Develop Bugs

[GUIDE] Revert, rollback, or downgrade Nvidia Shield TV Experience Upgrade +DATA LOSS

NOTICE: Several users have reported issues downgrading from v7.2.x, so it might require some additional experimentation to downgrade from that version.
-
Missing your screenshot or twitch streaming functionality? Hate the new launcher layout w/ its tiny one row of icons and its numerous rows of psychologically-aggressive suggestion imposition?
Well, now you can stop cursing at Nvidia, because they provided a way (albiet, a highly technical and mostly-undocumented way), to load any version of their OS that you choose.
I've seen others wanting to downgrade (including myself), so I've collected the relevant steps which I used to successfully revert to an earlier version. This guide assumes a bit of technical working knowledge, so I apologize if you are one of the 'normal' people that Nvidia has bulldozed over...
All the usual "don't blame me for bricked devices" caveats apply.... please be careful, know what each step does! research each step!
Best of luck...
0 - prereqs
make sure your PC & nvidia shield are both plugged into a UPS, b/c a power failure during a flashing operation is not very pleasant.
make sure you have (or do get) the adb & fastboot binaries ("commands") for your computer
make sure that you get all your userdata off the device, because it will be erased by this process
1 - using a web browser
register for an nvidia developer account (which you will have an opportunity to do if you attempt the next step)
download the 6.3 'developer os' rom for your particular model
https: //developer.nvidia.com/shield-developer-os-images (sorry, noob filter won't allow the real/clickable url)​
NB: The 6.3 developer rom for the 2017 console is missing the userdata.img, there are currently no reports (on this thread) if a different userimage (pre-6.3 or for the 2015 version) works on the 2017 console (testers welcome!).
NB: if the cost of being identified as a developer offends you (i.e. yielding a name, company, email, etc), then you can probably dig up a link to the roms in the comments or elsewhere on the xda forums.
2 - on the device
enable developer mode by clicking the 'build' entry in settings->info
enable usb debugging in settings->developer-options
plug it into your computer using the usb port furthest from the hdmi port
3 - in a terminal
unzip the downloaded rom & cd into the resulting directory
edit the 'flash-all.sh' script to add the following line just before the final reboot:
fastboot flash userdata userdata.img​
#(this will add even more wall-time to the flashing process, but will clobber the already-erased newer 7.0 user partition data with the old)
adb reboot bootloader
fastboot oem unlock && ./flash-all.sh
NB: Now confirm your willingness to lose all your data. On the 2015 'pro' version of the console, this is accomplished by pressing (or holding) the nvidia logo 'button'... AND WILL TAKE NEARLY TWO HOURS. Others use the x/y/a/b buttons on the game controller connected to the usb port nearest to the hdmi port.
[... time passes ...]
NB: the 7.0 to 6.3 was a clean backstep for me, but if you are going between other versions, I can see that this script might stall in the middle if the device does not come back up with adb services available... in which case you will need to enter fastboot manually using a hardware method.
4 - Break TegraOTA
You have now flushed the correct version onto your device, but we can't complete the setup process... if you were to try, the final step would immediately and automatically start downloading & applying the latest (7.0) experience update! Therefore, we must neuter the updater itself.
Still in the terminal:
adb root
adb remount
adb shell
# now these commands are run in the adb shell (technically on the phone through the PC terminal)
# the first path was the right one for me, but I'm putting here all the paths known to me in case you are using a different version
rm -rf /system/priv-app/TegraOTA
rm -rf /system/app/TegraOTA
rm -rf /system/app/TegraOTA.apk
sync
reboot
5 - you should now be able to setup and pain-stakingly reconfigure your nvidia shield to the way it was before you blindly trusted an OEM update without doing extensive research beforehand.
PS: if you fear that netflix or amazon-video will at some point stop working because of this process, you might wish to "fastboot oem lock" the device (knowing that an unlock will erase your user-data, but having the developer rom means you can always get root access via adb).
I hope you find this useful.

Thanks! I will be trying this tonight! I miss 6.3 and PLEX is BROKEN in 7.0!
Any idea if this can be done without needing a controller? My buddy has a shield TV but bought it used without a controller.

rossbeck said:
Thanks! I will be trying this tonight! I miss 6.3 and PLEX is BROKEN in 7.0!
Any idea if this can be done without needing a controller? My buddy has a shield TV but bought it used without a controller.
Click to expand...
Click to collapse
Plex is NOT broken in 7.0 i use it everyday.

