[GUIDE] Root NVIDIA SHIELD Experience Upgrade v7.2 with Magisk v18.0 - Shield Android TV General

(Note before you begin: If you have a SHIELD TV 2017, you will need a quality Male-to-Male USB Type A cable to connect your SHIELD TV to a PC. If you have a SHIELD TV 2015 or a SHIELD TV Pro, you may be able to just use a regular micro USB cable, because those two models have a micro USB port)
A. Download these files to your PC:
Download the Android SDK Platform-Tools
Download the Official NVIDIA SHIELD family Windows USB Drivers
Download the Magisk Manager APK (This is the latest version as of the time of writing)
Download the ***CORRECT*** NVIDIA SHIELD Experience Upgrade v7.2 Image for your model
(You will need to register for a Developer Account if you don't already have one. Flashing the wrong image will BRICK your device)
B. Setting up Android SDK Platform-Tools on your PC:
On your PC, extract the Android SDK Platform-Tools somewhere where you can find them
Add the platform-tools folder to PATH in the Windows System Environment Variables (Instructions HERE or HERE)
C. Installing the Official NVIDIA SHIELD family Windows USB Drivers on your PC:
On your SHIELD TV, enable developer options and debugging (Instructions HERE)
Using a Male-to-Male USB Type-A Cable, connect the USB port further away from the HDMI port on your SHIELD TV to your PC
On your PC, extract the Official NVIDIA SHIELD family Windows USB Drivers somewhere where you can find them
Open Device Manager and find the new device
Right-click it and select Update driver
Select "Browse my computer for driver software"
Input the path to the folder where you extracted the Official NVIDIA SHIELD family Windows USB Drivers earlier (make sure the "Include subfolders" option is checked)
Click Next and Install the Driver (if there is more than one option, select the one relating to ADB or Android Device Bridge)
Open a Command Prompt and type:
Code:
adb devices
On your SHIELD TV, a prompt will pop up asking you to allow ADB access from your computer. Check the box to remember your selection and then Grant Access
On your PC, the Command Prompt should show the serial number of your SHIELD TV
(You may have to run the 'adb devices' command again since it may have timed out the first time waiting on you to authorize the ADB connection on the SHIELD TV)
Boot the SHIELD TV into bootloader/fastboot mode by typing the command:
Code:
adb reboot bootloader
(Alternatively, you can enter bootloader/fastboot mode by following the instructions HERE)
On your PC, open the Device Manager again and find the new device (it will probably have an error with a yellow triangle)
Right-click it and select Update driver
Select "Browse my computer for driver software"
Input the path to the folder where you extracted the Official NVIDIA SHIELD family Windows USB Drivers earlier (make sure the "Include subfolders" option is checked)
Click Next and Install the Driver (if there is more than one option, select the one NOT relating to ADB or Android Device Bridge)
Open a Command Prompt and type:
Code:
fastboot devices
The Command Prompt should show the serial number of your SHIELD TV
D. Unlocking the bootloader on your SHIELD TV (CAUTION: THIS WILL WIPE YOUR DATA AND FACTORY RESET YOUR SHIELD TV)
Plug the NVIDIA SHIELD TV Game Controller or a USB Keyboard into the USB port closest to the HDMI port on your SHIELD TV
In bootloader/fastboot mode on your SHIELD TV, select "Unlock Bootloader", read the message and confirm
(Use the Y and X buttons to scroll UP and DOWN, and the A button to CONFIRM selection, if your button presses aren't doing anything you need to reboot the SHIELD TV into bootloader/fastboot mode with the Controller or Keyboard already plugged in)
On your PC, open a Command Prompt and reboot your SHIELD TV to the OS by typing:
Code:
fastboot reboot
This process only needs to be done once per device and you will not have to unlock the bootloader again for subsequent updates
(From now on while your bootloader is unlocked, your SHIELD TV will display a warning message when it first boots saying that the system cannot check for corruption. This is perfectly normal and the boot process will resume automatically after a few seconds. There is no need to relock your bootloader unless you are selling the device or something. NEVER lock the bootloader if you have anything other than 100% stock full RECOVERY Image installed. Never even try it.)
E. Installing Magisk Manager on your SHIELD TV and Patching your boot.img
On your PC, extract the NVIDIA SHIELD Experience Upgrade v7.2 Image that you downloaded to somewhere where you can find it
Find the boot.img file in the folder that you extracted it to
Open a Command Prompt and type:
Code:
adb push boot.img /storage/emulated/0/Download/
Install Magisk Manager by typing 'adb install [path-to-magiskmanagerapk]' example:
Code:
adb install C:\MagiskManager-v6.1.0.apk
On your SHIELD TV, open Magisk Manager [Settings > Device > Apps > Magisk Manager > Open]
(The Magisk Manager App Interface is not designed to be operated with an Android TV Remote so I suggest you install the NVIDIA SHIELD TV app on your phone. Once paired with your SHIELD TV, the app has an option to let you use a virtual mouse to navigate and interact with your SHIELD TV. Alternatively, you can plug a USB Mouse into the USB port closest to the HDMI port on your SHIELD TV)
If Magisk Manager automatically pops up and asks you if you would like to Install Magisk, select Cancel
Make sure the "Preserve AVB 2.0/dm-verity" option is checked, and then select "Install"
Select "Patch Boot Image File"
Using the Virtual Mouse on the NVIDIA SHIELD TV remote app on your phone, or a USB Mouse, navigate to the "Download" folder on your internal storage and select the boot.img file that you copied over then click Open
Magisk Manager will take a few moments to patch the boot.img (pay attention to the message in the console about the path to the patched_boot.img - It should be "/storage/emulated/0/Download/patched_boot.img"
On your PC, in the Command Prompt type:
Code:
adb pull /storage/emulated/0/Download/patched_boot.img
F. Installing Magisk rooted SHIELD Experience Upgrade v7.2 on your SHIELD TV:
On your PC, navigate to the folder where you extracted the NVIDIA SHIELD Experience Upgrade v7.2 Image
Find the boot.img and rename it to boot.img.bak
Rename the patched_boot.img to boot.img
Open a Command Prompt and type:
Code:
adb reboot bootloader
Once the SHIELD TV is in bootloader/fastboot mode, type:
Code:
flash-all.bat
(It will take a few minutes for the flashing process to finish and then the SHIELD TV will automatically reboot to the OS)
Optional Stuff and Additional Information:
Disable Auto-Upgrades by going to [Settings > Device > About > System upgrade > Auto-upgrade]
Enable Full OTA's instead of Partial/Differential by going to [Settings > Preferences > Developer options > Provide full system upgrades]
(It is the very last option at the bottom and this is very important when using a rooted device and modifications to the System partition are likely)
If you want to upgrade to a new OTA update with root without waiting on NVIDIA to post the Developer/Recovery images, the downloaded OTA file is in
Code:
/data/data/com.nvidia.ota/app_download
(You will need a root file explorer to be able to access this directory)
You can extract the boot.img from the OTA zip and patch it using the same method described in step E.5 through E.10
You can then install the OTA the normal way [Settings > Device > About > System upgrade > Check for upgrade]
(Make sure you have copied the OTA zip or extracted the boot.img to somewhere on your Internal Storage like "/storage/emulated/0/Download" BEFORE you install the OTA because the system will delete the file in "/data/data/com.nvidia.ota/app_download" when it installs the update and you will be unable to get it after that)
Copy the patched_boot.img that you made with Magisk to your PC
Reboot to bootloader/fastboot mode with:
Code:
adb reboot bootloader
Manually flash just the Magisk Patched boot:
Code:
fastboot flash boot patched_boot.img
Manually reboot back to the OS with:
Code:
fastboot reboot

Hey mate, just curious if you have full root access, eg, can you uninstall system apps or delete their folders in system/apps, only asking as I also thought I had gained full root access with patching the boot.img with Kantjers version of Magisk, but when I try to uninstall a system app or try and delete their respective folders, even though it appears in Magisk that I have full root access, when I try to uninstall or delete a system app folder, I actually don't have full root access.

whiteak said:
Hey mate, just curious if you have full root access, eg, can you uninstall system apps or delete their folders in system/apps, only asking as I also thought I had gained full root access with patching the boot.img with Kantjers version of Magisk, but when I try to uninstall a system app or try and delete their respective folders, even though it appears in Magisk that I have full root access, when I try to uninstall or delete a system app folder, I actually don't have full root access.
Click to expand...
Click to collapse
I don't modify the system partition if I can avoid it. I just disable System Apps if I want them gone; however, I am fully confident that I could delete anything in /system if I wanted to. Is /system mounted as +rw? Not all Root File Managers are created equal. I recommend Root Explorer. It is not the most modern and feature rich file manager, but when it comes to Root File Managers specifically, I haven't found any other that can compare.

Thanks for the reply, not a big deal, was just curious if you actually did have full root access as it appears I do as well until I actually need it to do something like delete a system app etc. I may try flashing your patched boot.img and see if I get the same results as my patched boot.img, may just come down to the fact that I'm using Kantjers version of Magisk etc, wouldn't think it would be any different, but never know I guess until I try. Thanks again.

whiteak said:
Thanks for the reply, not a big deal, was just curious if you actually did have full root access as it appears I do as well until I actually need it to do something like delete a system app etc. I may try flashing your patched boot.img and see if I get the same results as my patched boot.img, may just come down to the fact that I'm using Kantjers version of Magisk etc, wouldn't think it would be any different, but never know I guess until I try. Thanks again.
Click to expand...
Click to collapse
I would test it for you if I had a system.img for v7.2.1 that I could reflash real quick. I just don't feel like flashing v7.2.0 then updating to v7.2.1 again to restore an unmodified system partition.

