Hi all,
It's been a long time since I released my root guide for Xperia XA and I'm back for the same reasons: I didn't find a way to root my new Smart TV so I worked hard to find the way and now I want to share the answer with you.
## Background
I bough a cheap Smart TV as a replacement of my 15 years old LG TV used as a monitor for my PC.
It's a 32" TV, manufactured by STRONG, model is SRT 32HC4432, Soc is MSD6683 and codename is "komagome"
The TV have Android TV 9 with only 1GB RAM so it's slooooow and the sound is awfull, I thinked "OK let's root it and tweak it a little". After a long search I found nothing easy and usable for my TV: No "one click" root solution, no factory firmware to extract boot.img and patch it, no TWRP and all guides are outdated for my TV. So I started from scratch (or near).
This guide should works for a lot of TV with MSTAR Soc and Android TV 9.
## Rooting MSTAR TV on Android TV 9 (PIE)
Before proceeding a word of caution (or why you wouldn't like to root your TV):
1. Unlocking your BootLoader will void your warranty.
2. Unlocking your bootloader will wipe the device (factory reset) so make a backup !
3. Disabling dm-verity is a security flaw
3. If you have confidential files in your TV don't unlock your bootloader, as long as your TV is locked your data are officially secured.
4. Opening your TV will void your warranty too.
5. If you brick your TV and you don't have a factory firmware you will no be able to recover it.
6. This guide is not for noob and I will not answer questions like: How to enable ADB? What is UART? How to connect with Putty?
Edit: rooting will break videos on YouTube, Netflix,... Thanks to @dante_ov for the feedback, I will try to find why and fix the problem.
## Requirement
- Adb and Fastboot drivers on your PC
- An USB to serial adapter
- Some solder skills if you are not lucky like me
- Putty software or equivalent
- A USB key (or two)
- Magisk Manager apk
- A file manager app to install apk
- A brain (recommanded)
## Method
1) Unplug the power cord of the TV and remove the back cover of the TV.
2) Connect RX, TX and GND of your adapter on the UART port of the motherboard, DO NOT CONNECT VCC ! On my motherboard it's at the bottom near RCA connectors and I have to solder wires because there is no socket
3) Connect Putty with speed set to 115200
4) Plug the power cord and right after keep pressing Enter on your PC until you see the prompt in the terminal session. For me the prompt is <<M5621>>#
6) We need the partitions info, the command ismmc part
copy/paste the result in a text file on your PC and save it, now we can make a backup of all partitions.
7) Format your USB key in FAT32 and plug it on the USB port on the right of the TV, it will be USB 0, if you connect on the bottom USB port it will be USB 2 or 3. Given commands will be for USB 0.
8) Enter command usb reset 0 to initialize the key
9) For root we only need the recovery partition but to be safe make a backup of all partitions. Be carefull with userdata partition because of FAT32 limitations, size limit is 4GB. You can skip it if you don't care about your user data.
You have to backup partitions one by one because the commands with emmcbin without comments and mmc dd mmc2usb to make a full backup corrupt the dump or the USB key
The command looks like:
emmcbin [usbportnum] [pad] [binname] [offset/partitionname] [dumpsize]
For [offset/partitionname] we use the name of the partition and for [dumpsize] we use length, both values obtained at step 6. [binname] is the name of the created file on the USB key.
For sample:
emmcbin 0 0 recovery.bin recovery 65536
after the dump, if like me you have an error
** Bad Signature on 0:37: expected 0x5840, got 0x0000
[do_emmc_mkbin]: check bininfo of part 37 failed ignore it
10) Now that you have all partitions enter usb stop
Unplug the key and copy the content in a safe place
11) We have to unlock the bootloader by entering
avbab set_device_state 0
setenv devicestate unlock
saveenv
12) We have to disable dm-verity to avoid bootloop, command is
avbab disable-verity
13) Unplug/replug the tv and boot normally, you should see the annoying message " /!\ Your bootloader is unlocked ... " and the wipe data processing screen right after. Wait and follow the setup wizard, enable ABD on the TV then install Magisk Manager app.
13) Rename recovery.bin to recovery.img, copy it on the USB key and plug it on the bottom port of the TV.
14) Open Magisk Manager and patch recovery.img, don't uncheck recovery setting box.
15) On your computer, pull the patched recovery with ADB, it should be in /storage/emulated/0/Download/Magisk_patched_XXX.img
Then copy it on the USB key from the PC and rename it recovery2.bin
I have to do like this because I can't simply copy/paste from internal storage to USB (permission denied)
16) Plug the key on the right side of the tv and do step 4 again
17) We will flash the patched recovery on the recovery partition and on boot too !
(I will explain why later)
Commands are:
usb reset 0
usb_partial_upgrade_to_emmc recovery2.bin recovery
usb_partial_upgrade_to_emmc recovery2.bin boot
18) unplug/plug the power cord and boot normally
19) YOU ARE ROOTED !
20) Hit the thank button on this post
## Unroot
You can unroot the device by flashing the stock boot and recovery with commands from step 17.
You can enable dm-verity again with avbab enable-verity command
You can relock the bootloader with avbab set_device_state 1 command
## Conclusions and comments
If you are familiar with MSTAR devices you noticed that I didn't used special tools and keys, all ways used before are not working anymore, upgrade packages are differents too. Now they are in pkg format so it's not possible to extract boot, recovery, system, ... like before (or I missed the way)
I found a factory firmware for the KIVI 32f710kw who is the copy of my TV but I wasn't able to unpack it.
SPI and TFTP ways are not possible on my TV (as I tried).
An other big change is that the TV uses "system as root" to work so the ramdisk is in system partition and not in the boot that's why I flashed the patched recovery on boot too on step 17.
You can flash only on recovery partition but each time you shutdown (not standby) the TV you will have to reboot to recovery to trigger the root as explained in Magisk documentation.
I don't know if UART through HDMI is working on power on to do the same without opening the TV, I can enable it in the factory menu within Android but I don't have the adapter to try.
## What next ?
Now that I have root and disabled dm-verity I'm free to edit factory configs to enable some features, add the missing HDCP2 key and tweak the firmware.
An other good thing will be to try firmwares from differents TV and GSI Roms
because YES my TV is "Treble enabled"
Have a nice day and good luck !
Thanks for sharing
rrvuhpg said:
We have to unlock the bootloader by entering
avbab set_device_state 0
Click to expand...
Click to collapse
avbab seems not exist on my MSD338 based TV. Upon entering the commands in the console (<< MStar >>#), it returns an error saying Unknown command 'avbab' - try 'help'. The command also doesn't appear in help
The other commands do work though
Do commands differ between devices? Is there any alternative command I can use on my TV, that also unlocks the bootloader? Is there some proper documentation for these commands, since the descriptions in help are really vague
sagnikpal2004 said:
avbab seems not exist on my MSD338 based TV. Upon entering the commands in the console (<< MStar >>#), it returns an error saying Unknown command 'avbab' - try 'help'. The command also doesn't appear in help
The other commands do work though
Do commands differ between devices? Is there any alternative command I can use on my TV, that also unlocks the bootloader? Is there some proper documentation for these commands, since the descriptions in help are really vague
Click to expand...
Click to collapse
Hi,
After a quick search it looks like MSD338 is an "old" Soc so all previous commands and tools should works. You will probably have better answers for MSD338 here: https://forum.xda-developers.com/t/tools-mstar-android-tv-firmware-tools.3559227/
rrvuhpg said:
Hi all,
It's been a long time since I released my root guide for Xperia XA and I'm back for the same reasons: I didn't find a way to root my new Smart TV so I worked hard to find the way and now I want to share the answer with you.
## Background
I bough a cheap Smart TV as a replacement of my 15 years old LG TV used as a monitor for my PC.
It's a 32" TV, manufactured by STRONG, model is SRT 32HC4432, Soc is MSD6683 and codename is "komagome"
The TV have Android TV 9 with only 1GB RAM so it's slooooow and the sound is awfull, I thinked "OK let's root it and tweak it a little". After a long search I found nothing easy and usable for my TV: No "one click" root solution, no factory firmware to extract boot.img and patch it, no TWRP and all guides are outdated for my TV. So I started from scratch (or near).
This guide should works for a lot of TV with MSTAR Soc and Android TV 9.
## Rooting MSTAR TV on Android TV 9 (PIE)
Before proceeding a word of caution (or why you wouldn't like to root your TV):
1. Unlocking your BootLoader will void your warranty.
2. Unlocking your bootloader will wipe the device (factory reset) so make a backup !
3. Disabling dm-verity is a security flaw
3. If you have confidential files in your TV don't unlock your bootloader, as long as your TV is locked your data are officially secured.
4. Opening your TV will void your warranty too.
5. If you brick your TV and you don't have a factory firmware you will no be able to recover it.
6. This guide is not for noob and I will not answer questions like: How to enable ADB? What is UART? How to connect with Putty?
Edit: rooting will break videos on YouTube, Netflix,... Thanks to @dante_ov for the feedback, I will try to find why and fix the problem.
## Requirement
- Adb and Fastboot drivers on your PC
- An USB to serial adapter
- Some solder skills if you are not lucky like me
- Putty software or equivalent
- A USB key (or two)
- Magisk Manager apk
- A file manager app to install apk
- A brain (recommanded)
## Method
1) Unplug the power cord of the TV and remove the back cover of the TV.
2) Connect RX, TX and GND of your adapter on the UART port of the motherboard, DO NOT CONNECT VCC ! On my motherboard it's at the bottom near RCA connectors and I have to solder wires because there is no socket
3) Connect Putty with speed set to 115200
4) Plug the power cord and right after keep pressing Enter on your PC until you see the prompt in the terminal session. For me the prompt is <<M5621>>#
6) We need the partitions info, the command ismmc part
copy/paste the result in a text file on your PC and save it, now we can make a backup of all partitions.
