
As with other things I tried before Magisk seems to struggle with the new user rights system implementations.
No app is running as root or general anymore, only in its own userspace and with its own set of rights.
Like in a true and secure Linux no other user can modify files outside the group sid user is in.
Read access is handled slightly different for some system related things and still includes the old ways of getting rights.
So while Magisk, with preserving verity at least, is able to give us root rights, it is not able to give us write access to these areas.
And if Magisk can't give us these rights then the logical conclusion is that it failed to get these rights itself.
For real root either a new Magisk is required or a system that is fully cleaned from all checks and restrictions by default.
My current rom tests still seem to indicate that the new booloader (not the boot.img!!) is trying all it can to prevent this.

TWRP.....
I am able to get a modified TWRP working on 7.2, that is the only good part.
As with Magisk, TWRP fails to get write access to system, vendor and some unrequired partitions.
Even changing the ramdisk so everything is "unsecure" failed here.
The way I see it:
Some partitions, like system and vendor are encrypted.
The recovery is able to read and decrypt these s TWRP can create a backup.
But since the recover does not contain the private keys required to encrypt an image through the bootloader we end up with an unecrypted one.
The system boots, bootloader recognises the mismatch and stops.
And since it is a dead stop and not just some missing files all goes nuts on the screen.

Starting to run out of ideas here but the WWW is full of them...
Going back to the old booloader (not boot.img) is really not advised as it can result in a true hard brick in over 90% of cases.
My biggest evelopment concern right now is that my bootloader was patched by the small OTA update and then not replaced with the full one from the big update.
So I am not 100% sure if besides having the same version numbers they are both really identical.
Ether way, the pure Android release seems to indicate that even with 7.2 flashing a totally modified system and vendor partition will work.
Sadly it also involves a modified bootloader so a bit hrd to make a full set of comparisions in the code to figure it out from there.
Not good at kernel stuff, only firmware levels :(
In the next few days I will focus on the packing of the firmware for flashing.
Oreo and especially the TV versions are usually packed slightly different than nougat or before firmwares.
Although my tests sometimes show my mods boot up into the system I can not be 100% sure whether or not my mods or the packing algorithms are the cause of problems.
Found some update cooking tools, also some new ones but since they are for Linux I need to find a way to at least utilise them through Cygwin somehow.
Did I mention: not good with Linux either LOL
I am in contact with Kauststubh Patange, a really nice guy with great potential.
Can't wait for his new ADK release to try, hopefully it will make things a lot easier.
 

iLLNiSS

Senior Member
Aug 5, 2016
62
18
0
The boot image, or the bootloader image? If it was the boot image then your Shield is not bricked - just flash the correct one and it should work again.
@ iLLNISS: I agree with Mogster2k.
Even if the image sizes are totally wrong the normal flash process can't break the partitions.
And unless there was a true bootloader included all is good :)
The initial steps before the first reboot were done:

Code:
adb reboot bootloader
fastboot flash staging blob
fastboot flash boot boot.img
fastboot reboot
At this point the device showed up as an APX device and I could no longer use adb or fastboot. It does not have any lights and I cannot get into recovery with a keyboard. As far as I can find when it's showing as APX it's bricked until nvflash is updated and apx drivers are released for the Shield.
 

Downunder35m

Senior Member
Jul 23, 2010
205
103
0
The staging blob is your new bootloader.
Flashing it manually could be what caused your troubles.
Some Shields require a full blob, some only the partial, while a few do need one as they run a special bootloader.
The updater script should make sure no bootloader is changed the wrong way or update if not required.
I will check for options to get APX drivers to work that allow to flash the stock booloader again to get access.
My initital searches however do not look good.

I am sorry for the problem!
But there is a final light available now!
I will update the first post a bit and hopefully a friend of mine will join in to share his findings soon.
 

whiteak

Senior Member
Jan 29, 2018
430
201
0
Gold Coast
Alright guys, here is a quick rundown of how I have gained Full Root Access for firmware version 7.2.2 for the 2017 Darcy Model. Can also confirm it works for 7.2.1 as well. Should also work for 7.2.0, I cannot confirm this as I have not actually tried but I have successfully done it with 7.2.2 and 7.2.1. The majority of you would probably be on 7.2.1, but there is a way to get a test version of 7.2.2 from Nvidia from their forums. But doesn't matter, instructions and files are the same regardless of what ever firmware version you are on whether it be 7.2.2 or 7.2.1.

Credit must be given to Zulu99 as it is his modified dtb file that makes this all possible. He has his own custom Firmware and he is the one who made this modified dtb file to be able to get us up and running again. Now I haven't tried his firmware, so I cannot comment on how it works, but I am using his dtb file to help us continue using the Nvidia Stock Firmware with Full Root Access again, so I must give thanks and credit to Zulu99. For anyone interested in his work you can check his page out at http://www.videomap.it/forum/viewtopic.php?f=25&t=1965. Take note, the instructions I am about to give are not for his Firmware, they are how to use Nvidia Stock Firmware and gain Full Root access, 2 totally different Firmwares, just want to make that clear.

I am a bit short for time, so I will just give a brief rundown of what to do. Downunder35m may or may not decide to make a better guide, totally up to him. I am going to presume most of you already have a good idea on what I am talking about, so there should be no real issues following my brief instructions. When needed, I installed apks via adb just fyi, if you don't know how to do that, then please do not proceed any further, this guide is not for you.