ACiDxCHRiST said:
A. Download these files to your PC:
Download the Android SDK Platform-Tools HERE
Download the Official NVIDIA SHIELD family Windows USB Drivers HERE
Download Magisk Manager APK (Link to latest version at time of writing is HERE)
Download the ***CORRECT*** NVIDIA SHIELD Experience Upgrade v7.2 Image for your model HERE
(Flashing the wrong boot.img will BRICK your device You will need to register for a Developer Account if you don't already have one)
B. Setting up Android SDK Platform-Tools on your PC:
On your PC, extract the Android SDK Platform-Tools somewhere where you can find them
Add the platform-tools folder to PATH in the Windows System Environment Variables (Instructions HERE)
C. Installing the Official NVIDIA SHIELD family Windows USB Drivers on your PC:
On your SHIELD TV, enable developer options and debugging (Instructions HERE)
Using a Male Type-A to Male Type-A USB Cable, connect the USB port further away from the HDMI port on your SHIELD TV to your PC
On your PC, extract the Official NVIDIA SHIELD family Windows USB Drivers somewhere where you can find them
Open Device Manager and find the new device
Right-click it and select Update driver
Select "Browse my computer for driver software"
Input the path to the folder where you extracted the Official NVIDIA SHIELD family Windows USB Drivers earlier (make sure the "Include subfolders" option is checked)
Click Next and Install the Driver (if there is more than one option, select the one relating to ADB or Android Device Bridge)
Open a Command Prompt and type:
Code:
adb devices
On your SHIELD TV, a prompt will pop up asking you to allow ADB access from your computer. Check the box to remember your selection and then Grant Access
On your PC, the Command Prompt should show the serial number of your SHIELD TV
(You may have to run the 'adb devices' command again since it may have timed out the first time waiting on you to authorize the ADB connection on the SHIELD TV)
Boot the SHIELD TV into bootloader/fastboot mode by typing the command:
Code:
adb reboot bootloader
(Alternatively, you can enter bootloader/fastboot mode by following the instructions HERE)
On your PC, open the Device Manager again and find the new device (it will probably have an error with a yellow triangle)
Right-click it and select Update driver
Select "Browse my computer for driver software"
Input the path to the folder where you extracted the Official NVIDIA SHIELD family Windows USB Drivers earlier (make sure the "Include subfolders" option is checked)
Click Next and Install the Driver (if there is more than one option, select the one NOT relating to ADB or Android Device Bridge)
Open a Command Prompt and type:
Code:
fastboot devices
The Command Prompt should show the serial number of your SHIELD TV
D. Unlocking the bootloader on your SHIELD TV (WARNING: THIS WILL WIPE YOUR DATA AND FACTORY RESET YOUR SHIELD TV)
Plug the NVIDIA SHIELD TV Game Controller or a USB Keyboard into the USB port closest to the HDMI port on your SHIELD TV
In bootloader/fastboot mode on your SHIELD TV, select "Unlock Bootloader", read the message and confirm
(Use the Y and X buttons to scroll UP and DOWN, and the A button to confirm selection, if your button presses aren't doing anything you need to reboot the SHIELD TV into bootloader/fastboot mode with the Controller or Keyboard already plugged in)
On your PC, open a Command Prompt and reboot your SHIELD TV to the OS by typing:
Code:
fastboot reboot
E. Installing Magisk Manager on your SHIELD TV and Patching your boot.img
On your PC, extract the NVIDIA SHIELD Experience Upgrade v7.2 Image that you downloaded to somewhere where you can find it
Find the boot.img file in the folder that you extracted it to
Open a Command Prompt and type:
Code:
adb push boot.img /storage/emulated/0/Download/
Install Magisk Manager by typing 'adb install [path-to-Magisk-Manager-APK]' example:
Code:
adb install C:\MagiskManager-v6.1.0.apk
On your SHIELD TV, open Magisk Manager [Settings > Device > Apps > Magisk Manager > Open]
(The Magisk Manager App Interface is not designed to be operated with an Android TV Remote so I suggest you install the NVIDIA SHIELD TV app on your phone. Once paired with your SHIELD TV, the app has an option to let you use a virtual mouse to navigate and interact with apps on your SHIELD TV. Alternatively, you can plug in a USB Mouse into the USB port closest to the HDMI port on your SHIELD TV)
If Magisk Manager automatically pops up and asks you if you would like to Install Magisk, select Cancel
Make sure the "Preserve AVB 2.0/dm-verity" option is checked, and then select "Install"
Select "Patch Boot Image File"
Using the Virtual Mouse on the NVIDIA SHIELD TV remote app on your phone, or a USB Mouse, navigate to the "Download" folder on your internal storage and select the boot.img file that you copied over then click Open
Magisk Manager will take a few moments to patch the boot.img (pay attention to the message in the console about the path to the patched_boot.img - It should be "/storage/emulated/0/Download/patched_boot.img"
On your PC, in the Command Prompt type:
Code:
adb pull /storage/emulated/0/Download/patched_boot.img
F. Installing Magisk rooted SHIELD Experience Upgrade v7.2 on your SHIELD TV:
On your PC, navigate to the folder where you extracted the NVIDIA SHIELD Experience Upgrade v7.2 Image
Find the boot.img and rename it to boot.img.bak
Rename the patched_boot.img to boot.img
Open a Command Prompt and type:
Code:
adb reboot bootloader
Once the SHIELD TV is in bootloader/fastboot mode, type:
Code:
flash-all.bat
(It will take a few minutes for the flashing process to finish and then the SHIELD TV will automatically reboot to the OS)
Optional Stuff and Additional Information:
Disable Auto-Upgrades by going to [Settings > Device > About > System upgrade > Auto-upgrade]
Enable Full OTA's instead of Partial/Differential by going to [Settings > Preferences > Developer options > Provide full system upgrades]
(It is the very last option at the bottom and this is very important when using a rooted device and modifications to the System partition are likely)
If you want to upgrade to a new OTA update with root without waiting on NVIDIA to post the Developer/Recovery images, the downloaded OTA file is in
Code:
/data/data/com.nvidia.ota/app_download
(You will need a root file explorer to be able to access this directory)
You can extract the boot.img from the OTA zip and patch it using the same method described in step E.5 through E.10
You can then install the OTA the normal way [Settings > Device > About > System upgrade > Check for upgrade]
(Make sure you have copied the OTA zip or extracted the boot.img to somewhere on your Internal Storage like "/storage/emulated/0/Download" before you install the OTA because the system will delete the file in "/data/data/com.nvidia.ota/app_download" when it installs the update and you will be unable to get it after that)
Copy the patched_boot.img that you made with Magisk to your PC
Reboot to bootloader/fastboot mode with:
Code:
adb reboot bootloader
Manually flash just the Magisk Patched boot:
Code:
fastboot flash boot patched_boot.img
Manually reboot back to the OS with:
Code:
fastboot reboot
Click to expand...
Click to collapse
Thankyou ever so much for putting this together but after following exactly what you said in this guide this is what i get:
C:\Users\sconn\nv-recovery-image-shield-atv-7.2.0>flash-all.bat
Sending 'staging' (6436 KB) FAILED (Write to device failed in SendBuffer() (Unknown error))
Finished. Total time: 10.295s
Sending 'boot' (14115 KB) FAILED (Write to device failed (Invalid argument))
Finished. Total time: 15.641s
< waiting for any device >

sconnyuk said:
Thankyou ever so much for putting this together but after following exactly what you said in this guide this is what i get:
C:\Users\sconn\nv-recovery-image-shield-atv-7.2.0>flash-all.bat
Sending 'staging' (6436 KB) FAILED (Write to device failed in SendBuffer() (Unknown error))
Finished. Total time: 10.295s
Sending 'boot' (14115 KB) FAILED (Write to device failed (Invalid argument))
Finished. Total time: 15.641s
< waiting for any device >
Click to expand...
Click to collapse
Do you have a 2015 or a 2017 SHIELD TV? Assuming you didn't edit that directory name, it should be nv-recovery-image-shield-atv-2017-7.2.0
If you have a 2017 and did manage to flash that image without an error, it would have bricked your SHIELD TV.
Do you still have Minimal ADB installed? I kind of feel like your fastboot.exe is outdated. I feel like your Minimal ADB install is registered to PATH and whenever a command calls fastboot, it is running the outdated fastboot in your Minimal ADB install.

ACiDxCHRiST said:
Do you have a 2015 or a 2017 SHIELD TV? Assuming you didn't edit that directory name, it should be nv-recovery-image-shield-atv-2017-7.2.0
If you have a 2017 and did manage to flash that image without an error, it would have bricked your SHIELD TV.
Do you still have Minimal ADB installed? I kind of feel like your fastboot.exe is outdated. I feel like your Minimal ADB install is registered to PATH and whenever a command calls fastboot, it is running the outdated fastboot in your Minimal ADB install.
Click to expand...
Click to collapse
I have 2017 Shield TV 16gb, which is on stock 7.2.1
I am using platform tools you suggested previously.
im quite sure im downloading the correct version, yes i do rename certain folders when i extract (just like i did with platform-tools to platform tools etc.
Im wondering if because im using standard usb 2.0 a to a cable is problem ? , aswell as both my laptop and desktop computers are older usb 2.0 models?
Both cables i have are usb 2.0 a to a but never had problems using with other devices including amazon fire tv 2 4k box when i had to recover it. Also i can adb push/pull/install no problems.
I have tried selecting unlock bootloader again just to triple check its unloacked and it reports bootloader is already un locked.
Im running out of ideas to be honest, quite the nightmare im having.

sconnyuk said:
I have 2017 Shield TV 16gb, which is on stock 7.2.1
I am using platform tools you suggested previously.
im quite sure im downloading the correct version, yes i do rename certain folders when i extract (just like i did with platform-tools to platform tools etc.
Im wondering if because im using standard usb 2.0 a to a cable is problem ? , aswell as both my laptop and desktop computers are older usb 2.0 models?
Both cables i have are usb 2.0 a to a but never had problems using with other devices including amazon fire tv 2 4k box when i had to recover it.
I have tried selecting unlock bootloader again just to triple check its unloacked and it reports bootloader is already un locked.
Im running out of ideas to be honest, quite the nightmare im having.
Click to expand...
Click to collapse
I don't see USB 2.0 being an issue. You could try locking then unlocking your bootloader again.
Also try running with an elevated Command Prompt with admin rights.

ACiDxCHRiST said:
I don't see USB 2.0 being an issue. You could try locking then unlocking your bootloader again.
Also try running with an elevated Command Prompt with admin rights.
Click to expand...
Click to collapse
Yes i always use admin rights with CMD.
I will try re locking and unlocking again later today. (i cant see how nobody else has had issues like mine)
Thanks, il report back.
---------- Post added at 09:00 AM ---------- Previous post was at 08:36 AM ----------
Just tried re locking my bootloader then unlocking again and get same output:
Just for your info the download im using is 'nv-recovery-image-shield-atv-2017-7.2.0.zip' like i said i had a few downloaded alreadyh so just renamed it.
C:\Users\sconn\nv-recovery-image-shield-atv-7.2.0>flash-all.bat
Sending 'staging' (6436 KB) FAILED (Write to device failed in SendBuffer() (Unknown error))
Finished. Total time: 6.297s
Sending 'boot' (14115 KB) FAILED (Write to device failed (Invalid argument))
Finished. Total time: 15.853s
< waiting for any device >

sconnyuk said:
Just tried re locking my bootloader then unlocking again and get same output:
Just for your info the download im using is 'nv-recovery-image-shield-atv-2017-7.2.0.zip' like i said i had a few downloaded alreadyh so just renamed it.
C:\Users\sconn\nv-recovery-image-shield-atv-7.2.0>flash-all.bat
Sending 'staging' (6436 KB) FAILED (Write to device failed in SendBuffer() (Unknown error))
Finished. Total time: 6.297s
Sending 'boot' (14115 KB) FAILED (Write to device failed (Invalid argument))
Finished. Total time: 15.853s
< waiting for any device >
Click to expand...
Click to collapse
I googled your error and I found a post that said changing cables fixed the problem. So that is at least one piece of information that points towards your hardware setup being the issue. I don't know what else to tell you.