7) Format your USB key in FAT32 and plug it on the USB port on the right of the TV, it will be USB 0, if you connect on the bottom USB port it will be USB 2 or 3. Given commands will be for USB 0.
8) Enter command usb reset 0 to initialize the key
9) For root we only need the recovery partition but to be safe make a backup of all partitions. Be carefull with userdata partition because of FAT32 limitations, size limit is 4GB. You can skip it if you don't care about your user data.
You have to backup partitions one by one because the commands with emmcbin without comments and mmc dd mmc2usb to make a full backup corrupt the dump or the USB key
The command looks like:
emmcbin [usbportnum] [pad] [binname] [offset/partitionname] [dumpsize]
For [offset/partitionname] we use the name of the partition and for [dumpsize] we use length, both values obtained at step 6. [binname] is the name of the created file on the USB key.
For sample:
emmcbin 0 0 recovery.bin recovery 65536
after the dump, if like me you have an error
** Bad Signature on 0:37: expected 0x5840, got 0x0000
[do_emmc_mkbin]: check bininfo of part 37 failed ignore it
10) Now that you have all partitions enter usb stop
Unplug the key and copy the content in a safe place
11) We have to unlock the bootloader by entering
avbab set_device_state 0
setenv devicestate unlock
saveenv
12) We have to disable dm-verity to avoid bootloop, command is
avbab disable-verity
13) Unplug/replug the tv and boot normally, you should see the annoying message " /!\ Your bootloader is unlocked ... " and the wipe data processing screen right after. Wait and follow the setup wizard, enable ABD on the TV then install Magisk Manager app.
13) Rename recovery.bin to recovery.img, copy it on the USB key and plug it on the bottom port of the TV.
14) Open Magisk Manager and patch recovery.img, don't uncheck recovery setting box.
15) On your computer, pull the patched recovery with ADB, it should be in /storage/emulated/0/Download/Magisk_patched_XXX.img
Then copy it on the USB key from the PC and rename it recovery2.bin
I have to do like this because I can't simply copy/paste from internal storage to USB (permission denied)
16) Plug the key on the right side of the tv and do step 4 again
17) We will flash the patched recovery on the recovery partition and on boot too !
(I will explain why later)
Commands are:
usb reset 0
usb_partial_upgrade_to_emmc recovery2.bin recovery
usb_partial_upgrade_to_emmc recovery2.bin boot
18) unplug/plug the power cord and boot normally
19) YOU ARE ROOTED !
20) Hit the thank button on this post
## Unroot
You can unroot the device by flashing the stock boot and recovery with commands from step 17.
You can enable dm-verity again with avbab enable-verity command
You can relock the bootloader with avbab set_device_state 1 command
## Conclusions and comments
If you are familiar with MSTAR devices you noticed that I didn't used special tools and keys, all ways used before are not working anymore, upgrade packages are differents too. Now they are in pkg format so it's not possible to extract boot, recovery, system, ... like before (or I missed the way)
I found a factory firmware for the KIVI 32f710kw who is the copy of my TV but I wasn't able to unpack it.
SPI and TFTP ways are not possible on my TV (as I tried).
An other big change is that the TV uses "system as root" to work so the ramdisk is in system partition and not in the boot that's why I flashed the patched recovery on boot too on step 17.
You can flash only on recovery partition but each time you shutdown (not standby) the TV you will have to reboot to recovery to trigger the root as explained in Magisk documentation.
I don't know if UART through HDMI is working on power on to do the same without opening the TV, I can enable it in the factory menu within Android but I don't have the adapter to try.
## What next ?
Now that I have root and disabled dm-verity I'm free to edit factory configs to enable some features, add the missing HDCP2 key and tweak the firmware.
An other good thing will be to try firmwares from differents TV and GSI Roms
because YES my TV is "Treble enabled"
Have a nice day and good luck !
Click to expand...
Click to collapse
Hello,
Thanks you very much! Very useful guide, I was able to root my TV following the instructions, I have a JVC with mainboard 17MB170 (Produced by VESTEL). UART is over VGA, I connected through a RaspberryPi 3 B+ UART pins with PuTTY because I didn't have any USB to UART interface.
My questions is:
Is there any solution for the process not breaking YouTube and Netflix, I installed SafetyNet module and it showing to be compliant but still YouTube is not working. (Application opens up but throws an error when you try to play any video)
Best regards!
ScorpionXII said:
Hello,
Thanks you very much! Very useful guide, I was able to root my TV following the instructions, I have a JVC with mainboard 17MB170 (Produced by VESTEL). UART is over VGA, I connected through a RaspberryPi 3 B+ UART pins with PuTTY because I didn't have any USB to UART interface.
My questions is:
Is there any solution for the process not breaking YouTube and Netflix, I installed SafetyNet module and it showing to be compliant but still YouTube is not working. (Application opens up but throws an error when you try to play any video)
Best regards!
Click to expand...
Click to collapse
Hi,
I'm happy to see that my guide worked for you
I never found how to fix the issue with YouTube and Netflix, sorry for that.
If you find the fix you can share it here
Very nice tutorial!
I managed to root my NOBLEX DM32X7000 TV (also MSD6683-based) thanks to your method and it works fine except for one huge issue...
While you all mention that YouTube and Netflix breaks for you, I didn't have that problem at all. Instead, my Live TV app breaks and it gets stuck on "Retrieving data..." for all inputs when the boot image is patched with Magisk.
Would you mind sharing your LiveTV and MtkTvInput apps so I can try mix and matching them?
Finding other firmwares for this SoC is quite difficult, I haven't been able to find one so far.
Seem hardcode for me
rrvuhpg said:
Hi all,
It's been a long time since I released my root guide for Xperia XA and I'm back for the same reasons: I didn't find a way to root my new Smart TV so I worked hard to find the way and now I want to share the answer with you.
## Background
I bough a cheap Smart TV as a replacement of my 15 years old LG TV used as a monitor for my PC.
It's a 32" TV, manufactured by STRONG, model is SRT 32HC4432, Soc is MSD6683 and codename is "komagome"
The TV have Android TV 9 with only 1GB RAM so it's slooooow and the sound is awfull, I thinked "OK let's root it and tweak it a little". After a long search I found nothing easy and usable for my TV: No "one click" root solution, no factory firmware to extract boot.img and patch it, no TWRP and all guides are outdated for my TV. So I started from scratch (or near).
This guide should works for a lot of TV with MSTAR Soc and Android TV 9.
## Rooting MSTAR TV on Android TV 9 (PIE)
Before proceeding a word of caution (or why you wouldn't like to root your TV):
1. Unlocking your BootLoader will void your warranty.
2. Unlocking your bootloader will wipe the device (factory reset) so make a backup !
3. Disabling dm-verity is a security flaw
3. If you have confidential files in your TV don't unlock your bootloader, as long as your TV is locked your data are officially secured.
4. Opening your TV will void your warranty too.
5. If you brick your TV and you don't have a factory firmware you will no be able to recover it.
6. This guide is not for noob and I will not answer questions like: How to enable ADB? What is UART? How to connect with Putty?
Edit: rooting will break videos on YouTube, Netflix,... Thanks to @dante_ov for the feedback, I will try to find why and fix the problem.
## Requirement
- Adb and Fastboot drivers on your PC
- An USB to serial adapter
- Some solder skills if you are not lucky like me
- Putty software or equivalent
- A USB key (or two)
- Magisk Manager apk
- A file manager app to install apk
- A brain (recommanded)
## Method
1) Unplug the power cord of the TV and remove the back cover of the TV.
2) Connect RX, TX and GND of your adapter on the UART port of the motherboard, DO NOT CONNECT VCC ! On my motherboard it's at the bottom near RCA connectors and I have to solder wires because there is no socket
3) Connect Putty with speed set to 115200
4) Plug the power cord and right after keep pressing Enter on your PC until you see the prompt in the terminal session. For me the prompt is <<M5621>>#
6) We need the partitions info, the command ismmc part
copy/paste the result in a text file on your PC and save it, now we can make a backup of all partitions.
7) Format your USB key in FAT32 and plug it on the USB port on the right of the TV, it will be USB 0, if you connect on the bottom USB port it will be USB 2 or 3. Given commands will be for USB 0.
8) Enter command usb reset 0 to initialize the key
9) For root we only need the recovery partition but to be safe make a backup of all partitions. Be carefull with userdata partition because of FAT32 limitations, size limit is 4GB. You can skip it if you don't care about your user data.
You have to backup partitions one by one because the commands with emmcbin without comments and mmc dd mmc2usb to make a full backup corrupt the dump or the USB key
The command looks like:
emmcbin [usbportnum] [pad] [binname] [offset/partitionname] [dumpsize]
For [offset/partitionname] we use the name of the partition and for [dumpsize] we use length, both values obtained at step 6. [binname] is the name of the created file on the USB key.
For sample:
emmcbin 0 0 recovery.bin recovery 65536
after the dump, if like me you have an error
** Bad Signature on 0:37: expected 0x5840, got 0x0000
[do_emmc_mkbin]: check bininfo of part 37 failed ignore it
10) Now that you have all partitions enter usb stop
Unplug the key and copy the content in a safe place
11) We have to unlock the bootloader by entering
avbab set_device_state 0
setenv devicestate unlock
saveenv
12) We have to disable dm-verity to avoid bootloop, command is
avbab disable-verity
13) Unplug/replug the tv and boot normally, you should see the annoying message " /!\ Your bootloader is unlocked ... " and the wipe data processing screen right after. Wait and follow the setup wizard, enable ABD on the TV then install Magisk Manager app.