Files needed:

Kantjer Patched boot.img: https://mega.nz/#!H59GiIyb!_zsoqaIdwG1PQj2VNKra82hWORWfjCs45F1LHYV-1jE
Kantjer Magisk Manager: https://mega.nz/#!y4t0xapD!uoCt1Z85hNbnsXDTi4TAjkh2JY8yIgV49aIH_Er6pvE
Zulu99 dtb file: https://mega.nz/#!ih8Q0CgZ!JctOaSURx2-Xo7ceuhdCyN57rmrnFbpX2PtzmtPTF7E


I patched the latest version of Kantjers Magisk (Can use Official, I just like Kantjers) to the stock 7.2.1 or 7.2.2 boot.img (certain they are the same anyway). I downloaded Zulu99's dtb file and then I basically just got to a Clean install of 7.2.1. or 7.2.2 depending on what you have.

Booted to Fastboot and just did this:

fastboot flash boot patched_boot.img
fastboot flash dtb tegra210-darcy-p2894-0050-a04-00.dtb
fastboot -w
fastboot reboot

Booted to System.

Let it sit for a bit, now not too sure if this is normal or not, but it appeared to lock up a bit and sometimes go to a Black Screen and seem unresponsive, I just let it sit for 5-10 mins and it rebooted on it's own accord and booted to system, now it was normal (responsive, no black screens etc). I was kind of worried about why it was unresponsive and going to a black screen, so I did another Factory Reset even though it appeared I didn't need to after the restart, I did anyway, it booted to System fine, this time with no sign of unresponsiveness or black screens. Let it sit for 5 mins anyway, all good.

Uninstalled the half pre-installed version of Magisk Manager installed from flashing the patched boot.img. Installed the Full Version of Kantjers latest Magisk Manager, opened, asks to complete Setup, click allow, asks again to complete setup, again click allow, Magisk Manager is now installed.

Tested for Full Root Access, Uninstalls and deletes System Apps and System Folders.

Success. Stock 7.2.1 or 7.2.2 with Full Root Access.

Now it is to be said, that I also done this to a Second Shield I have and at the end I also got the unresponsiveness etc, I also done a Factory Reset and the unresponsiveness was still there unlike the First Shield I flashed when the unresponsiveness dissapeared after a Factory Reset. On the second shield all I did was a Restart and upon restart everything was normal again. Not too sure what really causes it, but a restart fixes it.

**Take note*** You do not need to use my Kantjer Patched Boot.img and Manager, you could use the official ones, I just use Kantjers, so that is what is provided in instructions.
 
Last edited:
  • Like
Reactions: TheLoonyRebel

nanerasingh

Senior Member
Feb 25, 2011
50
3
0
Solved!
Thanks @Downunder35m for guide.
I downgraded to 7.1
-Flashed developer 7.1 firmware.Flash all.bat
-After install i hold AB button to enter fastboot and locked the bootloader.
-Rebooted and on 7.1 firmware setwizard,Luckily after few steps i goes directly to Home screen and adb debugging on.
-Unlocked bootloader and flashed Magiskv18 via twrp.
Now i downloaded FULL OTA Update 7.2.2 and update after backup ota file from Root explorer i patched it with magisk app with Preserve AVB 2.0/dm-verity checked.And saved pathced_boot.img of 7.2.2.
-Then Updated to 7.2.2 ota.
-After boot to home screen enabled adb debugging.and reboot to bootloader.
-flashed pathced_boot.img of 7.2.2.
-rebooted and magisk root available on my 7.2.2 version(as it doesnt shows any version in system info just- Unkown)
-To check the root issue i modify the build.prop file via es explorer and changed ro.setupwizard.mode=DISABLED.
But seems file was not saved and revert back to ro.setupwizard.mode=OPTIONAL.
So Official magisk patching not working fully for pesistant.
 
Last edited:

Downunder35m

Senior Member
Jul 23, 2010
205
103
0
There he is with the solution, I knew I can count on Whiteak :)
Will include the instructions with a link in the first posting.

I tried Whiteak's solution myself this morning and can confirm it works just fine.
Although there might be problem for some who already tinkered too much like I did.
As the normal flashing through fastboot not always removes vital system stuff the Shield can come with some hickups.
A good way to prevent this is to do a full wipe through the stock recovery - a factory reset.
I tried one right after the flashing and before the first boot up and then the shield went on with no problems at all.
 

Michajin

Senior Member
Oct 23, 2012
1,107
396
103
This is what worked for me, using the files and commands and files from Post 36 (Great job Whiteak) I modified a flash-all.bat file and placed the files and ran it. I upgraded from 7.1 to 7.2.1 with full magisk root. I downgraded back to 7.1 with the flash-all from that image to test. After a android boot screen bootloop, i had to power down and restart (it then booted into android), i was back on 7.1. The i used the flash-all-root.bat file i modified and i am back on 7.2.1. I did not use the fastboot -w (this wipes data right?). I did notice on first boot the system seemed to lag badly until another restart, then it was all good. I did have to install the Kantjer Magisk Manager above (its included in the zip). Just run the flash-all-root.bat file. It will reboot a couple times then go back into bootloader then flash the rooted boot image and dtb file. The flash-all-root. bat is the only thing i did to get it to work. I am using the shield 2017. I would also recommend a factory wipe if you are having issues, maybe try a cache wipe first and see if that resolves issues. I'm a novice at this so I'm sorry if this information is useless to any of you. I flashed from windows, i'm sure i could modify a .sh to run in linux if anyone needs it. Use the file at your own risk.

https://drive.google.com/open?id=1OxGpiqrSyRuodhpYnVqxhpQUvUZwmIac