ACiDxCHRiST said:
I googled your error and I found a post that said changing cables fixed the problem. So that is at least one piece of information that points towards your hardware setup being the issue. I don't know what else to tell you.
Click to expand...
Click to collapse
Yes even though I've got 2 here I'm going to try another, now if my local computer shop is open today I'll grab one to try.
As soon as I get a cable I'll report back and let you know, at the very least this might help someone with any issues that turn out to be similar to mine.
I was even thinking of trying to get twrp on or even boot to it to flash the boot.img but it's a no go on 7.2.1 and more so it's a no go because nothing will flash through fastboot for me at the moment.
I'll be in touch. ?

sconnyuk said:
Yes even though I've got 2 here I'm going to try another, now if my local computer shop is open today I'll grab one to try.
As soon as I get a cable I'll report back and let you know, at the very least this might help someone with any issues that turn out to be similar to mine.
I was even thinking of trying to get twrp on or even boot to it to flash the boot.img but it's a no go on 7.2.1 and more so it's a no go because nothing will flash through fastboot for me at the moment.
I'll be in touch.
Click to expand...
Click to collapse
Here is the cable that I use: https://www.amazon.com/Cable-Matters-2-Pack-Male-Black/dp/B00HSS9IDW

Finally, i decided to butcher 2 good thick usb cables and bodge a new a to a cable together and it flashed first time
Thanks for all your help.
Cannot understand how i have had issues with 2 different cables but now we know this device must be picky.

sconnyuk said:
Finally, i decided to butcher 2 good thick usb cables and bodge a new a to a cable together and it flashed first time
Thanks for all your help.
Cannot understand how i have had issues with 2 different cables but now we know this device must be picky.
Click to expand...
Click to collapse
Awesome

ACiDxCHRiST said:
Awesome
Click to expand...
Click to collapse
So from a virgin 7.2.1 we can after all flash a modded boot ??.
Just have to wait for a TWRP that is working on 7.2.1 now.
Thanks again for your help, I'd probably of given up after all that untill you mentioned the lead.
I did have a sneaky feeling myself but wasn't gunna try a new one till after Christmas.

sconnyuk said:
So from a virgin 7.2.1 we can after all flash a modded boot .
Just have to wait for a TWRP that is working on 7.2.1 now.
Thanks again for your help, I'd probably of given up after all that untill you mentioned the lead.
I did have a sneaky feeling myself but wasn't gunna try a new one till after Christmas.
Click to expand...
Click to collapse
What do you need TWRP for?

Thank you ACiDxCHRiST, for creating a new guide. It takes a considerable amount of time to first find a solution that is repeatable, document everything, test it, etc... :good: well done.
I have a question for you if I may. I've been trying to understand what Magisk actually patches. I've read through their web site and other than rooting it doesn't go into to many details about what else it patches or modifies. Do you have any additional information about this?
Once you've installed the patched_boot.img, and you first boot your Nvidia Shield TV are you required to first connect to the internet, then sign-in to Google Play and assuming the existing Nvidia Experience software is not already updated to the latest release, does it begin to download the and force you to install the latest update?

ACiDxCHRiST said:
What do you need TWRP for?
Click to expand...
Click to collapse
Just for backups, I'd like to get my system all setup exactly like I want it and then create a backup.
Also if any magisk/xposed modules make my box not boot to restore also ??

nadia p. said:
Thank you ACiDxCHRiST, for creating a new guide. It takes a considerable amount of time to first find a solution that is repeatable, document everything, test it, etc... :good: well done.
I have a question for you if I may. I've been trying to understand what Magisk actually patches. I've read through their web site and other than rooting it doesn't go into to many details about what else it patches or modifies. Do you have any additional information about this?
Once you've installed the patched_boot.img, and you first boot your Nvidia Shield TV are you required to first connect to the internet, then sign-in to Google Play and assuming the existing Nvidia Experience software is not already updated to the latest release, does it begin to download the and force you to install the latest update?
Click to expand...
Click to collapse
The SHIELD TV will only force you to update when you are going through the Initial Setup after a data wipe. If you follow the guide exactly as written and your bootloader is not unlocked yet, you will be forced to update to v7.2.1 after unlocking the bootloader. But since there aren't any more data wipes and the last step is to flash the v7.2.0 image that we modified, you will end up on v7.2.0 without being forced to do the Initial Setup again. In fact, you could likely use the same steps in the guide to install other versions.
As for what Magisk patches, it modifies the bootloader to trick the OS into thinking that the SU binary is in the system partition without actually modifying the system partition.
sconnyuk said:
Just for backups, I'd like to get my system all setup exactly like I want it and then create a backup.
Also if any magisk/xposed modules make my box not boot to restore also
Click to expand...
Click to collapse
Roger that, makes sense.

Related

[GUIDE] Revert, rollback, or downgrade Nvidia Shield TV Experience Upgrade +DATA LOSS