13) Rename recovery.bin to recovery.img, copy it on the USB key and plug it on the bottom port of the TV.
14) Open Magisk Manager and patch recovery.img, don't uncheck recovery setting box.
15) On your computer, pull the patched recovery with ADB, it should be in /storage/emulated/0/Download/Magisk_patched_XXX.img
Then copy it on the USB key from the PC and rename it recovery2.bin
I have to do like this because I can't simply copy/paste from internal storage to USB (permission denied)
16) Plug the key on the right side of the tv and do step 4 again
17) We will flash the patched recovery on the recovery partition and on boot too !
(I will explain why later)
Commands are:
usb reset 0
usb_partial_upgrade_to_emmc recovery2.bin recovery
usb_partial_upgrade_to_emmc recovery2.bin boot
18) unplug/plug the power cord and boot normally
19) YOU ARE ROOTED !
20) Hit the thank button on this post
## Unroot
You can unroot the device by flashing the stock boot and recovery with commands from step 17.
You can enable dm-verity again with avbab enable-verity command
You can relock the bootloader with avbab set_device_state 1 command
## Conclusions and comments
If you are familiar with MSTAR devices you noticed that I didn't used special tools and keys, all ways used before are not working anymore, upgrade packages are differents too. Now they are in pkg format so it's not possible to extract boot, recovery, system, ... like before (or I missed the way)
I found a factory firmware for the KIVI 32f710kw who is the copy of my TV but I wasn't able to unpack it.
SPI and TFTP ways are not possible on my TV (as I tried).
An other big change is that the TV uses "system as root" to work so the ramdisk is in system partition and not in the boot that's why I flashed the patched recovery on boot too on step 17.
You can flash only on recovery partition but each time you shutdown (not standby) the TV you will have to reboot to recovery to trigger the root as explained in Magisk documentation.
I don't know if UART through HDMI is working on power on to do the same without opening the TV, I can enable it in the factory menu within Android but I don't have the adapter to try.
## What next ?
Now that I have root and disabled dm-verity I'm free to edit factory configs to enable some features, add the missing HDCP2 key and tweak the firmware.
An other good thing will be to try firmwares from differents TV and GSI Roms
because YES my TV is "Treble enabled"
Have a nice day and good luck !
Click to expand...
Click to collapse
Will this method work on my Hisense 50A71F, based on Board : MSD6886, platform M7322?
rrvuhpg said:
4) Enchufe el cable de alimentación y luego siga presionando Enter en su PC hasta que vea el mensaje en la sesión de terminal. Para mí, el aviso es <<M5621>>#
Click to expand...
Click to collapse
Hola . Tengo en mi taller un tv con micro MSD6683BQHT... Obtengo el log en consola sin problemas pero no puedo entrar a modo super usuario de ninguna manera como demás tv . He usado enter, esc hasta botón de power presionado etc etc . Alguien me ayuda ?
Thank you, I have successfully rooted my device following the tutorial.
Related
As always Any information I give is free and this information is to be used at your own risk I take no responsibility for your device this is just my experience and i hope it helps someone with the same problem i had
I recently bought the Double Power (DOPO) M7088 Jelly Bean 4.1.1 Tablet from Walmart.com After a few days of searching and many failed Attempts I finally found out how to root this device and would like to share it to those having the same problem.
After doing some digging i descover the Dopo tablets are nothing more than a rebranded generic rock ship tablets so after some searching here is what i found.
Things you will Need.
1.Pdanet+ for android installer (just type in pdanet+ in your search engine of choice)
2.Your device and usb cable
3.The free download of unlockrootpro (Just type unlockroot into your search engine of choice
Steps.
1. Download and install Pdanet+
2 Download and install unlockrootpro free Version
a. you must be connected to the internet for the installer to work.
b. the unlockroot pro will download a file to your computer that is in itself a down loader it is safe but it does try to get you to install some 3rd part software. if you click the close button it will give you the option to skip the 3rd party software and install just the unlockroot software. it does this 2 or 3 times just click close and skip each time.
3. Connect your Tablet up to the PC and allow all the drivers to install.
4. Once connected start unlockrootpro once it is ope click the green root button it should detect your device and bring up a box just click the button and it will install the root.
a. Now i noticed after it installed the root and say rebooting device my device would not reboot. I unplugged my device and then plugged it right back in and the device immediately rebooted
5. Once your table has rebooted download root checker or the app of your choice to verify root access.
I hope this helped anyone with a Dopo m7088
I don't know if this method will work for any of the other Double Power Tablets so i honestly cannot answer any questions other than what i have stated but feel free to try it if you cannot find any other method.
If this method does Work for you please post a coment on your steps and what device you used this method on so that you can help the community.
M7088
Well i have found out that there is a way to ROOT the M7088 from walmart with out internet connection
Download Moborobo in order to load drivers for the M7088
Just download the same software as you would for the PIPO S1 Its all over the net now and also this M7088 has an attitude about rooting so you might have to click root a couple time to force it to but it does work quite well the Chinese software ( ZhuoDaShi ) after its done you will get a message window in Chinese just copy and paste that text into Google translator and it will tell you ROOT is good Ha Ha ha have fun
backslashx said:
As always Any information I give is free and this information is to be used at your own risk I take no responsibility for your device this is just my experience and i hope it helps someone with the same problem i had
I recently bought the Double Power (DOPO) M7088 Jelly Bean 4.1.1 Tablet from Walmart.com After a few days of searching and many failed Attempts I finally found out how to root this device and would like to share it to those having the same problem.
After doing some digging i descover the Dopo tablets are nothing more than a rebranded generic rock ship tablets so after some searching here is what i found.
Things you will Need.
1.Pdanet+ for android installer (just type in pdanet+ in your search engine of choice)
2.Your device and usb cable
3.The free download of unlockrootpro (Just type unlockroot into your search engine of choice
Steps.
1. Download and install Pdanet+
2 Download and install unlockrootpro free Version
a. you must be connected to the internet for the installer to work.
b. the unlockroot pro will download a file to your computer that is in itself a down loader it is safe but it does try to get you to install some 3rd part software. if you click the close button it will give you the option to skip the 3rd party software and install just the unlockroot software. it does this 2 or 3 times just click close and skip each time.
3. Connect your Tablet up to the PC and allow all the drivers to install.
4. Once connected start unlockrootpro once it is ope click the green root button it should detect your device and bring up a box just click the button and it will install the root.
a. Now i noticed after it installed the root and say rebooting device my device would not reboot. I unplugged my device and then plugged it right back in and the device immediately rebooted
5. Once your table has rebooted download root checker or the app of your choice to verify root access.
I hope this helped anyone with a Dopo m7088
I don't know if this method will work for any of the other Double Power Tablets so i honestly cannot answer any questions other than what i have stated but feel free to try it if you cannot find any other method.
If this method does Work for you please post a coment on your steps and what device you used this method on so that you can help the community.
Click to expand...
Click to collapse
Firmware
Hey awesome i may have a chance to try that method out on my tablet soon if i am lucky. I was wondering if anyone or the one that commented on my original post. I need a copy of the firmware for this tablet mine crashed after lending it out to a friend i am afraid he tried to modify it and somehow corrupted the system it is stuck on the dopo start up screen. if there is anyone who can provide a clean copy of this or even maybe dump a copy of theirs for me i would greatly appreciate it.
.
zxhwk said:
Well i have found out that there is a way to ROOT the M7088 from walmart with out internet connection
Download Moborobo in order to load drivers for the M7088
Just download the same software as you would for the PIPO S1 Its all over the net now and also this M7088 has an attitude about rooting so you might have to click root a couple time to force it to but it does work quite well the Chinese software ( ZhuoDaShi ) after its done you will get a message window in Chinese just copy and paste that text into Google translator and it will tell you ROOT is good Ha Ha ha have fun
Click to expand...
Click to collapse
hey this is great news and I thank you !!!
I was wondering if the m7088 caan be upgraded to CM10/4.2.2?
thanks
I don't know if you can install any form of CM on it as of yet. I have successfully I believe Dumped a copy of the system and recovery images from my M7088. Unfortunately my last unit was toast but being under warrantee i sent it back and they replaced it. Soon as I had it i researched how to back up the system just in case. I can provide my copy of the dump or show the process i used to do it.
I don't know if the dump I have is what is exactly a proper form of back up or recovery. I also don't know what is needed to mod it for CM but at least this is a start to anyone who would like to try.
If there is anyone who would like to and would like the Files I have dumped or any help I can provide let me know. I would like to see Cm/4.2.2 working on this device.
Easy way to root any Dopo tablet
I am not responsible for anything. Use this at your on risk.
Download and install Exynos abuse .
Then Uninstall and get any kind of root checker to verify root access.
And that's it.
Worked for me with no problems. NOW My Dopo tablet is faster than when I got it out the box. With minor tweaking apps and my 32 gb external SD card as my internal SD card and you can find the thread on how to do this on xda forums. Running games like NFS MW, Modern Combat 2 and 3,Nba Jam for android.To run good games like these I had to get a system app freezer like titanium backup to freeze a few useless apps. So now these games run very smooth and flawlessly.Good luck.
backslashx said:
I don't know if you can install any form of CM on it as of yet. I have successfully I believe Dumped a copy of the system and recovery images from my M7088. Unfortunately my last unit was toast but being under warrantee i sent it back and they replaced it. Soon as I had it i researched how to back up the system just in case. I can provide my copy of the dump or show the process i used to do it.
