Sony KD-55A9G Root

[josonxie]

My sony TV KD-55A9G 。
My TV is not working properly anymore, I have removed the TV Main board。
Who has sony's Flahs programming program ？
Who can provide Sony service manual for this 55A9G ？

 

[josonxie]

Recently, I re-ordered the motherboard from the SONY repair department. At present, I have a bad SONY 55A9G motherboard. I copied the Emmc software from the new motherboard to the mirror file. The old motherboard is currently working properly.

I am looking for methods to get root on my Sony TV KD-55A9G. Anyone have any ideas?

The following files are currently extracted from sony's upgrade files：
3rd.img
boot.img
dtbo.img
linux_rootfs.img
recipe.img
system.img
tzbp.img
upgrade.img
vbmeta.img
vendor.img

I'm looking for a way to repackage bootimg, but after I modify the boot and repackage it, most tools don't support it.

Next,
Solve the modification and repackaging of bootimg... ...

 

[Daltonxx]

I have a KD-65A1 and I need to root it , please let me have the rooted image if you can make it work

 

[josonxie]

I have a KD-65A1 and I need to root it , please let me have the rooted image if you can make it work

So far, Not yet successful root!!!

 

[Lefteris Fragiadakis (Frago)]

Can you flash the files withoute unlock the bootloader?

 

[yylyyl]

Recently, I re-ordered the motherboard from the SONY repair department. At present, I have a bad SONY 55A9G motherboard. I copied the Emmc software from the new motherboard to the mirror file. The old motherboard is currently working properly.

I am looking for methods to get root on my Sony TV KD-55A9G. Anyone have any ideas?

The following files are currently extracted from sony's upgrade files：
3rd.img
boot.img
dtbo.img
linux_rootfs.img
recipe.img
system.img
tzbp.img
upgrade.img
vbmeta.img
vendor.img

I'm looking for a way to repackage bootimg, but after I modify the boot and repackage it, most tools don't support it.

Next,
Solve the modification and repackaging of bootimg... ...

How did you extract these files from sony's upgrade files?

 

[Codename_Falcon]

Can you please tell us how you managed to extract the files?

 

[Lefteris Fragiadakis (Frago)]

Sony af9 already temp rooted ?

 

[enixspike]

Sony af9 already temp rooted

Can you tell us how can you do that? is there any further information?

 

[Lefteris Fragiadakis (Frago)]

Can you tell us how can you do that? is there any further information?

Modding emmc with ufi box and root the system manual

 

[enixspike]

Modding emmc with ufi box and root the system manual

well, thanks

 

[enixspike]

Modding emmc with ufi box and root the system manual

BTW, I just saw some people post on a chinese forum, link below：
https://tieba.baidu.com/p/6536366728?pn=1

The poster have a SONY BRAVIA 65X8500G Chinese version(x850G in US), running Android TV 9.0 but no GSM, no youtube, no netflix,no Alexa nor Airplay2.
So they want to root the TV and add the GSM and Airplay. or even more.

The poster did not say much how he do that, but as we can see from the photo, he root it and modify the firmware with other regional firmware.

I find some resualt in his other thread that he flash different firmware on his chinese version 65X8500G hardware.
China Frimware (cna)(1603610100): boot normally, works fine
China Frimware(cna)(1603590100)(downgrade): boot normally, works fine
US Frimware(naa)(1603598100): boot normally, can't finish initial setup wizard
EU Frimware(eua)(1603598100): black screen after SONY logo，can't enter the system
Ph Frimware(laa)(1603598100): black screen after SONY logo，can't enter the system
Japan Frimware(jpa)(1603598100): black screen after SONY logo，can't enter the system
APAC (paa): no android 9 firmare yet
HK (hka): no android 9 firmare yet
TW (twa): no android 9 firmare yet

Here is how he root the tv
1. use A male -A male USB Cable physical contect the PC and TV，using adb to enter the fastboot mode, unlock bootload, there is no code needed.
after you enter the fastboot mode, all the button combinations are invalid,if anything goes wrong, noway to fix it by yourself.
1a. after unlock, disable the verify boot
1b. there is anti rollback,ab slot, you can not boot the slot with low firmware version， change the vb index, you can bypass the anti rollback
2. you can use Magisk to root it now.
3. after root the TV you can use Magisk to patch the boot,and flash it under recovery mode. Do NOT wipe data, otherwise you will have bootanimation loop.
4. do not forget set_active/setActiveBootSlot after you flash the boot, also reset retry count and unmark curent slot successful mark

I am not an Android developer, I just try to translate the Chinese into English.
Hope someone can understand this, and make it more easier for people to root their Sony bravia android TV.