NOTICE: Several users have reported issues downgrading from v7.2.x, so it might require some additional experimentation to downgrade from that version.
-
Missing your screenshot or twitch streaming functionality? Hate the new launcher layout w/ its tiny one row of icons and its numerous rows of psychologically-aggressive suggestion imposition?
Well, now you can stop cursing at Nvidia, because they provided a way (albiet, a highly technical and mostly-undocumented way), to load any version of their OS that you choose.
I've seen others wanting to downgrade (including myself), so I've collected the relevant steps which I used to successfully revert to an earlier version. This guide assumes a bit of technical working knowledge, so I apologize if you are one of the 'normal' people that Nvidia has bulldozed over...
All the usual "don't blame me for bricked devices" caveats apply.... please be careful, know what each step does! research each step!
Best of luck...
0 - prereqs
make sure your PC & nvidia shield are both plugged into a UPS, b/c a power failure during a flashing operation is not very pleasant.
make sure you have (or do get) the adb & fastboot binaries ("commands") for your computer
make sure that you get all your userdata off the device, because it will be erased by this process
1 - using a web browser
register for an nvidia developer account (which you will have an opportunity to do if you attempt the next step)
download the 6.3 'developer os' rom for your particular model
https: //developer.nvidia.com/shield-developer-os-images (sorry, noob filter won't allow the real/clickable url)​
NB: The 6.3 developer rom for the 2017 console is missing the userdata.img, there are currently no reports (on this thread) if a different userimage (pre-6.3 or for the 2015 version) works on the 2017 console (testers welcome!).
NB: if the cost of being identified as a developer offends you (i.e. yielding a name, company, email, etc), then you can probably dig up a link to the roms in the comments or elsewhere on the xda forums.
2 - on the device
enable developer mode by clicking the 'build' entry in settings->info
enable usb debugging in settings->developer-options
plug it into your computer using the usb port furthest from the hdmi port
3 - in a terminal
unzip the downloaded rom & cd into the resulting directory
edit the 'flash-all.sh' script to add the following line just before the final reboot:
fastboot flash userdata userdata.img​
#(this will add even more wall-time to the flashing process, but will clobber the already-erased newer 7.0 user partition data with the old)
adb reboot bootloader
fastboot oem unlock && ./flash-all.sh
NB: Now confirm your willingness to lose all your data. On the 2015 'pro' version of the console, this is accomplished by pressing (or holding) the nvidia logo 'button'... AND WILL TAKE NEARLY TWO HOURS. Others use the x/y/a/b buttons on the game controller connected to the usb port nearest to the hdmi port.
[... time passes ...]
NB: the 7.0 to 6.3 was a clean backstep for me, but if you are going between other versions, I can see that this script might stall in the middle if the device does not come back up with adb services available... in which case you will need to enter fastboot manually using a hardware method.
4 - Break TegraOTA
You have now flushed the correct version onto your device, but we can't complete the setup process... if you were to try, the final step would immediately and automatically start downloading & applying the latest (7.0) experience update! Therefore, we must neuter the updater itself.
Still in the terminal:
adb root
adb remount
adb shell
# now these commands are run in the adb shell (technically on the phone through the PC terminal)
# the first path was the right one for me, but I'm putting here all the paths known to me in case you are using a different version
rm -rf /system/priv-app/TegraOTA
rm -rf /system/app/TegraOTA
rm -rf /system/app/TegraOTA.apk
sync
reboot
5 - you should now be able to setup and pain-stakingly reconfigure your nvidia shield to the way it was before you blindly trusted an OEM update without doing extensive research beforehand.
PS: if you fear that netflix or amazon-video will at some point stop working because of this process, you might wish to "fastboot oem lock" the device (knowing that an unlock will erase your user-data, but having the developer rom means you can always get root access via adb).
I hope you find this useful.
Thanks! I will be trying this tonight! I miss 6.3 and PLEX is BROKEN in 7.0!
Any idea if this can be done without needing a controller? My buddy has a shield TV but bought it used without a controller.
rossbeck said:
Thanks! I will be trying this tonight! I miss 6.3 and PLEX is BROKEN in 7.0!
Any idea if this can be done without needing a controller? My buddy has a shield TV but bought it used without a controller.
Click to expand...
Click to collapse
Plex is NOT broken in 7.0 i use it everyday.
Builtfordtough1 said:
Plex is NOT broken in 7.0 i use it everyday.
Click to expand...
Click to collapse
I use it every day too... and since Plex v6.13, files fail to play after 3 seconds unless you run them a 2nd time.
It's a known issue that everyone is having due an acknowledged bug in exoplayer2 with certain containers like mkv. Since 7.0/oreo has plex v6.14 baked in as a system app, it's impossible to downgrade to v6.12 to get rid of the issue until Plex fixes it... and they've known about it for 2 months now. Since quantity has been their focus over quality lately, I'm not holding my breath for a fix.
The solution is to downgrade to 6.3, manually install plex v6.12, and turn off app updates.... so that's my plan.
rossbeck said:
Any idea if this can be done without needing a controller? My buddy has a shield TV but bought it used without a controller.
Click to expand...
Click to collapse
I think it depends on the model. AFAIK, the newer 2017 ones need a controller (or possibly a USB keyboard) to confirm the userdata partition wipe.
Osndok said:
I think it depends on the model. AFAIK, the newer 2017 ones need a controller (or possibly a USB keyboard) to confirm the userdata partition wipe.
Click to expand...
Click to collapse
Ahhh, good call. I'll have him try a usb keyboard.
doesnt work for me... i have a nvidia shield tv 2015. i tried with flash-all.bat
and im stuck after reboot. is there any other way?
crazyscow said:
doesnt work for me... i have a nvidia shield tv 2015. i tried with flash-all.bat
and im stuck after reboot. is there any other way?
Click to expand...
Click to collapse
What command did the script stop at? and how 'stuck' are you (i.e. can you get to fastboot?).
I imagine that if you started with the wrong rom, it would likely fail to boot.
thanks for the fast reply, i just manually installed it without the bat file
I went manually into the fastboot mode by unplugging the power pressing the power button and plugging it back in until fastboot mode comes.
then i typed
fastboot flash staging blob
fastboot flash boot boot.img
wait until the sound on windows comes then - adb devices
adb reboot bootloader
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot reboot
and then it booted
crazyscow said:
thanks for the fast reply, i just manually installed it without the bat file
I went manually into the fastboot mode by unplugging the power pressing the power button and plugging it back in until fastboot mode comes.
then i typed
fastboot flash staging blob
fastboot flash boot boot.img
wait until the sound on windows comes then - adb devices
adb reboot bootloader
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot reboot
and then it booted
Click to expand...
Click to collapse
How did you get past the forced update? I was able to flash 6.3, but it forces the update during setup and I don't have ADB access yet because usb debugging isn't turned on. Can't disable the OTA updates without it!
Basically I've successfully flashed 6.3 and am sitting at a working fastboot prompt. Not sure what to do from here.
rossbeck said:
How did you get past the forced update? I was able to flash 6.3, but it forces the update during setup and I don't have ADB access yet because usb debugging isn't turned on. Can't disable the OTA updates without it!
Basically I've successfully flashed 6.3 and am sitting at a working fastboot prompt. Not sure what to do from here.
Click to expand...
Click to collapse
Disabling the OTA update is step four, if ADB does not work, I would guess that you forgot to flash userdata.img in the previous step(s).
Osndok said:
Disabling the OTA update is step four, if ADB does not work, I would guess that you forgot to flash userdata.img in the previous step(s).
Click to expand...
Click to collapse
So you did what to get userdata.img? Created it in TWRP or something? It's not included with the recovery images... and this basically bypasses the OOBE/setup stuff?
Thanks man
rossbeck said:
you did what to get userdata.img? ... It's not included with the recovery images... and this basically bypasses the OOBE/setup stuff?
Click to expand...
Click to collapse
userdata.img is inside the ZIP from the nvidia developer website, as can be seen here:
Code:
$ jar tf nv-recovery-image-shield-atv-pro-6.3.0-dev_rooted.zip | grep user
nv-recovery-image-shield-atv-pro-6.3.0-dev_rooted/userdata.img
rossbeck said:
[the userdata.img] basically bypasses the OOBE/setup stuff?
Click to expand...
Click to collapse
No... not really. The userdata.img from the developer pack both (1) matches the 6.3 version (doesn't have any of the newer, potentially incompatible entries), and (2) has developer-mode & adb enabled by default.
So in addition to it probably just working better, flashing the userdata will let you get adb access, and thus break the OTA, and thus complete the setup w/o the update.
I thought it would boot up, but im still stuck on the android loading screen!
Ill try to reflash the rom again tonight.
update:
I got it to work now, without update having to update to 7.0.2
Code:
adb reboot bootloader
fastboot flash staging blob
fastboot flash boot boot.img
fastboot reboot
//waiting for nvidia logo and the Windows PC to make the connection noise
//otherwise you can check by typing
adb devices
// if it shows something then continue
adb reboot bootloader
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot flash userdata userdata.img
fastboot reboot
once it booted it up, i went thru the procedure of setting it up with my network and google account, then the window pop-up "downloading version 7.0.2" then i followed the guide in the first post
Code:
adb root
adb remount
adb shell
# now these commands are run in the adb shell (technically on the phone through the PC terminal)
# the first path was the right one for me, but I'm putting here all the paths known to me in case you are using a different version
rm -rf /system/priv-app/TegraOTA
rm -rf /system/app/TegraOTA
rm -rf /system/app/TegraOTA.apk
sync
reboot
after that it booted up into android 7 with not OTA update notification.
thank you!
hello, thanks for the contribution, but when decompressing the image of developer 6.3 of shield tv 2017 I do not know where to get the file userdata.img, could you give me where to get it?
lohengrim93 said:
when decompressing the image of developer 6.3 of shield tv 2017 I do not know where to get the file userdata.img, could you give me where to get it?
Click to expand...
Click to collapse
As I said in #13, I found the userdata.img inside the archive from nvidia (the 2015 "pro" version to be exact), and I don't know why it is missing from (at least) the 6.3 archive for the 2017 device.
If you are feeling adventurous, you can try downloading either of the 2015 zips, and use its userdata.img... maybe the 16gb one?
I would be eager to know if that works for you, since I'm unsure if the userdata.img can be mixed between different versions of the console...
JUST BE VARY CAREFUL to not mix up your directories and start flashing the wrong blobs & boots... that would be a recipe for a brickin', methinks.
crazyscow said:
I got it to work now, without ... having to update to 7.0.2
... i followed the guide in the first post...
after that it booted up into android 7 [without] OTA update notification.
thank you!
Click to expand...
Click to collapse
I'm quite pleased to hear that it worked for you... (my first success report!).
Adb root
When I attempt to run the adb root command it just errors on me at the end, do I need to have the shield booted into setup for it to work?
Insatiablejimmy said:
When I attempt to run the adb root command it just errors on me at the end, do I need to have the shield booted into setup for it to work?
Click to expand...
Click to collapse
You forgot to include (or even describe) the actual error message, so I can only guess as to what is wrong.
However, since "adb root" is the linchpin of the developer rom, I would assume that you did not flash a developer rom (or as indicated above concerning the 2017 model) are missing the "userdata.img", which could also cause this behavior.

ADB no longer working

I have the latest Google driver on Windows 10 Pro. I have the latest 29.0.6 platform tools. I open a cmd prompt with admin privileges in platform tools and run "adb devices" and I get an error that I have attached. I have uninstalled and reinstalled Google driver to no avail. I have downloaded the platform tools again to make sure it was not corrupt, that didn't help. Afer I connect to the phone with usb debugging turned on it does not ask me if I want to trust the fingerprint of the computer. Can anyone give me some help? Thank you.
first attempt
Holysmoke99 said:
I have the latest Google driver on Windows 10 Pro. I have the latest 29.0.6 platform tools. I open a cmd prompt with admin privileges in platform tools and run "adb devices" and I get an error that I have attached. I have uninstalled and reinstalled Google driver to no avail. I have downloaded the platform tools again to make sure it was not corrupt, that didn't help. Afer I connect to the phone with usb debugging turned on it does not ask me if I want to trust the fingerprint of the computer. Can anyone give me some help? Thank you.
Click to expand...
Click to collapse
Download the latest:
https://developer.android.com/studio/releases/platform-tools
Unzip in a dir.
Copy following files to test dir:
adb.exe
AdbWinApi.dll
AdbWinUsbApi.dll
fastboot.exe
Create one .bat file in the same 'test' dir:
adbreboot.bat:
@Echo off
set PATH=%CD%;%PATH%;
adb reboot
save it .... connect your device ... and run it (if necessary with admin privileges)
Good luck
Thanks for the advice but nothing happened.
I attached the folder contents. That is correct?
second attempt
Holysmoke99 said:
Thanks for the advice but nothing happened.
I attached the folder contents. That is correct?
Click to expand...
Click to collapse
Download and extract:
https://www.uwe-sieber.de/files/devicecleanupcmd.zip
On a windows X64 machine:
copy DeviceCleanupCmd.exe from extracted x64 folder to your previous test folder (with adb.exe, AdbWinApi.dll, etc...)
set the properties of DeviceCleanupCmd.exe for all users to run as administrator
create 2 .bat files:
DeviceCleanupCmdLoad.bat:
@Echo off
set PATH=%CD%;%PATH%;
DeviceCleanupCmd.exe * -t
PAUSE
DeviceCleanupCmdRemove.bat:
@Echo off
set PATH=%CD%;%PATH%;
DeviceCleanupCmd.exe * -s
PAUSE
Run the 2 . bat files (don't connect your device yet !)
Follow the instructions on the messages: ex: 'press any key to close': press any key, etc...
After that:
1. connect your device and run adbreboot.bat... see what happens
2. if no luck, run DeviceCleanupCmdLoad.bat and DeviceCleanupCmdRemove.bat again : REBOOT your windows, connect your device and run adbreboot.bat... see what happens
Good luck
It still did not work. Thanks again.
third attempt
Holysmoke99 said:
It still did not work. Thanks again.
Click to expand...
Click to collapse
- Disconnect USB between PC and device
- On device use "Revoke USB debugging authorizations" in "Developer Options"
- Reboot device
- Reconnect the device to the PC
- You should see now: the fingerprint of the computer ... allow it!
- run adbreboot.bat... see what happens
Thanks again, I have tried to revoke authorizations all day to no avail. I tried all the steps above and added revoking but it still won't give me option to trust fingerprint.
Holysmoke99 said:
Thanks again, I have tried to revoke authorizations all day to no avail. I tried all the steps above and added revoking but it still won't give me option to trust fingerprint.
Click to expand...
Click to collapse
last attempt
fully uninstall magisk (root)
update to the latest OTA firmware of google....
revoke the authorizations again
I had altered boot.img to obtain root. This morning the phone was running very slow so I did a factory reset. I updated to the latest OTA. Is magisk still on the phone?
After installing 15 seconds ADB Installer v1.4.3 your batch file worked and brought up the prompt to accept fingerprint!!!!!!!!! Thanks so much for taking the time to help me!
Holysmoke99 said:
I had altered boot.img to obtain root. This morning the phone was running very slow so I did a factory reset. I updated to the latest OTA. Is magisk still on the phone?
Click to expand...
Click to collapse
I always complete remove magisk before installing the latest OTA ... just in case
biontx said:
I always complete remove magisk before installing the latest OTA ... just in case
Click to expand...
Click to collapse
do you have to alter boot.img each time you install OTA to keep root?
Holysmoke99 said:
do you have to alter boot.img each time you install OTA to keep root?
Click to expand...
Click to collapse
Each time before I install an OTA I remove root and magisk
Download the latest factory image for you device:
https://developers.google.com/android/images#bonito
Unzip it and copy boot.img to a dir on your device
Reinstall magisk apk with the permissions (my favorite: Magisk v20.4: MagiskManager-v7.5.1.apk)
https://github.com/topjohnwu/Magisk
Patch your boot.img with MagiskManager-v7.5.1.apk
Copy your magisk patched . img to your computer to a dir with: adb.exe; AdbWinApi.dll;AdbWinUsbApi.dll;fastboot.exe
Create 2 .bat files:
0001fastbootmagicpatched.bat:
@Echo off
set PATH=%CD%;%PATH%;
fastboot boot <FullPathTo your magisk patched img file>\magiskpatched.img
example:
fastboot boot D:\PROJECTS\NOUGAT\PIXEL3A\magisk\20200405Stable\magiskpatchedboot\magiskpatched.img
0002fastbootflashbootmagicpatched.bat:
@Echo off
set PATH=%CD%;%PATH%;
fastboot flash boot <FullPathTo your magisk patched img file>\magiskpatched.img
example:
fastboot flash boot D:\PROJECTS\NOUGAT\PIXEL3A\magisk\20200405Stable\magiskpatchedboot\magiskpatched.img
Put your device into bootloader.
Connect your device and run 0001fastbootmagicpatched.bat
Disconnect your device.
After a full start of your device, don't start any other app... put your device into bootloader again.
Connect your device and run 0002fastbootflashbootmagicpatched.bat
After de cmd window ends on your computer, press start on your device
Once fully started, all should be well on your device.
Start magisk app and adapt to your needs
System Power app
@Holysmoke99
System Power app (see attachment): could you test this app please:
Preview: see pictures in attachment.
Made for android 10 or higher.
Root is needed.
Contains a tile to be added in your quick settings: makes it more easy to take a screenshot.
Contains the following functions:
- Power off
- Restart
- Recovery
- Bootloader
- Torch (toggle torch: added v 3.1 b 30013)
- Screenshot
- Screen off
Any comments appreciated