I don't know if the dump I have is what is exactly a proper form of back up or recovery. I also don't know what is needed to mod it for CM but at least this is a start to anyone who would like to try.
If there is anyone who would like to and would like the Files I have dumped or any help I can provide let me know. I would like to see Cm/4.2.2 working on this device.
Click to expand...
Click to collapse
I ran across this post and was wondering if you have the original system and recovery images, as I rooted my M7088 and lost my backup files
m7088 firmware
I am looking for a copy of the firmware for my m7008 tablet.
I am trying to fix a problem of it not starting up its stuck on the DOPO screen.
I believe I can re flash it but DOPO will not send me the file they want me to send in.
Any help will be appreciated.
DOPO logo screen-freeze
putertim said:
I am looking for a copy of the firmware for my m7008 tablet.
I am trying to fix a problem of it not starting up its stuck on the DOPO screen.
I believe I can re flash it but DOPO will not send me the file they want me to send in.
Any help will be appreciated.
Click to expand...
Click to collapse
Joining just to make a couple comments here. I find that DOPO logo screen-freeze seems to be common problem.
My story - This passed Christmas 2012 my son purchased a DOPO M7088 for his 12y/o son, and talked me into a like purchase for myself this past March 2013. Here in Jul 2013, the grandson is visiting with his tablet. When it became frozen with the DOPO screen one night - we tried everything that we could think of to restore. Even pointing fingers at him... to what surprise the following morning my tablet froze updating apps. When I tried to restart, reboot, reset... even tried Vol+/PwrUP, Vol-/PwrUP... allowing the power in the battery to drain to a point that the screen would not light up or flash. Then recharging - nothing worked passed the DOPO screen-freeze.
For reference - I have worked in electronics/computers from the late 60s - so I’m not a rookie here.
Fortunately – I purchased insurance with Wal-Mart, their tech-line made same suggestions as I had done to restore the system, and came to the conclusion that they will completely return/refund my purchase.
Strange that within 12hrs two like tablets crash following app updates, where one is for a young man (games) and the other for adult (general usage). The finger pointing had three other fingers pointing back at us. So apologies to the grandson.
My son may root/re-install the grandson’s system when they return home – for myself I’m going to upgrade to a better brand (now that I'm missing the tablet).
Hope this helps others to understand that the DOPO screen-freeze problem may not be their personal tablet problem but a product problem (I.E. firmware). /TDos
Need dump of 7088 rom
backslashx said:
I don't know if you can install any form of CM on it as of yet. I have successfully I believe Dumped a copy of the system and recovery images from my M7088. Unfortunately my last unit was toast but being under warrantee i sent it back and they replaced it. Soon as I had it i researched how to back up the system just in case. I can provide my copy of the dump or show the process i used to do it.
I don't know if the dump I have is what is exactly a proper form of back up or recovery. I also don't know what is needed to mod it for CM but at least this is a start to anyone who would like to try.
If there is anyone who would like to and would like the Files I have dumped or any help I can provide let me know. I would like to see Cm/4.2.2 working on this device.
Click to expand...
Click to collapse
Hello, I have damaged the ROM by a an installed app after rooting. I see you said that you made a dump of the ROM. If possible, can I get a copy of these files as this would help me greatly. I have rkAndroidTool.exe working. If it works out, I will post the procedure.
Thanks
Dump and Flash the dopo M7088 and other RK3066 based ROMs
Any information I give is to be used at your own risk. I take no responsibility for any damage to your device.
Here's my story: I installed an application to change the fonts after I rooted. This damaged the system and created a boot loop. At this point I had not worked out a reliable method to backup and restore the ROM and in the process of trying to fix, I wound up damaging the partitions trying to push a file back into the tablet with adb.
So in my research to restore the ROM, I came across several methods to flash the ROM, but very few methods to dump the complete ROM and I wanted to be able to extract and restore the entire ROM. In another thread, I found scripts to dump the rk3066 chipset. I expanded this idea and modified the scripts to flash the ROM as well. Also, I created an installer script to simplify the process.
These scripts need to use the Ubuntu Linux live DVD to dump and flash the ROM. The advantages of Linux is you can directly connect to the tablet in flash mode without the trouble of having to install drivers or the android SDK.
Download the Linux 12.04 LTS version from the following Link http://www.ubuntu.com/download/desktop .
Once downloaded, burn this ISO file to a DVD using your favorite DVD burning software. Most burning software have the ability to decode ISO files. If needed, here is a free ISO burner. Link: http://download.cnet.com/ImgBurn/3000-2646_4-10847481.html?tag=mncol;2
Download the attached zip file and copy the zip to the USB drive. Do not decompress in windows as we need to do this under linux to preserve the stored permissions.
Boot the PC from the DVD drive. This should start the Linux. You may need to press an “F” key during the BIOS boot to bring up a menu to select which drive to boot from. You should see a purple screen. This is Linux loading. Select the “Try Ubuntu” option and the Linux should boot to the Linux Desktop.
OK, we are in Linux!
Insert the USB drive into the PC wait for the Linux to open a window. It may take a little bit as we are running off a DVD and some resources need to load. Be patient and watch the light to finish blinking on the USB stick! Drag the “ExtractRomRK3066.zip” file in the USB window to the desktop.
Write down the name of the USB in the title bar of the window.
For example, My USB window says: F490-4740 in the title bar. Write this down, then move the USB window to the side.
Double click on the zip file, this opens the zip in a window. Drag the “ExtractRomRK3066“ folder in the zip window to the desktop. When the copy is finished, close the zip window.
Click on the “Dash Home” icon on the top left of the desktop, Type “Terminal” in the search box and select the terminal application icon.
In the Terminal Window type exactly as shown while observing the caps:
cd ~/Desktop/Ex*
Type the command:
ls -l
You should see a file named “install.sh” along with other commands ending with “.sh”.
Type the line as shown below including the “./”:
./install.sh
The required libraries should install to Linux. Don't worry this is only in memory as we are not installing anything to your hard drive. Make sure everything completed without Errors. If you only see warnings, this is OK!
Let's connect the Tablet to the USB port and put into flash mode. With the Tablet power off and the all cables removed, hold the Vol– button and plug in the USB cable. Continue to hold the Vol- button for 5 seconds. Let go of the Vol- button and connect the power cable. We should now be in flash mode.
We can test if we connected to flash mode by typing:
lsusb
You should see a list of USB devices. Within this list you should see a entry that has the ID:
ID: 2207:300a
If you see the ID, great we are connected to the tablet. If not, make sure the tablet is off and do the above Tablet procedure again.
OK we are connected!
Dumping the ROM
Type the following command replacing the “F490-4740” with your USB name we wrote down earlier from the USB title bar and follow the prompts. This will start the dump of the tablet:
sudo ./dumpall.sh /media/F490-4740/output
YAY! We are dumping the ROM!
Now we wait for “done...”, hopefully without any errors.
Double click on the “ output” folder in the USB drive window.
Verify that we have “backup.img”, “boot.img”, “kernel.img”, “misc.img”, “parm.img”, “recovery.img”, “system.img and userdata.img.
Now in the left panel of the USB window. Click on the ^ icon next to the USB drive description. This will unmount the USB drive for removal.
We are done!
Flashing the ROM
To flash a file you will notice other commands with the extension “.sh”. You may use any of these commands to restore all or part of the ROM.
For example:
To flash the below stock rom, extract the zip file to a USB drive and type the command changing the “F490-4740” to the name of your USB drive:
sudo ./flashall-user.sh /media/F490-4740/dopo7088stock
To flash a backup of all files including the userdata.img, type the command changing the “F490-4740” to the name of your USB drive:
sudo ./flashall.sh /media/F490-4740/dopo7088stock
To flash just the recovery, do the same as above only with the command:
sudo ./flashrecovery.sh /media/F490-4740/dopo7088stock
To flash just the system, do the same as above only with the command:
sudo ./flashsystem.sh /media/F490-4740/dopo7088stock
The valid command are:
sudo ./dump?.sh
or
sudo ./flash?.sh
replacing ? With:
all, all-user, backup, boot. cache, kernel, kpanic, misc, recovery, system, user, userdata
----------------------
Hope this helps somebody create a full backup.
Thanks.
UPDATE: I got another dopo m7088 tablet, created a backup using the above method and flashed my bricked m7088 tablet. Everything works again. YAY!
Below is the dumped stock rom for the dopo m7088. Hopes this help's sombody unbrick their tablet.
Extract the dopo7088stk.zip to a USB drive and follow the above instructions.
Thanks
Stock Rom Link: https://docs.google.com/file/d/0B8YnQA1FX-_yUU1ERXh1TjNUbnc/edit?usp=sharing
Thanks
I now have my M7088 again. Thank you . Your instructions where 100% right on.
Partition table not correct in stock M7088 ROM!
After I created the dump of the M7088 ROM and I flashed my tablet, I was looking at the parameter file and realized it was wrong from the factory!
There are several problems that may be the reason some people (including me) has had their devices brick for no apparent reason.
Below is the factory partition table. There is a blank space at address 118000 for a length of 11E000 bytes, this is not a problem. However, the "userdata" partition overruns the "kpanic" and "system" partition as well as the "system" partition overruns the "user" partition. This could lead to data corruption in the partitions.