 

[SonyBraviauser]

BTW, I just saw some people post on a chinese forum, link below：
]

The poster have a SONY BRAVIA 65X8500G Chinese version(x850G in US), running Android TV 9.0 but no GSM, no youtube, no netflix,no Alexa nor Airplay2.
So they want to root the TV and add the GSM and Airplay. or even more.

The poster did not say much how he do that, but as we can see from the photo, he root it and modify the firmware with other regional firmware.

I find some resualt in his other thread that he flash different firmware on his chinese version 65X8500G hardware.
China Frimware (cna)(1603610100): boot normally, works fine
China Frimware(cna)(1603590100)(downgrade): boot normally, works fine
US Frimware(naa)(1603598100): boot normally, can't finish initial setup wizard
EU Frimware(eua)(1603598100): black screen after SONY logo，can't enter the system
Ph Frimware(laa)(1603598100): black screen after SONY logo，can't enter the system
Japan Frimware(jpa)(1603598100): black screen after SONY logo，can't enter the system
APAC (paa): no android 9 firmare yet
HK (hka): no android 9 firmare yet
TW (twa): no android 9 firmare yet

Here is how he root the tv
1. use A male -A male USB Cable physical contect the PC and TV，using adb to enter the fastboot mode, unlock bootload, there is no code needed.
after you enter the fastboot mode, all the button combinations are invalid,if anything goes wrong, noway to fix it by yourself.
1a. after unlock, disable the verify boot
1b. there is anti rollback,ab slot, you can not boot the slot with low firmware version， change the vb index, you can bypass the anti rollback
2. you can use Magisk to root it now.
3. after root the TV you can use Magisk to patch the boot,and flash it under recovery mode. Do NOT wipe data, otherwise you will have bootanimation loop.
4. do not forget set_active/setActiveBootSlot after you flash the boot, also reset retry count and unmark curent slot successful mark

I am not an Android developer, I just try to translate the Chinese into English.
Hope someone can understand this, and make it more easier for people to root their Sony bravia android TV.

Hi!

I have managed to connect the TV using the adb connect "IP" Method, I can see the device when I put the adb devices in adb shell but, the problem is, when I put the TV into bootloader mode, there is nothing on the screen just a black screen. I also have only tv plugged into my PC im gonna have to get some other display and try unlocking the bootloader command after I boot into the fastboot. Did anyone root their TV already with this method? Im trying to rollback the android version on my Bravia X900F from 8 back to nougat.


Greetings fromo a newbie.

 

[SonyBraviauser]

Hi!

I have managed to connect the TV using the adb connect "IP" Method, I can see the device when I put the adb devices in adb shell but, the problem is, when I put the TV into bootloader mode, there is nothing on the screen just a black screen. I also have only tv plugged into my PC im gonna have to get some other display and try unlocking the bootloader command after I boot into the fastboot. Did anyone root their TV already with this method? Im trying to rollback the android version on my Bravia X900F from 8 back to nougat.


Greetings fromo a newbie.

I have Also figure out, if you rename the old firmware file ( nougat 7 ) to a newer firmware name, the TV will copy the files succesfully to the TV but after updating around 5 minutes, TV just restarts and boots into newest installment of Android ( 8 ) thats probably due to A/B Partitioning the chinesse guy is refering in his post, android 7'+ uses A/B partitioning for the OTA updates and is some kind of a rollback protection, so you cant instal older android. I dont have the USB cable to try and figure out the method that guy on chinese site came up with. I know its possible, just had to do some internet research and you have all the needed commands. I went ahead and bought brand new SONY XF9005 motherboard and replaced it, since those have the older android 7 on it, everything works the picture and everything but the problem is, now everytime i restart the TV, ( plugged out) at the startup there is green and red light blinking that probably due to T con board, when the firmware has been updated to the latest android 8 the T con board has been updated along, now Im thinking buying the brand new T con board if I get is cheap, so I can report here. ( I bought brand new XF90 Motherboard for around 75euros + shipping ) It was factory sealed and newer used.
Greetings from Slovenia.
Newbie.