[Guide] nVidia Shield Android TV experience upgrade 9.0.0 workarounds

I just wanted to gather resources and guidance on workarounds for caveats found in:
nVidia Shield Experience Upgrade 9.0.0 with Android 11
Scoped storage for instance.
New Google TV launcher
Caution: I'm not responsible if you end up bricking your nVidia Shield Android TV.​
Change default launcher​Launcher alternatives​FLauncher​
https://play.google.com/store/apps/details?id=me.efesser.flauncher
https://gitlab.com/etienn01/flauncher
Example: FLauncher​
Install FLauncher from Google Play store.
Open FLauncher to make sure it works.
Enable ADB over network on the nVidia Shield (developer options).
Connect ADB from a computer with android-tools.
Disable default launcher with following ADB command:
Code:
adb shell pm disable-user --user 0 com.google.android.tvlauncher
Disconnect ADB.
Press "Home" button on the nVidia Shield. This should open FLauncher.
Instructions​
https://techmogulchannel.com/tutori...lt-launcher-to-custom-launcher-windows-guide/
https://www.reddit.com/r/AndroidTV/comments/o96tun/how_to_install_a_3rdparty_launcher_as_default_on/
Set scoped storage permissions​Example: Solid File Explorer​
Markdown (GitHub flavored):
### Example session with nVidia Shield Android TV
#### Start ADB server
adb start-server
#### Connect (approve request on the Shield)
adb connect 192.168.86.36:5555
#### Solid Explorer
adb shell cmd appops get --uid pl.solidexplorer2
adb shell cmd appops set --uid pl.solidexplorer2 android:MANAGE_EXTERNAL_STORAGE allow
adb shell cmd appops set --uid pl.solidexplorer2 android:REQUEST_INSTALL_PACKAGES allow
#### Disconnect
adb disconnect
#### Turn off ADB server
adb kill-server
Instructions​
https://www.codetd.com/en/article/10481938
https://forum.xda-developers.com/t/...adb-on-note-10-updated-to-android-11.4221617/
https://developer.android.com/train...es#enable-manage-external-storage-for-testing
https://www.reddit.com/r/androiddev/comments/mscu80/as_a_user_is_it_possible_for_me_to_grant_an_old/
Roll back to 8.2.3​Download​
https://developer.nvidia.com/gameworksdownload#?search=recovery os image
Instructions​
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
https://docs.nvidia.com/gameworks/content/devices/shield_flashing_from_image.htm
https://forum.xda-developers.com/t/3321404/
https://forum.xda-developers.com/t/4392605/#post-86397133 by @perieanuo.
Other related guides by me​
Ready made Leanback Icons and Shortcuts for "regular" Android Apps
[Tool][Windows][PowerShell] Android Platform Tools Updater (ADB & Fastboot)
Thanks for this !
I just hate this google tv launcher update and those F****** ads.
Now it's clean, Flauncher looks great
Thank you for that awesome guide
I have one question regarding scoped storage permissions. I'm trying to achieve the same with Kodi like you did with Solid File Explorer.
The first command worked fine: adb shell cmd appops get --uid org.xbmc.kodi
I get the following output:
Uid mode: LEGACY_STORAGE: allow
TAKE_AUDIO_FOCUS: allow; time=+2d3h23m52s536ms ago
WAKE_LOCK: allow; time=+2d3h23m52s331ms ago; duration=+22m38s145ms
READ_EXTERNAL_STORAGE: allow; time=+14h44m6s853ms ago
WRITE_EXTERNAL_STORAGE: allow
Unfortunately, when I try to execute the 2nd command adb shell cmd appops set --uid org.xbmc.kodi android:MANAGE_EXTERNAL_STORAGE allow I get the following error:
Error: Unknown operation string: android:MANAGE_EXTERNAL_STORAGE
Is there anything that I'm missing or not possible with Kodi?
No_Reason said:
Thank you for that awesome guide
I have one question regarding scoped storage permissions. I'm trying to achieve the same with Kodi like you did with Solid File Explorer.
The first command worked fine: adb shell cmd appops get --uid org.xbmc.kodi
I get the following output:
Uid mode: LEGACY_STORAGE: allow
TAKE_AUDIO_FOCUS: allow; time=+2d3h23m52s536ms ago
WAKE_LOCK: allow; time=+2d3h23m52s331ms ago; duration=+22m38s145ms
READ_EXTERNAL_STORAGE: allow; time=+14h44m6s853ms ago
WRITE_EXTERNAL_STORAGE: allow
Unfortunately, when I try to execute the 2nd command adb shell cmd appops set --uid org.xbmc.kodi android:MANAGE_EXTERNAL_STORAGE allow I get the following error:
Error: Unknown operation string: android:MANAGE_EXTERNAL_STORAGE
Is there anything that I'm missing or not possible with Kodi?
Click to expand...
Click to collapse
Are you using the latest version of Android platform-tools? I also got some errors when following a guide, turned out the command syntax had changed a little with newer versions of adb.
https://developer.android.com/studio/releases/platform-tools#downloads
I just switched to the latest version of Android platform-tools.
adb version is giving me:
Android Debug Bridge version 1.0.41
Version 32.0.0-8006631
But I still get the same error message as mentioned above
Any idea, why it's still failing? Does the app itself need to support this?
hi,
i downgraded but the flashing is not really like described here
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
those 2 are incorrect:
- fastboot flash dtb mdarcy.dtb.img
- fastboot flash vbmeta vbmeta.img
in my case i did (the files were in "c:\adb\822" folder, i used official 8.2.2 recovery image, but tested the same for 8.2.3 and 8.2.0)
fastboot flash staging ./822/blob
fastboot flash boot ./822/boot.img
fastboot flash recovery ./822/recovery.img
fastboot flash system ./822/system.img
fastboot flash vendor ./822/vendor.img
fastboot flash dtb ./822/tegra210-darcy-p2894-0050-a08-00.dtb
(attention i choosed /tegra210-darcy-p2894-0050-a08-00.dtb because my shield was this version, to be checked before flashing in settings/about...)
I tried with and without dtb and with and without erasing user data from fastboot menu (the last option)
I guess mdarcy.dtb.img and vbmeta.img are from other recovery archives, my test was done 27 jan 2022, maybe nvidia modified those recovery archives?
anyway, for inexperienced users it should be more clear what to flash, in what order, why writing this and that, the tutos for this downgrade are a mess. someone on reddit says we should format all those partitions but he says it at the end of his post, so if you respect command orders and reboot shield you're screwed.
my 2 cts, you should write ALL partitions provided by nvidia in archive after unlocking bootloader (maybe formatting them before??? but with UPS attached, risky thing btw), reset shield, relock bootloader and maybe reset shield from bootloader menu or gui.
i hope a pro take this in hand explaining for us
in the process i managed to fry my 'away' usb port power (it works well as debug port but his power control chip is dead, tried already deactivating usd debug and usb file sharing and reflashing 3 times like i described before, but it's clearrly a hardware issue). well, this one it's on me, I had olimex usb separator with power supply conected and after reflash i set that away usb as normal port, mayhe the two devices (shield and olimex usb-iso isolator tried to power the +5V line at once and the nvidia one was the weaker one). normally nvidia should entered protected mode, but i'm not the hw designer on that one
Any you guys know how to force landscape android tv 9, whole apks I used to forces doesn't work, I have 2015 and 2017 models, please help.
No_Reason said:
I just switched to the latest version of Android platform-tools.
adb version is giving me:
Android Debug Bridge version 1.0.41
Version 32.0.0-8006631
But I still get the same error message as mentioned above
Any idea, why it's still failing? Does the app itself need to support this?
Click to expand...
Click to collapse
Hmm. I'm certainly no expert at this. But what you say about the app need to support it might make sense. With the get command on Solid Explorer, I saw that permission that I could set, but you can't.
baba702 said:
Any you guys know how to force landscape android tv 9, whole apks I used to forces doesn't work, I have 2015 and 2017 models, please help.
Click to expand...
Click to collapse
Tried hotfix 3?
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481434/shield-experience-upgrade-90-hotfix-image/
o-l-a-v said:
Tried hotfix 3?
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481434/shield-experience-upgrade-90-hotfix-image/
Click to expand...
Click to collapse
Thank you I didn't know about it I'll try
Ok just I installed hotfix 3 but I'm still have several issues, now button mapper doesn't work and the screen rotation doesn't work, any help
baba702 said:
Ok just I installed hotfix 3 but I'm still have several issues, now button mapper doesn't work and the screen rotation doesn't work, any help
Click to expand...
Click to collapse
If you use button remapper so change default launcher, use the method in the original post instead to just disable the default launcher app. Else, ask the button remapper developer I guess.
For the 2nd problem (orientation), I think there is a adb command to set it. Google it and see what you find.
Edit: Orientation, found some related info:
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481782/shield-experience-upgrade-90-known-issues/3206852/
I
o-l-a-v said:
If you use button remapper so change default launcher, use the method in the original post instead to just disable the default launcher app. Else, ask the button remapper developer I guess.
For the 2nd problem (orientation), I think there is a adb command to set it. Google it and see what you find.
Edit: Orientation, found some related info:
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481782/shield-experience-upgrade-90-known-issues/3206852/
Click to expand...
Click to collapse
I give whole the permite but doesn't work the buttons remapper, something with YouTube vanced is the problem, I unistalled and that works, rotation I tried with whole permite included the energy optimization access but no work
perieanuo said:
hi,
i downgraded but the flashing is not really like described here
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
those 2 are incorrect:
- fastboot flash dtb mdarcy.dtb.img
- fastboot flash vbmeta vbmeta.img
in my case i did (the files were in "c:\adb\822" folder, i used official 8.2.2 recovery image, but tested the same for 8.2.3 and 8.2.0)
fastboot flash staging ./822/blob
fastboot flash boot ./822/boot.img
fastboot flash recovery ./822/recovery.img
fastboot flash system ./822/system.img
fastboot flash vendor ./822/vendor.img
fastboot flash dtb ./822/tegra210-darcy-p2894-0050-a08-00.dtb
(attention i choosed /tegra210-darcy-p2894-0050-a08-00.dtb because my shield was this version, to be checked before flashing in settings/about...)
I tried with and without dtb and with and without erasing user data from fastboot menu (the last option)
I guess mdarcy.dtb.img and vbmeta.img are from other recovery archives, my test was done 27 jan 2022, maybe nvidia modified those recovery archives?
anyway, for inexperienced users it should be more clear what to flash, in what order, why writing this and that, the tutos for this downgrade are a mess. someone on reddit says we should format all those partitions but he says it at the end of his post, so if you respect command orders and reboot shield you're screwed.
my 2 cts, you should write ALL partitions provided by nvidia in archive after unlocking bootloader (maybe formatting them before??? but with UPS attached, risky thing btw), reset shield, relock bootloader and maybe reset shield from bootloader menu or gui.
i hope a pro take this in hand explaining for us
in the process i managed to fry my 'away' usb port power (it works well as debug port but his power control chip is dead, tried already deactivating usd debug and usb file sharing and reflashing 3 times like i described before, but it's clearrly a hardware issue). well, this one it's on me, I had olimex usb separator with power supply conected and after reflash i set that away usb as normal port, mayhe the two devices (shield and olimex usb-iso isolator tried to power the +5V line at once and the nvidia one was the weaker one). normally nvidia should entered protected mode, but i'm not the hw designer on that one
Click to expand...
Click to collapse
this is really good info - seriously. I'm about to downgrade to 8.2.3 on the 2017_16gb model and I'm trying to take it all in. Weird how there's not a ton of good information on this. Did you follow any other videos or guides?
Alekos said:
this is really good info - seriously. I'm about to downgrade to 8.2.3 on the 2017_16gb model and I'm trying to take it all in. Weird how there's not a ton of good information on this. Did you follow any other videos or guides?
Click to expand...
Click to collapse
hi,
i did kinda mixup of some guides like
https://www.reddit.com/r/ShieldAndroidTV/comments/s3yqe1
(also tested like he said, first fastboot erase boot/staging/recovery/system/vendor, then write those)
the procedure was as simpliy as this:
__________________________________________________________________________________________________________________
How to downgrade your Shield TV Pro back to 8.2.3 (Android 9)
The first step is to go to Settings, Device Preferences, About, tap build number 7-8 times for developer options and enable USB debugging and allow debugging through your PC. Before you reboot to the bootloader, plug in a keyboard or your Shield Controller to continue, then input adb reboot bootloader (must have drivers installed), unlock bootloader, and factory reset, reboot and unplug the USB and power for a full unlock or else you'll get "write failed" when flashing.
first, wipe partitions:
fastboot erase boot
fastboot erase staging
fastboot erase recovery
fastboot erase system
fastboot erase vendor
second, flash partitions (i saved/unzipped in c:\adb\823 the files, that's why "./823/" appears below)
fastboot flash boot ./823/boot.img
fastboot flash staging ./823/blob
fastboot flash recovery ./823/recovery.img
fastboot flash system ./823/system.img
fastboot flash vendor ./823/vendor.img
I relocked bootloader at the end
fastboot oem lock (or via bootloader GUI)
Just used a simple usb keyboard ( a french one, "A" was in the place of "Q" key) and bootloader use US layout as default for keyboard.
The USB cable must be a quality one, mine was USB3 one, 1m long.
Hey, so you guys don't recommend updating to Android 11 on the 2017 Shield TV?
I'm still running Android 9 (NVidia Experience 8.2.3) and everything works well. Will I gain anything by updating?
Ghisy said:
Hey, so you guys don't recommend updating to Android 11 on the 2017 Shield TV?
I'm still running Android 9 (NVidia Experience 8.2.3) and everything works well. Will I gain anything by updating?
Click to expand...
Click to collapse
I'd wait for next stable/ non-hotfix release, and then check feedback on Reddit and the nVidia forum before doing the jump.
But I won't bother rolling back to 8.2.3 either, 9.0.0 works OK for me. If you're hosting Plex server on your Shield, definitely wait. I only use it as a media player, nothing fancy.
o-l-a-v said:
I'd wait for next stable/ non-hotfix release, and then check feedback on Reddit and the nVidia forum before doing the jump.
But I won't bother rolling back to 8.2.3 either, 9.0.0 works OK for me. If you're hosting Plex server on your Shield, definitely wait. I only use it as a media player, nothing fancy.
Click to expand...
Click to collapse
Well, I guess 9.0.1 is the stable one apparently: https://9to5google.com/2022/02/15/shield-tv-9-0-1-update-android-11/
I need to wait for the developer image because I want to root my Shield TV again. Although there's no guide here that's up to date unfortunately...
baba702 said:
I
I give whole the permite but doesn't work the buttons remapper, something with YouTube vanced is the problem, I unistalled and that works, rotation I tried with whole permite included the energy optimization access but no work
Click to expand...
Click to collapse
For the screen orientation setting, have you tried something as simple as a "forced rotation" app? I've used that for apps that normally come up in portrait that i wanted to force into landscape mode (ie YouTube Vanced, Magisk Manager, etc).
Here's one that's worked for me in the past (side loaded):
https://m.apkpure.com/set-orientation/com.googlecode.eyesfree.setorientation
o-l-a-v said:
I just wanted to gather resources and guidance on workarounds for caveats found in:
nVidia Shield Experience Upgrade 9.0.0 with Android 11
Scoped storage for instance.
New Google TV launcher
Caution: I'm not responsible if you end up bricking your nVidia Shield Android TV.​
Change default launcher​Launcher alternatives​FLauncher​
https://play.google.com/store/apps/details?id=me.efesser.flauncher
https://gitlab.com/etienn01/flauncher
Example: FLauncher​
Install FLauncher from Google Play store.
Open FLauncher to make sure it works.
Enable ADB over network on the nVidia Shield (developer options).
Connect ADB from a computer with android-tools.
Disable default launcher with following ADB command:
Code:
adb shell pm disable-user --user 0 com.google.android.tvlauncher
Disconnect ADB.
Press "Home" button on the nVidia Shield. This should open FLauncher.
Instructions​
https://techmogulchannel.com/tutori...lt-launcher-to-custom-launcher-windows-guide/
https://www.reddit.com/r/AndroidTV/comments/o96tun/how_to_install_a_3rdparty_launcher_as_default_on/
Set scoped storage permissions​Example: Solid File Explorer​
Markdown (GitHub flavored):
### Example session with nVidia Shield Android TV
#### Start ADB server
adb start-server
#### Connect (approve request on the Shield)
adb connect 192.168.86.36:5555
#### Solid Explorer
adb shell cmd appops get --uid pl.solidexplorer2
adb shell cmd appops set --uid pl.solidexplorer2 android:MANAGE_EXTERNAL_STORAGE allow
adb shell cmd appops set --uid pl.solidexplorer2 android:REQUEST_INSTALL_PACKAGES allow
#### Disconnect
adb disconnect
#### Turn off ADB server
adb kill-server
Instructions​
https://www.codetd.com/en/article/10481938
https://forum.xda-developers.com/t/...adb-on-note-10-updated-to-android-11.4221617/
https://developer.android.com/train...es#enable-manage-external-storage-for-testing
https://www.reddit.com/r/androiddev/comments/mscu80/as_a_user_is_it_possible_for_me_to_grant_an_old/
Roll back to 8.2.3​Download​
https://developer.nvidia.com/gameworksdownload#?search=recovery os image
Instructions​
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
https://docs.nvidia.com/gameworks/content/devices/shield_flashing_from_image.htm
https://forum.xda-developers.com/t/3321404/
https://forum.xda-developers.com/t/4392605/#post-86397133 by @perieanuo.
Other related guides by me​
Ready made Leanback Icons and Shortcuts for "regular" Android Apps
[Tool][Windows][PowerShell] Android Platform Tools Updater (ADB & Fastboot)
Click to expand...
Click to collapse
Do you need to be rooted to Set Scoped Storage permissions or install an alternative launcher?
Is there a guide for rooting the Nvidia Shield 2017 using linux?
Thanks.
bdika