Factory Partition Table: (length @ start)
[email protected](misc), (2000 + 2000 = 4000)
[email protected](kernel), (4000 + 4000 = 8000)
[email protected](boot), (8000 + 8000 = 10000)
[email protected](recovery), (10000 + 8000 = 18000)
[email protected](backup), (18000 + C0000 = D8000)
[email protected](cache), (D8000 + 40000 = 118000)
(ERROR - Space between 118000 and 236000)
[email protected](userdata), (236000 + 400000 = 636000)
(ERROR - 636000 is past 618000 and 61A000)
0x000020[email protected](kpanic), (618000 + 2000 = 61A000)
[email protected](system), (61A000 + 200000 = 81A000)
(ERROR - 81A000 is past 73A000)
[email protected](user) (73A000 -> end)
It looks like someone made a mistake and/or adjusted the partition sizes and never finished the job!
The only way to fix this is to correct the partition table and re-flash the entire device.
Before I corrected the "parameter" and "parm.img" file, I examined other RK3066 roms as well as the dopo TD1010. The TD1010 has a shorter "system" partition so the fixed partition table below is the same as the TD1010 all the way through the "kpanic" partition.
Fixed Partition Table: (length @ start)
[email protected](misc), (2000 + 2000 = 4000)
[email protected](kernel), (4000 + 4000 = 8000)
[email protected](boot), (8000 + 8000 = 10000)
[email protected](recovery), (10000 + 8000 = 18000)
[email protected](backup), (18000 + C0000 = D8000)
[email protected](cache), (D8000 + 40000 = 118000)
[email protected](userdata), (118000 + 400000 = 518000)
[email protected](kpanic), (518000 + 2000 = 51A000)
[email protected](system), (51A000 + 200000 = 71A000)
[email protected](user) (71A000 -> end)
I corrected the stock firmware and repacked it as dopo7088stkfixed.zip. This file can be flashed with the procedure in the earlier post, replacing the original zip package with this one.
Fixed Firmware Link: https://docs.google.com/file/d/0B8YnQA1FX-_yRmhIN1dCT245R2c/edit?usp=sharing
Also, remember to do a full wipe after flashing.
Thanks
---------- Post added at 02:12 PM ---------- Previous post was at 01:51 PM ----------
putertim said:
I now have my M7088 again. Thank you . Your instructions where 100% right on.
Click to expand...
Click to collapse
No problem. Check my above post. I discovered the partition tables from the factory are wrong which could cause data corruption.
Thanks
i keep on getting this error when trying to reflash i follow the steps i dont know what im doing wrong? ..please help.
[can't open input file 'parm.img': No such file or directory
Error: mkkrnlimg could not decode partition table
[email protected]:~/Desktop/ExtractRomRK3066$
bird56duce said:
i keep on getting this error when trying to reflash i follow the steps i dont know what im doing wrong? ..please help.
[can't open input file 'parm.img': No such file or directory
Error: mkkrnlimg could not decode partition table
[email protected]:~/Desktop/ExtractRomRK3066$
Click to expand...
Click to collapse
Sounds like the path to the files is incorrect.
The command "sudo ./flashall-user.sh /media/F490-4740/dopo7088stock" will look for the media in the path specified.
The "sudo ./flashall-user.sh" is the command part of the line.
The path can be interpreted as "/media/" + "The USB Drive Name in the title bar of the window" + "/" + "The Folder the media is in that has the parm.img file."
For example: if you have the files that includes the parm.img file on the USB drive in a folder called "ROM" and the name of the USB drive at the top of the USB drive window is "ABCD-0123", the line would look like:
sudo ./flashall-user.sh /media/ABCD-0123/ROM
Hope this helps.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
opening awsfai
mikeopi said:
Sounds like the path to the files is incorrect.
The command "sudo ./flashall-user.sh /media/F490-4740/dopo7088stock" will look for the media in the path specified.
The "sudo ./flashall-user.sh" is the command part of the line.
The path can be interpreted as "/media/" + "The USB Drive Name in the title bar of the window" + "/" + "The Folder the media is in that has the parm.img file."
For example: if you have the files that includes the parm.img file on the USB drive in a folder called "ROM" and the name of the USB drive at the top of the USB drive window is "ABCD-0123", the line would look like:
sudo ./flashall-user.sh /media/ABCD-0123/ROM
Hope this helps.
Click to expand...
Click to collapse
:good: I figured it out. thank you. I have another question what are the proper steps after flashing a new rom? I followed all your steps from dumping to flashing the new fixed rom, but cant get the device out of that stupid DOPO screen. After flashing with the new rom do you unplug it and reboot? BTW its not rooted. thanks
bird56duce said:
:good: I figured it out. thank you. I have another question what are the proper steps after flashing a new rom? I followed all your steps from dumping to flashing the new fixed rom, but cant get the device out of that stupid DOPO screen. After flashing with the new rom do you unplug it and reboot? BTW its not rooted. thanks
Click to expand...
Click to collapse
Hold the power key for about 15 seconds to force a shut down.
After shutting down, do you still get a stuck dopo screen?
If so, try a different USB port on the PC and try the procedure again. Sometime it does not seem to always take.
Make sure you are using the command sudo ./flashall.sh with the fixed rom. For the fixed rom to work, you have to flash all partitions. Then do a factory reset once it is fully booted.
Also, do a wipe. With the power off, hold the vol- and power key. This should bring you into the recovery menu. Do a wipe cache & wipe data/factory reset & reboot.
I have tried your technique at least 4 times and it doesn't work. I can't get through the Linux part with the downloaded file that you offer in your post. I get errors and I cannot go any further.
Either the file that you posted is not good or there is something else going on here. Any idea's? I have also seen other posts saying they cannot get past the errors.
mvalent000 said:
I have tried your technique at least 4 times and it doesn't work. I can't get through the Linux part with the downloaded file that you offer in your post. I get errors and I cannot go any further.
Either the file that you posted is not good or there is something else going on here. Any idea's? I have also seen other posts saying they cannot get past the errors.
Click to expand...
Click to collapse
Please give me more info on what the errors are and what command are they after?
mikeopi said:
Any information I give is to be used at your own risk. I take no responsibility for any damage to your device.
Here's my story: I installed an application to change the fonts after I rooted. This damaged the system and created a boot loop. At this point I had not worked out a reliable method to backup and restore the ROM and in the process of trying to fix, I wound up damaging the partitions trying to push a file back into the tablet with adb.
So in my research to restore the ROM, I came across several methods to flash the ROM, but very few methods to dump the complete ROM and I wanted to be able to extract and restore the entire ROM. In another thread, I found scripts to dump the rk3066 chipset. I expanded this idea and modified the scripts to flash the ROM as well. Also, I created an installer script to simplify the process.
These scripts need to use the Ubuntu Linux live DVD to dump and flash the ROM. The advantages of Linux is you can directly connect to the tablet in flash mode without the trouble of having to install drivers or the android SDK.
Download the Linux 12.04 LTS version from the following Link .
Once downloaded, burn this ISO file to a DVD using your favorite DVD burning software. Most burning software have the ability to decode ISO files. If needed, here is a free ISO burner. Link:
Download the attached zip file and copy the zip to the USB drive. Do not decompress in windows as we need to do this under linux to preserve the stored permissions.
Boot the PC from the DVD drive. This should start the Linux. You may need to press an “F” key during the BIOS boot to bring up a menu to select which drive to boot from. You should see a purple screen. This is Linux loading. Select the “Try Ubuntu” option and the Linux should boot to the Linux Desktop.
OK, we are in Linux!
Insert the USB drive into the PC wait for the Linux to open a window. It may take a little bit as we are running off a DVD and some resources need to load. Be patient and watch the light to finish blinking on the USB stick! Drag the “ExtractRomRK3066.zip” file in the USB window to the desktop.
Write down the name of the USB in the title bar of the window.
For example, My USB window says: F490-4740 in the title bar. Write this down, then move the USB window to the side.
Double click on the zip file, this opens the zip in a window. Drag the “ExtractRomRK3066“ folder in the zip window to the desktop. When the copy is finished, close the zip window.
Click on the “Dash Home” icon on the top left of the desktop, Type “Terminal” in the search box and select the terminal application icon.
In the Terminal Window type exactly as shown while observing the caps:
cd ~/Desktop/Ex*
Type the command:
ls -l
You should see a file named “install.sh” along with other commands ending with “.sh”.
Type the line as shown below including the “./”:
./install.sh
The required libraries should install to Linux. Don't worry this is only in memory as we are not installing anything to your hard drive. Make sure everything completed without Errors. If you only see warnings, this is OK!
Let's connect the Tablet to the USB port and put into flash mode. With the Tablet power off and the all cables removed, hold the Vol– button and plug in the USB cable. Continue to hold the Vol- button for 5 seconds. Let go of the Vol- button and connect the power cable. We should now be in flash mode.
We can test if we connected to flash mode by typing:
lsusb
You should see a list of USB devices. Within this list you should see a entry that has the ID:
ID: 2207:300a
If you see the ID, great we are connected to the tablet. If not, make sure the tablet is off and do the above Tablet procedure again.
OK we are connected!
Dumping the ROM
Type the following command replacing the “F490-4740” with your USB name we wrote down earlier from the USB title bar and follow the prompts. This will start the dump of the tablet:
sudo ./dumpall.sh /media/F490-4740/output
YAY! We are dumping the ROM!
Now we wait for “done...”, hopefully without any errors.
Double click on the “ output” folder in the USB drive window.
Verify that we have “backup.img”, “boot.img”, “kernel.img”, “misc.img”, “parm.img”, “recovery.img”, “system.img and userdata.img.
Now in the left panel of the USB window. Click on the ^ icon next to the USB drive description. This will unmount the USB drive for removal.
We are done!
Flashing the ROM
To flash a file you will notice other commands with the extension “.sh”. You may use any of these commands to restore all or part of the ROM.