 

[Sonyledlcdtv]

Recently, I re-ordered the motherboard from the SONY repair department. At present, I have a bad SONY 55A9G motherboard. I copied the Emmc software from the new motherboard to the mirror file. The old motherboard is currently working properly.

I am looking for methods to get root on my Sony TV KD-55A9G. Anyone have any ideas?

The following files are currently extracted from sony's upgrade files：
3rd.img
boot.img
dtbo.img
linux_rootfs.img
recipe.img
system.img
tzbp.img
upgrade.img
vbmeta.img
vendor.img

I'm looking for a way to repackage bootimg, but after I modify the boot and repackage it, most tools don't support it.

Next,
Solve the modification and repackaging of bootimg... ...

Whatsapp me 8826711619

 

[coolek33]

Hi. I'm attempting to downgrade from android 10 to 9 mine sony tv x900h via fastboot. I don't know if it's a good idea. Got images from payload.bin as on the photo. Maybe someone could point me the correct order to manual flash/commands. It has 2 slots and "b" is active one. I want "a" to be flashed with android 9.

 

[Ganessh28]

Whatsapp me 8826711619

Hi afzal sir

 

[t-mobile_mda]

hey guys..

i am interested in Sony TV rooting.. i have xf9005 device and i can go to fastboot and got some info about device..