Easiest Way To Root Android 11 on Surface Duo

first off, huge shout out to @JengaMasterG for TWRP for these devices. Without him, this super simple method wouldn't be possible.
What You'll Need
- Android 11 most recent update
- TWRP: TWRP for Surface Duo (credits to @JengaMasterG )
- Unlocked Bootloader
- ADB/Fastboot: ADB/Fastboot Install (what i use)
- Magisk
video
YT Tutorial
Bootloader Unlock
1.) Enable Developer Options via tapping Build Number over and over in the About Device part of settings
2.) Enable USB Debugging and OEM Unlock
3.) Plug device into the computer, and type the following command in cmd.exe, hit enter
Code:
adb devices
4.) You may get a pop up on screen requesting permission, always allow it
5.) Type the following and hit enter
Code:
adb reboot bootloader
6.) Once in the bootloader, your device might not be recognized right away and will need the driver manually installed via Device manager (see video for that)
7.) Once device is recognized, type the following command
Code:
fastboot flashing unlock
8.) Allow the unlocking of the Bootloader on device screen. this will erase everything
9.) Allow the device to fully boot up, enable USB Debugging again and continue the tutorial!
Instructions
1.) Rename Magisk-vxx.x.apk to Magisk.zip
2.) Enable USB Debugging
3.) Type the following to make sure your computer sees the device (in cmd.exe)
Code:
adb devices
4.) You may get a pop up on your device's screen asking for adb permission, check the always allow and hit ok
5.) Type the follow command to reboot to bootloader (in cmd.exe)
Code:
adb reboot bootloader
6.) Once you're in the booloader and its unlocked, download the TWRP image from above
7.) Use the following fastboot command to boot into TWRP
Code:
fastboot boot twrp.img
8.) Once TWRP boots, keep your device plugged in via usb and type the following command into cmd.exe and hit enter
Code:
adb shell twrp sideload
9.) Once in sideload, you can type the following with magisk.zip and root your device!
Code:
adb sideload magisk.zip
10.) Use the following command to reboot and you're done!
Code:
adb reboot
congrats! you're rooted!
LETS GOOOO!! HEROOO!! Super easy and working on the latest December 2022 update! Felt way safer as well, not so much concern over twrp as we only booted into it, and then I just used the standard magisk and it worked excellent without worrying about all types of patches and versions aside from the latest twrp for android 12 from @JengaMasterG!
Thank you! I think the renaming the magisk file from apk to zip was probably what I was doing wrong trying to follow the other methods, on top of driver errors, that were solved by uninstalling all the drivers for the duo on my surface pro, which revealed a native 'Surface Fastboot' driver. Combine that with the 15 second ADB and it's .bat ready to go command line interface, idk... it wen't so smooth and worked perfectly.
Now I can try to see if I can improve my experience with some go to methods.. I really want to enable immersive mode and hopefully increase overall volume, if possible (many devices this can be done with engineeringmode, idk yet but hopefully it does have one and hopefully I can also calibrate the gyroscope)... obviously adblock without vpn is on the menu.... can utilize the full autoruns app to stop apps from starting up at boot like in windows... and then get into some other customizations.
cqqx2 said:
LETS GOOOO!! HEROOO!! Super easy and working on the latest December 2022 update! Felt way safer as well, not so much concern over twrp as we only booted into it, and then I just used the standard magisk and it worked excellent without worrying about all types of patches and versions aside from the latest twrp for android 12 from @JengaMasterG!
Thank you! I think the renaming the magisk file from apk to zip was probably what I was doing wrong trying to follow the other methods, on top of driver errors, that were solved by uninstalling all the drivers for the duo on my surface pro, which revealed a native 'Surface Fastboot' driver. Combine that with the 15 second ADB and it's .bat ready to go command line interface, idk... it wen't so smooth and worked perfectly.
Now I can try to see if I can improve my experience with some go to methods.. I really want to enable immersive mode and hopefully increase overall volume, if possible (many devices this can be done with engineeringmode, idk yet but hopefully it does have one and hopefully I can also calibrate the gyroscope)... obviously adblock without vpn is on the menu.... can utilize the full autoruns app to stop apps from starting up at boot like in windows... and then get into some other customizations.
Click to expand...
Click to collapse
Hello! I'm rooted, but I can only read and can't write. I am Android version 122022.821.13 of Att.
So I can't delete the apk inside the system directory
linlin2az said:
Hello! I'm rooted, but I can only read and can't write. I am Android version 122022.821.13 of Att.
So I can't delete the apk inside the system directory
Click to expand...
Click to collapse
Newer Android versions, especially stock ROM, generally doesn't let you write to the system partition. Only ROMs can do that, unless you can find a way to change the partition permissions. Root alone will not allow it, no matter what you do. I used to know of a TWRP script to fix that and make the system writable, but it doesn't work on andorid 11/12/13 anyway