For example:
To flash the below stock rom, extract the zip file to a USB drive and type the command changing the “F490-4740” to the name of your USB drive:
sudo ./flashall-user.sh /media/F490-4740/dopo7088stock
To flash a backup of all files including the userdata.img, type the command changing the “F490-4740” to the name of your USB drive:
sudo ./flashall.sh /media/F490-4740/dopo7088stock
To flash just the recovery, do the same as above only with the command:
sudo ./flashrecovery.sh /media/F490-4740/dopo7088stock
To flash just the system, do the same as above only with the command:
sudo ./flashsystem.sh /media/F490-4740/dopo7088stock
The valid command are:
sudo ./dump?.sh
or
sudo ./flash?.sh
replacing ? With:
all, all-user, backup, boot. cache, kernel, kpanic, misc, recovery, system, user, userdata
----------------------
Hope this helps somebody create a full backup.
Thanks.
UPDATE: I got another dopo m7088 tablet, created a backup using the above method and flashed my bricked m7088 tablet. Everything works again. YAY!
Below is the dumped stock rom for the dopo m7088. Hopes this help's sombody unbrick their tablet.
Extract the dopo7088stk.zip to a USB drive and follow the above instructions.
Thanks
Stock Rom Link:
Click to expand...
Click to collapse
I have tried this today about 8 times today. 4 with each folder you supplied in every usb port on my computer. I could do it all the way down to the dumping. I couldn't get any of the flashing working and my m7088 tablet is still stuck on the dopo screen. Please help as I would like to have this tablet working for my way home in a week.
I have Linux as a second os on my laptop so the first part was easy.
Thanks for your help so far. Good info
TVPad 4 is fourth in a series of Android-based IPTV settop boxes targeting the worldwide Chinese communities at large, although it seems to work well as a basic Android TV box. Support for all its predecessors (TVPad 1-3) have been discontinued. This guide will only focus on TVPad 4, model M418. Also this device have been banned from US and upgrading it may "brick" it - more on this later.
The method I used below is gathered from various sources elsewhere but not much on rooting and ADB. This is a compilation of all the most important info in one place. I am not sure if its bootloader is locked or not, but the Android 4.4 kernel sources can be found at openlinux.amlogic.com.
Physical specs:
AmLogic S805 SoC: ARM Cortex-A5, quad-core 1.5Ghz, Mali450 graphics, 1080p H.265 support
~1GB RAM
microSD card slot
HDMI out
USB-A port
Hardware needed:
To fully complete the process you'll need:
Monitor/TV with HDMI port
USB hub
microSD card
USB drive (optional)
USB keyboard
USB mouse
The remote that came with your box
Files needed:
* TVPad 4 5.054 firmware + TWRP 2.8.1.0: https://tvpadtalk.ca/discussion/1071/downgrading-tvpad-4-to-5-054/p1
The TWRP seems to be the modified from the one for AmLogic k200. Only the one from above work; the one from TWRP themselves do not.
* TVPad 4 5.066 OTA update: http://www.phoneunlock.com/forum/viewtopic.php?f=5&t=590
If you have this box and are in the US, do NOT do 5.066 update; your box is going to be banned. Might as well go all out and repurpose it into a general purpose Android TV box; but for the rest of the world, this update directs your box to different servers where it's mostly business as usual. You should be able to go direct from 5.054 to 5.066 following this guide, despite what others say.
* Root zip: http://www.freak-tab.de/finless/s89_root_update.zip
* APK install hint file:
Create a file named batchinstall.banana with contents below:
Code:
directory=
checkapp=no
Preparation
1. Download the 5.054 firmware and unzip into root of your microSD card. You should have recovery.img and TWRP folder. They are the TWRP recovery and a 5.054 TWRP backup respectively. Devices boots from recovery.img on root of microSD card if detected.
2. NON-US ONLY: Download the 5.066 OTA update to microSD root.
3. Download root zip to microSD root.
4. Put batchinstall.banana and any APKs you want to install on your USB drive or microSD. There is a APK pack of 23 apps for Cantonese speakers or 29 apps for Manadarin speakers available out there, but I haven't bothered. I included an updated SuperSU, ES File Explorer (preferably an older version; I used 4.0.4.9; newer ones are heavily loaded with ads), VLC, Firefox, AdAway, Terminal Emulator (by Jack Palevich). The last 4 being open source should also be available from F-Droid. Substitutions can be made to taste but Terminal Emulator is required to enable ADB (see below).
Enter Recovery
You will need to use stock recovery for OTA update AND TWRP for 5.054 firmware and root.
1. Connect HDMI monitor and USB hub to device. Connect USB keyboard and mouse to the hub. Leave power disconnected.
2. Look for a hole on the underside. If you have one, stick an iPhone/iPad SIM ejector pin in it and feel for a button. If able, this is the recovery button and you may skip to step 6.
3. Pull off the 4 rubber feet on the bottom and remove 4 screws under them.
4. Pry around the seams and lift the bottom cover off.
5. You either have a recovery button on the PCB or an empty spot for it. If no button, you'll have to short the bottom two contacts where the button is supposed to be (with all ports on the top edge).
6. Insert microSD card into "TF" slot. IMPORTANT: Leave popped out to enter stock recovery; fully insert to enter TWRP.
7. Press and hold the recovery button (or short the contacts) while plugging it in. Keep it pressed (or contacts shorted) until the recovery or TWRP appears.
8. Operate stock recovery with keyboard and TWRP with mouse.
Re-flash 5.054 - Downgrade/Unbrick
People do this to recover from "use restricted" or some other server errors after this thing is sued out of the States. I have also used it to recover from a soft brick situation.
1. Fully insert microSD card. Enter TWRP.
2. Select Restore. Choose External SD for storage.
3. Select the only available package to restore.
4. Swipe to Restore.
5. When complete, do not reboot yet. Return to main menu and select Wipe. Swipe to Factory Reset.
6. US ONLY: Remain in TWRP and proceed to step 2 of rooting.
7. NON-US ONLY: Return to main menu and select Reboot, Recovery. Immediately after screen go blank, push the microSD card again to eject it. It will pop out half way. Leave it hanging there. Proceed to update 5.066 next.
Update to 5.066 - NON-US ONLY! New server and Play Store support.
1. Enter stock recovery.
2. Fully insert microSD card.
3. Select Apply update from EXT and press Enter.
4. Select your 5.066 update file and press Enter.
5. When update complete, unplug power. Proceed to rooting.
Rooting
This is too easy with TWRP.
1. Fully insert microSD card. Enter TWRP.
2. Select Install, then the root zip file. Swipe to install.
3. Reboot into system and proceed with initial setup.
Kingroot also works but leaves some very persistent crap and questionable apps on the system so I do not recommend rooting using it.
Sideload apps
Plug the USB drive with your apps and batchinstall.banana file into the device or hub. Batch installer will appear. Select Batch Install and check that all apps you are installing are there and checked, then select Install.
Enable ADB
TVPad 4 does not have a USB slave port so ADB is only through TCP/IP. Steps below assume you have adb working on your computer.
1. Connect a USB mouse if not already.
2. Move mouse to right half of top of screen then drag down. Click on the gear to enter regular Android Settings app.
3. Enable Developer Options - About Mediabox, click Build Number 7 times.
4. Enable USB Debugging in Developer Options.
5. Open Terminal Emulator (sideload it if you haven't already).
6. Type in the following:
Code:
$ su
(Grant root if prompted)
# setprop service.adb.tcp.port 5555
# mount -o remount,rw /system
(Make the same setprop change in /system/build.prop - uncomment or add the line)
# stop adbd
# start adbd
7. Find the IP address of your TVPad from its own over-simplified settings page.
8. Open a command prompt/terminal on your computer and do this:
Code:
> adb connect <TVPAD IP ADDRESS>
(Authorize your computer on the TVPad.)
> adb devices
(confirm its IP is listed and not "unauthorized")
> adb shell
$ su
(grant root if prompted)
#
(success!)
# chmod 660 /data/misc/adb/adb_keys
(Double check permissions the public key file of authorized ADB clients)
9. Reboot and check that the change stays.
You're done! Now you have full control of this little TV box even after its server go under for good.
Additional apps
Kodi 15.2 seems to work on this box. 16.1 is untested. 17.x will not work since it requires Lollipop. Download from kodi.tv.
If all you want out of TVPad is TVB programming, the official app TVBAnywhere works on this box. About US$100/yr subscription for its own original programming only. Oh and it doesn't serve the States either. Go figure.
The gapps framework added with 5.066 is very minimal and doesn't work for eg. maps. You'll need to get it from apkpure. Use version 11.0.38-030-155006848.
I'm still looking for a decent launcher.
Credits:
https://www.youtube.com/watch?v=6evvWebosnU
https://www.youtube.com/watch?v=ZtY_qdYzmPs
https://www.youtube.com/watch?v=W2heIbUdZVE
can we flash any other rom on TVPad 4 since we can install TWRP??
I rooted easily with kingroot apk. to get shell, I just used my laptop as proxy between wifi and lan, created a meterpreter reverse_tcp metaploit payload, connected back to my laptop, shell and then su...
3vilhomer said:
can we flash any other rom on TVPad 4 since we can install TWRP??
Click to expand...
Click to collapse
To be honest, I'm more interested in if we can get Lollipop on this thing, for that is required for Kodi 17.
For whatever reason I can't boot into the TWRP. I have all the recovery.img and TWRP folder located in the root directory of the SDcard and my SDcard is FAT32 formatted. What did I do wrong?
Suppport has been officially terminated for this box so, it will only be a normal TVbox.