fastboot getvar all
(bootloader) partition-size: part_63:0x00000000
(bootloader) partition-type: part_63:emmc
(bootloader) partition-size: reserved10:0x00100000
(bootloader) partition-type: reserved10:emmc
(bootloader) partition-size: reserved9:0x00100000
(bootloader) partition-type: reserved9:emmc
(bootloader) partition-size: reserved8:0x00100000
(bootloader) partition-type: reserved8:emmc
(bootloader) partition-size: reserved7:0x00100000
(bootloader) partition-type: reserved7:emmc
(bootloader) partition-size: reserved6:0x00100000
(bootloader) partition-type: reserved6:emmc
(bootloader) partition-size: reserved5:0x00100000
(bootloader) partition-type: reserved5:emmc
(bootloader) partition-size: reserved4:0x00100000
(bootloader) partition-type: reserved4:emmc
(bootloader) partition-size: reserved3:0x00100000
(bootloader) partition-type: reserved3:emmc
(bootloader) partition-size: spqc:0x00500000
(bootloader) partition-type: spqc:emmc
(bootloader) partition-size: spqd:0x00200000
(bootloader) partition-type: spqd:emmc
(bootloader) partition-size: oops:0x00100000
(bootloader) partition-type: oops:emmc
(bootloader) partition-size: version:0x00100000
(bootloader) partition-type: version:emmc
(bootloader) partition-size: data_demo:0x40000000
(bootloader) partition-type: data_demo:emmc
(bootloader) partition-size: sapost:0x00400000
(bootloader) partition-type: sapost:emmc
(bootloader) partition-size: arib_nvram:0x00100000
(bootloader) partition-type: arib_nvram:emmc
(bootloader) partition-size: udt:0x00100000
(bootloader) partition-type: udt:emmc
(bootloader) partition-size: sdcard:0x00100000
(bootloader) partition-type: sdcard:emmc
(bootloader) partition-size: cache:0x25800000
(bootloader) partition-type: cache:emmc
(bootloader) partition-size: userdata:0x1ae00000
(bootloader) partition-type: userdata:emmc
(bootloader) partition-size: system:0x70800000
(bootloader) partition-type: system:emmc
(bootloader) partition-size: recovery:0x01400000
(bootloader) partition-type: recovery:emmc
(bootloader) partition-size: misc:0x00100000
(bootloader) partition-type: misc:emmc
(bootloader) partition-size: upgrade:0x80000000
(bootloader) partition-type: upgrade:emmc
(bootloader) partition-size: bedat:0x00600000
(bootloader) partition-type: bedat:emmc
(bootloader) partition-size: minf:0x00100000
(bootloader) partition-type: minf:emmc
(bootloader) partition-size: bdix:0x00200000
(bootloader) partition-type: bdix:emmc
(bootloader) partition-size: udat:0x00100000
(bootloader) partition-type: udat:emmc
(bootloader) partition-size: fdat:0x00100000
(bootloader) partition-type: fdat:emmc
(bootloader) partition-size: ndat:0x00200000
(bootloader) partition-type: ndat:emmc
(bootloader) partition-size: bdat:0x00800000
(bootloader) partition-type: bdat:emmc
(bootloader) partition-size: pdat:0x00500000
(bootloader) partition-type: pdat:emmc
(bootloader) partition-size: dfw2:0x00100000
(bootloader) partition-type: dfw2:emmc
(bootloader) partition-size: dfw1:0x00100000
(bootloader) partition-type: dfw1:emmc
(bootloader) partition-size: mafw:0x00600000
(bootloader) partition-type: mafw:emmc
(bootloader) partition-size: ldat:0x00300000
(bootloader) partition-type: ldat:emmc
(bootloader) partition-size: mlfw:0x00100000
(bootloader) partition-type: mlfw:emmc
(bootloader) partition-size: ddri:0x00100000
(bootloader) partition-type: ddri:emmc
(bootloader) partition-size: wfdp:0x00100000
(bootloader) partition-type: wfdp:emmc
(bootloader) partition-size: reserved2:0x00100000
(bootloader) partition-type: reserved2:emmc
(bootloader) partition-size: adsp:0x00300000
(bootloader) partition-type: adsp:emmc
(bootloader) partition-size: epg:0x02600000
(bootloader) partition-type: epg:emmc
(bootloader) partition-size: ddb:0x00100000
(bootloader) partition-type: ddb:emmc
(bootloader) partition-size: svc:0x00100000
(bootloader) partition-type: svc:emmc
(bootloader) partition-size: edid:0x00100000
(bootloader) partition-type: edid:emmc
(bootloader) partition-size: ci:0x00100000
(bootloader) partition-type: ci:emmc
(bootloader) partition-size: panel:0x00100000
(bootloader) partition-type: panel:emmc
(bootloader) partition-size: 3rd_ro:0x07c00000
(bootloader) partition-type: 3rd_ro:emmc
(bootloader) partition-size: hdmi:0x00100000
(bootloader) partition-type: hdmi:emmc
(bootloader) partition-size: 3rd_rw:0x0e900000
(bootloader) partition-type: 3rd_rw:emmc
(bootloader) partition-size: basic:0x09f00000
(bootloader) partition-type: basic:emmc
(bootloader) partition-size: linux_rootfsA:0x06400000
(bootloader) partition-type: linux_rootfsA:emmc
(bootloader) partition-size: tzbp:0x00200000
(bootloader) partition-type: tzbp:emmc
(bootloader) partition-size: bootlogo:0x00400000
(bootloader) partition-type: bootlogo:emmc
(bootloader) partition-size: aq:0x00100000
(bootloader) partition-type: aq:emmc
(bootloader) partition-size: pq:0x00500000
(bootloader) partition-type: pq:emmc
(bootloader) partition-size: channelB:0x00100000
(bootloader) partition-type: channelB:emmc
(bootloader) partition-size: channelA:0x00100000
(bootloader) partition-type: channelA:emmc
(bootloader) partition-size: reserved1:0x00100000
(bootloader) partition-type: reserved1:emmc
(bootloader) partition-size: boot:0x01400000
(bootloader) partition-type: boot:emmc
(bootloader) partition-size: perm:0x00800000
(bootloader) partition-type: perm:emmc
(bootloader) partition-size: eeprom_A:0x00100000
(bootloader) partition-type: eeprom_A:emmc
(bootloader) partition-size: uboot_env:0x00200000
(bootloader) partition-type: uboot_env:emmc
(bootloader) partition-size: uboot:0x00200000
(bootloader) partition-type: uboot:emmc
(bootloader) product: amai
(bootloader) unlocked: yes
(bootloader) secure: no
(bootloader) product: board-mtxx
(bootloader) version-baseband: 2.0
(bootloader) version-bootloader: 1.1
(bootloader) serialno: 000xxxxxxxxxxxxxxx
(bootloader) version: 0.5
all: Done!!
finished. total time: 0.837s

as u see device bootlaoder unlocked and maybe we can patch the device with Magisk.. let me try to read fw by Infinty Box...