How To Guide How to root Google Pixel Watch using Magisk

Google Pixel Watch Root Guide using Magisk​
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Readme​Note that this rooting process was performed with a special USB-C cradle provided by the Google Team. I would not recommend flashing the device without a stable connection to the pins under the wrist strap. I might attempt to make a 3D printed enclosure that uses pogo pins. Additionally, this process will wipe the device.
Rooting Process​
Enable developer options on the watch by going to Settings > System > About > Versions > Tap Build number until you unlock developer mode
While here, note down the Build Number. It will look like RWD9.XXXXXX.XXX.XX.
Go into Developer options and enable ADB debugging
Install the latest version of ADB and Fastboot tools on a computer
https://developer.android.com/tools/releases/platform-tools
Connect watch to computer using USB and allow permanent ADB debugging access on the watch
Verify your access works by running
Code:
adb devices
Download the appropriate (LTE or Bluetooth/WIFI) firmware at the link below, making sure to download the version that matches the build number from Step 2.
Factory Images for Google Pixel Watch Devices | Google Play services | Google for Developers
developers.google.com
Verify the checksum of downloaded firmware using
Code:
sha256sum name-of-firmware.zip
Unzip the downloaded zip, then unzip the image-rXX zip inside the original zip. Then, transfer the boot.img file to the watch using
Code:
adb push boot.img /sdcard/Download
Install a file manager on the watch because it does not include one by default. We will need it to select the boot.img file the Magisk app. I used File Manager TV USB OTG Cloud from the Play Store. I recommend launching the app and granting Files and media permissions all the time like it asks you to do in the popup.
Install the latest version of the Magisk APK from the Github link below on the watch by running
Code:
adb install name-of-magisk.apk
Releases · topjohnwu/Magisk
The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.
github.com
Launch the Magisk app, click Install, choose Select and Patch a File, then browse to the downloaded boot.img file
Click Let's Go and the magisk-patched boot image will be created in the Download folder
Transfer the image back to your computer using
Code:
adb pull /sdcard/Download/name-of-patched-image
Run
Code:
adb reboot bootloader
to reboot the watch into Fastboot
Verify the device shows up by using
Code:
fastboot devices
Unlock the bootloader of the watch using
Code:
fastboot flashing unlock
Confirm the message on the watch to unlock and wipe the device
Flash and boot the newly created Magisk image using
Code:
adb flash boot name-of-patched-image.img
Select Start in Fastboot to start the watch
After waiting an extremely long time, the watch will hopefully start and will need to be setup again
Reinstall the Magisk app using
Code:
adb install name-of-magisk.apk
Launch the app and it might prompt that it needs to restart the watch
To prevent the broken Superuser request popup where the grant button is off the screen, I recommend changing the Automatic Response prompt setting in the Magisk app to Grant. To change the option, swipe up on the Prompt text
With the watch started and setup, start an adb shell by running
Code:
adb shell
Then, run su to escalate to root privilege. The shell should change symbols from $ to # and running
Code:
whoami
should result in root
Bypassing SafetyNet​
Download the YASNAC - SafetyNet Checker APK from GitHub:
Releases · RikkaW/YASNAC
Yet Another SafetyNet Attestation Checker. Contribute to RikkaW/YASNAC development by creating an account on GitHub.
github.com
Install it on the watch using
Code:
adb install name-of-yasnac.apk
(Optional) Open the app and run the SafetyNet Attestation to verify your device fails
Download the SafetyNet Fix Magisk module from GitHub:
Releases · kdrag0n/safetynet-fix
Google SafetyNet attestation workarounds for Magisk - kdrag0n/safetynet-fix
github.com
Transfer it to watch using
Code:
adb push safetynet-fix-v2.4.0.zip /sdcard/Download
Start an adb shell with the watch using
Code:
adb shell
Elevate to root privileges with
Code:
su
Install the module with
Code:
magisk --install-module /sdcard/Download/safetynet-fix-v2.4.0.zip
Once installed, restart your watch
Now, run YASNAC SafetyNet Attestation again, and you should pass!
Interfacing with the USB Pins​The USB pins are under the watch band closest to the secondary button. From left to right, the pins are voltage, data+, data-, and ground. Google's VRP program provides the watch cradles by invitation only (still waiting for mine ). As such, a DIY solution needs to be created to make this process more accessible.
Picture courtesy of @ShinyQuagsire​The most reliable solution I can think of currently is using PCBite SP10 probes to connect to the USB pins. Once I get my PCBite, I will post a setup picture.
Another solution I'm going to try is inserting pogo pins into a replacement silicone watch band to connect to the USB pins.
Similarly, the pins have a 1.27mm spacing which you can find headers for online. That in combination with some helping hands could give a somewhat janky connection.
Troubleshooting​
If booting the Magisk image results in a bootloop, you can unbrick the device by flashing the corresponding stock boot.img image using
Code:
adb flash boot boot.image
If Magisk doesn't see the file, try doing the following to your file browser app:
Settings > Apps & Notifications > App permissions > Files and media > AppName > Allow all the time
Tips​
You can get into FastBoot mode by tapping on the top left and bottom right of the screen at the same time as the device is booting when the white "G" logo appears.
Wireless debugging allows you to do almost all of this guide except booting the patched boot.img file in Magisk. To enable wireless debugging, go to Settings > Developer options > Check Debug over Wi-Fi. Then, in developer options still, go to Wireless debugging and turn it on. From here, you can connect to your watch remotely from your PC using
Code:
adb connect watchip
Thanks​Huge thanks to Asmita Jha (Twitter @aj_0x00) who was there during the first 2 days of the rooting attempts and helped troubleshoot throughout. Additionally, big thanks to Stack Smashing (Twitter @ghidraninja) for giving us the idea to patch the Magisk file on the watch itself, instead of patching the boot image on another device running Magisk. Additionally, thanks to the Google team who gave us access to device and the prototype cradles to interface with the watch reliably.
Future Plans​To make the process more accessible, a cheap interfacing solution needs to be created. Please reach out if have any questions, concerns, or information that would make the process easier. You can find me on Twitter @breaddisease
https://twitter.com/breaddisease
Thanks!
This is awesome!
Now we just need a way to source that craddle or design one.
Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?
KineSight said:
Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?
Click to expand...
Click to collapse
I'm unsure about this so far! Both of my phones don't work with the Google Pixel Watch app (degoogled OP7P and old S8+) so I can't setup my Google account with the watch to use Google Wallet. Additionally, I can't install a SafetyNet checker without the USB cradle I'll get back to you if I figure something out!
How did you get the file manager to show the .img file? I installed the same file manager, pushed the file via adb, but the file manager can't see any .img files. I tried renaming it to 'boot.jpg', pushed that, the file manager sees it, but then Magisk fails with unknown/unsupported image type.
ClarkIV said:
How did you get the file manager to show the .img file? I installed the same file manager, pushed the file via adb, but the file manager can't see any .img files. I tried renaming it to 'boot.jpg', pushed that, the file manager sees it, but then Magisk fails with unknown/unsupported image type.
Click to expand...
Click to collapse
You might need to allow the app Files and media permissions all the time, like this:
Settings > Apps & Notifications > App permissions > Files and media > AnExplorer > Allow all the time
KineSight said:
Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?
Click to expand...
Click to collapse
I fail SafetyNet without the Universal SafetyNet Fix Magisk Module. However, I was able to install the SafetyNet Fix module with the following:
Code:
adb push safetynet-fix-v2.4.0.zip /sdcard/Download
adb shell
su
cd /sdcard/Download
magisk --install-module safetynet-fix-v2.4.0.zip
With this, I now pass SafetyNet! Still have to try Google Pay
breaddisease said:
Google Pixel Watch Root Guide using Magisk​
Readme​Note that this rooting process was performed with a special USB-C cradle provided by the Google Team. I would not recommend flashing the device without a stable connection to the pins under the wrist strap. I might attempt to make a 3D printed enclosure that uses pogo pins. Additionally, this process will wipe the device.
Rooting Process​
Enable developer options on the watch by going to Settings > System > About > Versions > Tap Build number until you unlock developer mode
Go into Developer options and enable ADB debugging
Install the latest version of ADB and Fastboot tools on a computer
Connect watch to computer using USB and allow permanent ADB debugging access on the watch
Verify your access works by running
Code:
adb devices
Download the latest version of the appropriate (LTE or Bluetooth/WIFI) Google Pixel Watch OTA firmware at the link below. Note that the latest version is at the bottom of the list (thanks Google)
https://developers.google.com/android/ota-watch
Verify the checksum of downloaded firmware using
Code:
sha256sum name-of-firmware.zip
Unzip the downloaded zip, then transfer the boot.img file to the watch using
Code:
adb push boot.img /sdcard/Download
Install a file manager on the watch because it does not include one by default. We will need it to select the boot.img file the Magisk app. I used File Manager TV USB OTG Cloud from the Play Store
Install the latest version of the Magisk APK from the Github link below on the watch by running
Code:
adb install name-of-magisk.apk
Releases · topjohnwu/Magisk
The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.
github.com
Launch the Magisk app, click Install, choose Select and Patch a File, then browse to the downloaded boot.img file
Click Let's Go and the magisk-patched boot image will be created in the Download folder
Transfer the image back to your computer using
Code:
adb pull /sdcard/Download/name-of-patched-image
Run
Code:
adb reboot bootloader
to reboot the watch into Fastboot
Verify the device shows up by using
Code:
fastboot devices
Unlock the bootloader of the watch using
Code:
fastboot flashing unlock
View attachment 5925307
Confirm the message on the watch to unlock and wipe the device
Flash and boot the newly created Magisk image using
Code:
adb flash boot name-of-patched-image.img
Select Start in Fastboot to start the watch
After waiting an extremely long time, the watch will hopefully start and will need to be setup again
Reinstall the Magisk app using
Code:
adb install name-of-magisk.apk
Launch the app and it might prompt that it needs to restart the watch
With the watch started and setup, start an adb shell by running
Code:
adb shell
Then, run su to escalate to root privilege. The shell should change symbols from $ to # and running
Code:
whoami
should result in root
View attachment 5925313​Bypassing SafetyNet​
Download the YASNAC - SafetyNet Checker APK from GitHub:
Releases · RikkaW/YASNAC
Yet Another SafetyNet Attestation Checker. Contribute to RikkaW/YASNAC development by creating an account on GitHub.
github.com
Install it on the watch using
Code:
adb install name-of-yasnac.apk
(Optional) Open the app and run the SafetyNet Attestation to verify your device fails
Download the SafetyNet Fix Magisk module from GitHub:
Releases · kdrag0n/safetynet-fix
Google SafetyNet attestation workarounds for Magisk - kdrag0n/safetynet-fix
github.com
Transfer it to watch using
Code:
adb push safetynet-fix-v2.4.0.zip /sdcard/Download
Start an adb shell with the watch using
Code:
adb shell
Elevate to root privileges with
Code:
su
Install the module with
Code:
magisk --install-module /sdcard/Download/safetynet-fix-v2.4.0.zip
Once installed, restart your watch
Now, run YASNAC SafetyNet Attestation again, and you should pass!
Troubleshooting/Tips​
If booting the Magisk image results in a bootloop, you can unbrick the device by flashing the corresponding stock boot.img image using
Code:
adb flash boot boot.image
Additionally, you can get into FastBoot mode by tapping on the top left and bottom right of the screen at the same time as the device is booting and the white "G" logo appears.
If Magisk doesn't see the file, try doing the following to your file browser app:
Settings > Apps & Notifications > App permissions > Files and media > AppName > Allow all the time
Wireless debugging allows you to do almost all of this guide except booting the patched boot.img file in Magisk. To enable wireless debugging, go to Settings > Developer options > Check Debug over Wi-Fi. Then, in developer options still, go to Wireless debugging and turn it on. From here, you can connect to your watch remotely from your PC using
Code:
adb connect watchip
Thanks​Huge thanks to Asmita Jha (Twitter @aj_0x00) who was there during the first 2 days of the rooting attempts and helped troubleshoot throughout. Additionally, big thanks to Stack Smashing (Twitter @ghidraninja) for giving us the idea to patch the Magisk file on the watch itself, instead of patching the boot image on another device running Magisk. Additionally, this wouldn't be possible without the help of the Google team who gave us access to device and the prototype cradles to interface with the watch reliably. Huge thanks to everyone running Hardwear.io this year where this method was discovered during the Hardpwn hardware hacking contest.
Future Plans​To make the process more accessable, a cheap interfacing solution needs to be created. My idea is to 3D print an enclosure and use pogo pins. Please reach out if have any questions, concerns, or information that would make the process easier. You can find me on Twitter @breaddisease
https://twitter.com/breaddisease
Thanks!
Click to expand...
Click to collapse
Cool
breaddisease said:
You might need to allow the app Files and media permissions all the time, like this:
Settings > Apps & Notifications > App permissions > Files and media > AnExplorer > Allow all the time
Click to expand...
Click to collapse
Thanks! That was it. Now the computer just refuses to recognize it as a fastboot device. It recognizes it with the watch fully on, so I know my wiring and pins are correct.
ClarkIV said:
Thanks! That was it. Now the computer just refuses to recognize it as a fastboot device. It recognizes it with the watch fully on, so I know my wiring and pins are correct.
Click to expand...
Click to collapse
Nice, good to hear! What's the output of
Code:
sudo fastboot devices
Or, if you're on Windows, an elevated terminal with
Code:
fastboot devices
Y'all realize that we already managed to root the watch a long time ago? https://forum.xda-developers.com/t/pixel-watch-successfully-bootloader-unlocked.4508253/
A lot of questions are also answered there.
Yes, it breaks safetynet. You can install this magisk module to get it back.
KineSight said:
Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?
Click to expand...
Click to collapse
Tiebe said:
Y'all realize that we already managed to root the watch a long time ago? https://forum.xda-developers.com/t/pixel-watch-successfully-bootloader-unlocked.4508253/
A lot of questions are also answered there.
Click to expand...
Click to collapse
I was not aware that it had been done already! Thanks for the info! I thought I was the first
breaddisease said:
I was not aware that it had been done already! Thanks for the info! I thought I was the first
Click to expand...
Click to collapse
Sadly, no.
Another small thing: You shouldn't download the OTA zip, but the factory images. The OTA zip doesn't always have full boot image, and only a patch image (boot.img.p), which is used in the updating process for patching the current boot image to the newer version. The factory images always have a full boot image.
Other than that: great guide!
Tiebe said:
Sadly, no.
Another small thing: You shouldn't download the OTA zip, but the factory images. The OTA zip doesn't always have full boot image, and only a patch image (boot.img.p), which is used in the updating process for patching the current boot image to the newer version. The factory images always have a full boot image.
Other than that: great guide!
Click to expand...
Click to collapse
Ok, thanks! I updated step 6 and 8 accordingly.
Would it be an issue if someone flashed an un-updated watch with the latest boot.img? Like should I recommend flashing the appropriate version's boot.img, or updating to the latest version before flashing the latest boot.img? Thanks!
breaddisease said:
Ok, thanks! I updated step 6 and 8 accordingly.
Would it be an issue if someone flashed an un-updated watch with the latest boot.img? Like should I recommend flashing the appropriate version's boot.img, or updating to the latest version before flashing the latest boot.img? Thanks!
Click to expand...
Click to collapse
Always flash the boot.img of the version that you're currently on. Happy to help!
@breaddisease
I've also noticed that the safetynet module patched by Displax seems to work better in most cases than the original one by kdrag0n. The one by Displax is just a fork of the one by kdrag0n, with some changes.
breaddisease said:
Nice, good to hear! What's the output of
Code:
sudo fastboot devices
Or, if you're on Windows, an elevated terminal with
Code:
fastboot devices
Click to expand...
Click to collapse
I'm on Linux and 'sudo fastboot devices' didn't list any device. I can communicate via ADB over USB so I know the cable is working. In fastboot mode, the device doesn't show up under 'lsusb' either. I have tried USB 2 and 3 ports.
ClarkIV said:
I'm on Linux and 'sudo fastboot devices' didn't list any device. I can communicate via ADB over USB so I know the cable is working. In fastboot mode, the device doesn't show up under 'lsusb' either. I have tried USB 2 and 3 ports.
Click to expand...
Click to collapse
Are you providing it power through the left pin? Maybe its required for fastboot
breaddisease said:
Are you providing it power through the left pin? Maybe its required for fastboot
Click to expand...
Click to collapse
Yes, I am powering it. Verified by the watch showing its charging when fully booted. Were you on Linux or Windows for this? If Linux what Distro?

Categories

Resources