I'm kinda wondering if the SoC supports at least lollipop. A custom rom would be cool to run Leanback apps with a few modifications
ya, is there anything we can do with this box now since most live tv apps doesnt work on it anymore
Do you know where I can grab the file for TVPAD1? I am not sure which model I have, is only written TVPAD on top and there is no 2S, Plus or anything else.
TvChina, a subsidiary pay TV app after TvPad 4 ceased operating on June 1st. TvPad, the parent company, together with its Blue TV etc, have gone bust due to lack of funds from global dwindling sales. Now that the box is useless, can someone upload a root file so we can wipe then reuse it for other purposes? Found a related message on Google but it's has been blocked. Thanks in advance. Wonder if someone can get hold of firmwares for UnBlock or evPad etc so we can tune this into other sites.
did anyone ever put a different android OS on this and got the IR blaster to work too??
3vilhomer said:
did anyone ever put a different android OS on this and got the IR blaster to work too??
Click to expand...
Click to collapse
They were able to upgrade to android lollipop here:
tvpad.ca/discussion/1993/tvpad4-upgrade-to-android-lollipop-5-1
The root file "s89_root_update.zip" link is not working anymore. Does anyone has a copy > please post it here.
Hello XDA,
Last few days I was trying to get my Moto E5 XT1944-2 rooted but I got stuck at the TWRP step because "twrp_james.img" touchscreen input doesn't work on the "Moto E5 XT1944-2".
Today I found a solution for my problem and was able to root my phone. The instruction should work for all Moto E5 models but I can not verify this.
Because I felt the other root tutorials were incomplete or had broken links to files needed for rooting I created yet another rooting tutorial for the Moto E5.
I wanted to share this knowledge because it took me way to much time to root this phone. (if the info was use full to you, say thanks).
Hardware needed:
Moto E5 XT1944-2 (Or other variant, But I haven't tested the other variants)
Micro USB OTG adapter (get it at Aliexpress, ebay for $0,40)
USB mouse
Micro USB cable
Windows PC (I'm Using windows 10)
USB flash drive or Micro Sd card
Software needed:
Twrp for the Moto E5 (not fully functional on the XT1944-2) https://forum.xda-developers.com/moto-e5/development/recovery-twrp-moto-e-5-play-james-t3796323
Magisk-Vxx.zip (I used V18.0 but the latest version should also work) https://github.com/topjohnwu/Magisk/releases
MagiskManager-vx.x.x.apk (I used V6.1.0 but the latest version should also work) https://github.com/topjohnwu/Magisk/releases
Adb + fastboot https://www.xda-developers.com/install-adb-windows-macos-linux/
[optional] Adaway, because I don't like ads (Click on "Download APK" do not install f-droid) https://f-droid.org/packages/org.adaway/
[optional] MiXplorer, because the build in filemager sucks https://labs.xda-developers.com/store/app/com.mixplorer
[optional] Youtube vanced, because youtube ads suck and background playing music is great (Download from within magisk manager on your phone)
Extract the ADB & fastboot zip downloaded
Inside this folder are command line controlled programs called "adb.exe" and "fastboot.exe"
Pic1
Configure the phone:
Remove phone password and bootpin: Setting->security->screenlock
Activate developer settings: Tap build number 7 time
Activate USB debugging
Enable OEM unlocking:
Unlock bootloaderFollow instructions from motorola website.
https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a
Check if drivers for adb and fastboot are installed and working correctly:
Open a cmd prompt or a powershell and go to the location of the "adb.exe" file on your PC.
Using the "cd" command [cd <filepath>] (Tip add quotes surround the file path when spaces are present in the path)
example: cd "C:\Users\KLIJN\Desktop\_MOTOe5_XT1944-2\platform-tools"
Pic2
Connect your phone to your pc.
While the phone is booted normally and "USB debugging" is activated on the phone. Type "adb devices" inside the command prompt (or power shell)
Pic3
You should see your device listed after running this command (your pc needs to be authorized on the phone when a popup is asking for this)
Reboot to the bootloader:
Type "adb reboot bootloader"
Pic4
Test fastboot:
Type "fastboot devices" (only works when the phone is booted inside the bootloader)
Your device should be listed if everything is working correctly
Pic5
Boot TWRP
Note this will not install TWRP, the original bootloader stays intact (Why should you flash a twrp image if it's not working 100%)
Copy "twrp_james.img" to the same directory as adb.exe & fastboot.exe
Type: "fastboot boot twrp_james.img
Now your phone will boot into "twrp_james.img"
Pic6
Connect a mouse to your phone
using a OTG adapter if twrp is not reponding to touch (I have this problem Moto E5 XT1944-2)
Select cancel when asked for decrypt password.
(somehow no password are working for me, I don't know why I changed the screen and boot pin multiple times, but twrp is unable to decrypt the data partition)
Pic7
TWRP:Swipe to allow modifications
pic8
Wipe data partition (Because decryption doesn't work), Note this will erase all user data:
Wipe->advanced wipe
Check the box before data:
Pic9
Optional check if data partition is mounted:
Go to mount and check if "data" is checked
Strongly recommended: Create a full backup of your phone
Select backup from the twrp home screen and select all partitions bigger as 0MB for the backup.
You will need a usb drive or a sdcard connected to your phone to store the backup. When making a backup make sure to select all patitions (System partition is important)
Store the backup on your pc or elsewhere.
Remove OTG adapter and connect phone to pc:
Check if device is detected using "adb devices"
Copy magisk files to phone for rooting the phone:
Connect your phone to your pc while its still booted inside twrp.
Type: adb push <sourcepath pc> <destinationpath phone>, to copy the magisk files to your phone.
Example "adb push "C:\Users\KLIJN\Desktop\_MOTOe5 XT1944-2\Magisk-v18.0.zip" /data/media/"
Make sure to change the path to your magisk file location on your pc
Pic10
Connect mouse to your phone so you can control twrp again:
Inside twrp select install and go to the <destinationpath phone> path you copied the magisk installer zip to.
Inside twrp select "Install" and go to the magisk file.
Pic11
After the installation Wipe dalvik cache.
Next select Reboot system. (reboot your phone to system)
While booting you will first see a black screen with the text "N/A" or "bad key" in the topleft corner. (this is an idication that the bootloader is unlocked)
Next you will see the message "Your phone is being encrypted" or something like that
When fully booted follow the setup instructions.
Install magisk manager:
Copy to phone and open apk on the phone and install
Or
Activate USB debugging again, and install using adb:
Type: adb install "C:\Users\KLIJN\Desktop\_MOTOe5 XT1944-2\MagiskManager-v6.1.0.apk"
Change path to your path, if the path contains spaces quotes need to be added around the path (As I did)
#Your phone is now rooted!!!
Optional block adds using adaway and youtube vanced;
Optional change irritating boot animation "hello moto" by downloading https://play.google.com/store/apps/details?id=com.jrummy.apps.boot.animations&hl=nl
Its also posible to disable just the boot animation sound. Go to setting->sound->advanced and disable power sounds.
PS: I don't know how to embed the attached images in the text.
Can anyone confirm that it works? It's an old phone but I don't want to risk it.
duszeks said:
Alguém pode confirmar se funciona? É um telefone antigo, mas não quero arriscar.
Click to expand...
Click to collapse
Yes it works. But it will depend on your device whether or not. Only you will have to test if you will. I can't guarantee if it will work for you, but if you don't test it you won't know.
Thread Closed Per OP Request
Don't work,
I give up
Thanks in advanced. All comments can help!
I have a tablet I can depure via USB and where I can root the tablet. But if I connect to the internet, the "registration and password" of university program enters and is saved (even after formatting it is stuck on this screen) blocking the tablet, I believe that after the internet loads, it installs this locking program ... What would be the name of this type of application? I'd like to know, how remove this app, to If connect in internet, we can block (and try install TWRP via internet with TWRP Management)...
C.Modica said:
Hello everyone !
I've been trying to resolve this issue for weeks. I have a tablet that I can't unlock (it's super hard, it's like Dark Souls of tablets). Well let's start.
He has a program that blocks asking for password and user (this a old from a university), where you request access via wireless or 2G/3G. without it you can't access it, so I believe I have to change his firmware instaled in, but I'm having a hard time to make it.
• Let's go to basic product information:
The chip is a RK3066 (same from TV BOX based on rockchip).
The model is YPY L1050 from POSITIVO (it's from Brazil).
- Software and Items
I have the drivers installed (correctly);
I have adb installed;
I have SD_Card;
I have acess from PC;
The tablet is unroot;
• Back to the items:
So, the good news is that I have the same tablet model, unlocked (with another type of ROM that I am unaware of). That works normally, without problems. Well, I saw a procedure that basically it is possible to extract this image from the good tablet, to the locked tablet. I did that, I ended up extracting a series of .img files from the unlocked tablet: boot, cache, kernel, system, etc... ok.
• Trying a extract from unlock same tablet:
I try transfer the copied files from "good unlock tablet" (extrated with AndroidTool), and put in (with the same tool) in the lock tablet... There is a problem, even before starting the operation, I have the error "Test Device Fail ", in the last is not possible to transfer files via USB (I can only do commands like" ResetDevice ", or export the images from the blocked tablet via AndroidTool... and yes I have the drivers instaled, commands like adb sideloader in the fastboot works).
• Trying a firmware found in internet:
Well, I tryed to download the firmware found on the internet corresponding to the device model, but unfortunately I have the same error as above. I download the .img firware original and using the RKBatchTool and have the same error (the operation don't start, give "Test Device Fail" in "Upgrade" and "Restore").
I believe that both operations do not accept transferring via USB.
PS: The tablet unlocked the command of "TestDevice" works fine.
• What I was thinking of doing:
1 - I think I need to take the all .img(s) files extracted from the unlocked device, put it in a single image (.img), put it in a SD_Card and in the "fastboot" take the option "update rkimage from external storage". But I don't know how to do this. (I try search for it);
2 - Somehow being able to do "apply update from external storage", maybe doing the same procedure above with an "update.img", but I also don't know how to do that (put all img. files together in the form of a one update.img).
3 - Have anothers options, like "apply update from ADB", the PC response this conection with tablet, (I can see the device with ''adb device'' cmds in sideload mode in PC). The problem is that I don't know how I'm going to send the .img file, if I send it inside a .zip (I even tried that, send all the .img files inside a .zip to see if it works. The tablet arrives to read the files but in the end the operation aborts). So my knowledge is lacking in this part.
4 - Another would be such a "ROM Dump." I'd like to do a "ROM dump" with an SD card, I even researched it on the internet but I didn't find this procedure to rockchip (only for Amlogic).
With SD Card:
There was a youtube that managed to unlock a tablet like that, but it was a previous model that I'd like to unlock (and different version of firmware, android etc). His method was to put a bootable sd_card, but he doesn't explain how he does it (he only gives the file done) and looking at the files internally, I just think they were converted to linux formats (system.tar.gz, userdata.tar.gz, some .sh .so files, and a bootenv.img, uImage etc) and with completely different names from .img... It is a pity that it is not for my Tablet model .
Well, that's it in the end, I need to change the firmware and I don't know how to do it.
PS: I tried other operations/methods as well, but I will not comment so that this post doesn't get big.
Thanks in advanced. All comments can help!
Click to expand...
Click to collapse
Instead of trying to package the .img files into one file, you should try flashing each .img individually via fastboot using commands with the following structure:
fastboot flash <name of partition> <name of partition.img>
The following commands are examples.
fastboot flash system system.img
fastboot flash boot boot.img
fastboot flash cache cache.img
fastboot flash kernel kernel.img
You will need to use a separate command for each individual .img.
Sent from my SM-S767VL using Tapatalk
Droidriven said:
Instead of trying to package the .img files into one file, you should try flashing each .img individually via fastboot using commands with the following structure:
fastboot flash <name of partition> <name of partition.img>
The following commands are examples.
fastboot flash system system.img
fastboot flash boot boot.img
fastboot flash cache cache.img
fastboot flash kernel kernel.img
You will need to use a separate command for each individual .img.
Sent from my SM-S767VL using Tapatalk
Click to expand...
Click to collapse
Hi, thanks for the reply. Well I can make it via adb sideload? I can't use the command "adb reboot fastboot". Because this command "adb reboot fastboot" only turns off the tablet don't restarting into fastboot/download mode (just turns off). But If I manually enter on the bootloader, I can access the adb sideload option, where the adb install on computer can detects the device via the "adb devices command" with sideload.
C.Modica said:
Hi, thanks for the reply. Well I can make it via adb sideload? I can't use the command "adb reboot fastboot". Because this command "adb reboot fastboot" only turns off the tablet don't restarting into fastboot/download mode (just turns off). But If I manually enter on the bootloader, I can access the adb sideload option, where the adb install on computer can detects the device via the "adb devices command" with sideload.
Click to expand...
Click to collapse
It isn't going to work via adb unless the device is rooted and then it won't be via adb sideload, it would be done by using dd commands to dd the .img files directly to their partitions.
Sent from my SM-S767VL using Tapatalk
I just found a solution. It requires some tinkering, though.
I had to use a machine running windows 7, because that's the only OS that the drivers worked.
Download the firmware for the Ypy L1050F here: https://www.stockrom.net/2018/07/l1050.html
It comes with the drivers, the ROM, and a tool called RKBatchtool 1.8
You'll have to decompress everything, open RKBatchtool and choose the firmware that is in the ROM folder (Not the DEMO one).
Now comes the tricky part: You gotta undo the 3 screws aroud the tablet, then pry it open with your fingers(remember to remove microSD and SIM first, to avoid breaking stuff!). I recommend startind by the side with the usb, hdmi and power ports to get some leverage. The back cover should pop right off. Then you have to locate the NAND chip in it. Should be a Micron one with 48 pins. The small circle at one of the corners of the chip represents pin 1. Plug your usb cable to the tablet. With the tablet TURNED OFF, use a SIM removal tool or very fine tip metallic screwdriver to short pins 17 and 18 on the NAND chip and plug the power jack into the tablet. RKBatchtool should show that a device was connected. You can release the screwdriver now and just click the "Upgrade" button in RKBatchtool. Now this is very important: DO NOT UNPLUG your tablet until everything is done. It'll tell you when it's done uploading the firmware and checking it. Enjoy your new usable tablet!
I scoured the internet and found this procedure being used for TV Boxes with the same RK3066 SoC. AFAIK, nobody else managed to do it so far, so spread the word.
You are awesome. Broke the internet! I will follow your procedures to try to unlock it. Many thanks again xmas for you.
[edit] don't work
So I had a pixel 6 pro and unfortunately my wife got mad and threw it against the wall a few times, causing the frame to bend and entire back glass to shatter. The front LCD didn't break, but glue came apart and it separated from the frame.
I had all my 2fa accounts on there, as well as very valuable data that I need to recover.
The phone still powers on, but there's nothing visible on the screen. A local repair shop advised we start by replacing the screen and then work on transferring everything out.
I have a replacement pixel 4a and want to be prepared for when my phone comes back online.
What's the best way to backup my 6 pro and restore on the 4a?
I need everything copied as a whole image, and restored on the 4a. I want to be able to boot up my 4a, open my authenticator app, and have all my accounts listed there.
Someone please tell me this is possible, and if so, please post instructions.
Thank you in advance.
I doubt 1:1 image cloning is possible because encryption is hardware-backed and therefore device-unique. it's not even possible to restore backup on origin device after factory reset since android apps can use keystore in TEE.
side note: you could connect HDMI multiport usb-c otg adapter to TV and mouse so you have access to phone at least
aIecxs said:
I doubt 1:1 image cloning is possible because encryption is hardware-backed and therefore device-unique. it's not even possible to restore backup on origin device after factory reset since android apps can use keystore in TEE.
side note: you could connect HDMI multiport usb-c otg adapter to TV and mouse so you have access to phone at least
Click to expand...
Click to collapse
The HDMI multiport didn't work. Nothing was displayed. I don't know if it's because my phone is badly damaged, or if the pixel 6 doesn't support HDMI out over USB C
I tried this one https://www.amazon.com/dp/B081VBSNRZ/ref=cm_sw_r_apan_i_5NF5RPBKZ97YW4KFW9AX
What are my other options?
the best option would be previously unlocked bootloader, so you can have full access. but you did not unlock bootloader so this is no option for you, because unlocking will factory reset device.
HDMI might require some setting or app installed on device. apps can installed remotely from PC google play with proper google play account. not sure how to start an app though, but guess app can autostart.
at least usb keyboard is working, you could try to navigate blind and enable usb-debugging, this would allow you to use scrcpy. maybe connect headphones or use talkback to get some kind of audio feedback.
of course both methods requires some information from another identical device and need to tested on fully functional pixel 6 pro before..
some (not) useful apps
https://forum.xda-developers.com/t/i-broke-my-screen-and-digitizer.4436261/#post-86791963
https://forum.xda-developers.com/t/broke-the-display-of-my-phone.4424413/#post-86676229
https://forum.xda-developers.com/t/...asily-manage-multiple-android-devices.2707556
Anyone else have suggestions?
AcuraKidd said:
Anyone else have suggestions?
Click to expand...
Click to collapse
This is not a full backup, but it might help you interactively recover some items without replacing the broken screen. Also, assuming this is something you're still looking to solve...
If you have adb debugging enabled, you can try to use https://github.com/Genymobile/scrcpy to interact with your phone over USB from a computer.
If you do not have adb debugging enabled, you can try to enable it via Recovery Mode. The steps to enable Recovery Mode below are from https://www.tenorshare.com/android/how-to-enable-usb-debugging-on-android-with-black-screen.html (I have not tried these steps).
Less:
To enable ADB without a screen:
1. Download the ADB toolkit for your computer and extract its contents to a folder.
ADB toolkit can be found at https://developer.android.com/studio/releases/platform-tools
ADB requires you have USB debugging enabled on your phone.
Since your phone has a black screen, reboot your phone into recovery mode to accomplish this.
Press the Volume Down and Power buttons at the same time to enter recovery mode.
2. Connect your phone to your computer, open a Command Prompt window in the ADB folder, and type the following command.
adb devices
3. You should see your device listed there.
Run the following commands one by one.
adb shell
mount data
mount system
4. Use the following command to pull the persist.sys.usb.config file from your phone to the PC.
adb pull /data/property/persist.sys.usb.config C:\Users\[your-username]\Desktop\
5. Access the persist.sys.usb.config file on your computer with a text editor and edit it to mtp,adb.
6. Run the following command to send the file back to your device.
adb push "C:\Users\[your-username]\Desktop/persist.sys.usb.config" /data/property
7. Download the build.prop file from your phone by using this command.
adb pull /system/build.prop C:\Users\[your-username]\Desktop\
8. Launch the build.prop file in a text editor like NotePad++ on your computer, and add the following code to it.
persist.service.adb.enable=1
persist.service.debuggable=1
persist.sys.usb.config=mtp,adb
9. Save the file and transfer the file back to your device using this command.
adb push "C:\Users\[your-username]\Desktop/build.prop" /system/
10. Reboot your device using the following command.
adb reboot
11. You are all set. Your phone will boot up with USB debugging enabled.