Builtfordtough1 said:
Plex is NOT broken in 7.0 i use it everyday.
Click to expand...
Click to collapse
I use it every day too... and since Plex v6.13, files fail to play after 3 seconds unless you run them a 2nd time.
It's a known issue that everyone is having due an acknowledged bug in exoplayer2 with certain containers like mkv. Since 7.0/oreo has plex v6.14 baked in as a system app, it's impossible to downgrade to v6.12 to get rid of the issue until Plex fixes it... and they've known about it for 2 months now. Since quantity has been their focus over quality lately, I'm not holding my breath for a fix.
The solution is to downgrade to 6.3, manually install plex v6.12, and turn off app updates.... so that's my plan.

rossbeck said:
Any idea if this can be done without needing a controller? My buddy has a shield TV but bought it used without a controller.
Click to expand...
Click to collapse
I think it depends on the model. AFAIK, the newer 2017 ones need a controller (or possibly a USB keyboard) to confirm the userdata partition wipe.

Osndok said:
I think it depends on the model. AFAIK, the newer 2017 ones need a controller (or possibly a USB keyboard) to confirm the userdata partition wipe.
Click to expand...
Click to collapse
Ahhh, good call. I'll have him try a usb keyboard.

doesnt work for me... i have a nvidia shield tv 2015. i tried with flash-all.bat
and im stuck after reboot. is there any other way?

crazyscow said:
doesnt work for me... i have a nvidia shield tv 2015. i tried with flash-all.bat
and im stuck after reboot. is there any other way?
Click to expand...
Click to collapse
What command did the script stop at? and how 'stuck' are you (i.e. can you get to fastboot?).
I imagine that if you started with the wrong rom, it would likely fail to boot.

thanks for the fast reply, i just manually installed it without the bat file
I went manually into the fastboot mode by unplugging the power pressing the power button and plugging it back in until fastboot mode comes.
then i typed
fastboot flash staging blob
fastboot flash boot boot.img
wait until the sound on windows comes then - adb devices
adb reboot bootloader
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot reboot
and then it booted

crazyscow said:
thanks for the fast reply, i just manually installed it without the bat file
I went manually into the fastboot mode by unplugging the power pressing the power button and plugging it back in until fastboot mode comes.
then i typed
fastboot flash staging blob
fastboot flash boot boot.img
wait until the sound on windows comes then - adb devices
adb reboot bootloader
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot reboot
and then it booted
Click to expand...
Click to collapse
How did you get past the forced update? I was able to flash 6.3, but it forces the update during setup and I don't have ADB access yet because usb debugging isn't turned on. Can't disable the OTA updates without it!
Basically I've successfully flashed 6.3 and am sitting at a working fastboot prompt. Not sure what to do from here.

rossbeck said:
How did you get past the forced update? I was able to flash 6.3, but it forces the update during setup and I don't have ADB access yet because usb debugging isn't turned on. Can't disable the OTA updates without it!
Basically I've successfully flashed 6.3 and am sitting at a working fastboot prompt. Not sure what to do from here.
Click to expand...
Click to collapse
Disabling the OTA update is step four, if ADB does not work, I would guess that you forgot to flash userdata.img in the previous step(s).

Osndok said:
Disabling the OTA update is step four, if ADB does not work, I would guess that you forgot to flash userdata.img in the previous step(s).
Click to expand...
Click to collapse
So you did what to get userdata.img? Created it in TWRP or something? It's not included with the recovery images... and this basically bypasses the OOBE/setup stuff?
Thanks man

rossbeck said:
you did what to get userdata.img? ... It's not included with the recovery images... and this basically bypasses the OOBE/setup stuff?
Click to expand...
Click to collapse
userdata.img is inside the ZIP from the nvidia developer website, as can be seen here:
Code:
$ jar tf nv-recovery-image-shield-atv-pro-6.3.0-dev_rooted.zip | grep user
nv-recovery-image-shield-atv-pro-6.3.0-dev_rooted/userdata.img

rossbeck said:
[the userdata.img] basically bypasses the OOBE/setup stuff?
Click to expand...
Click to collapse
No... not really. The userdata.img from the developer pack both (1) matches the 6.3 version (doesn't have any of the newer, potentially incompatible entries), and (2) has developer-mode & adb enabled by default.
So in addition to it probably just working better, flashing the userdata will let you get adb access, and thus break the OTA, and thus complete the setup w/o the update.

I thought it would boot up, but im still stuck on the android loading screen!
Ill try to reflash the rom again tonight.
update:
I got it to work now, without update having to update to 7.0.2
Code:
adb reboot bootloader
fastboot flash staging blob
fastboot flash boot boot.img
fastboot reboot
//waiting for nvidia logo and the Windows PC to make the connection noise
//otherwise you can check by typing
adb devices
// if it shows something then continue
adb reboot bootloader
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot flash userdata userdata.img
fastboot reboot
once it booted it up, i went thru the procedure of setting it up with my network and google account, then the window pop-up "downloading version 7.0.2" then i followed the guide in the first post
Code:
adb root
adb remount
adb shell
# now these commands are run in the adb shell (technically on the phone through the PC terminal)
# the first path was the right one for me, but I'm putting here all the paths known to me in case you are using a different version
rm -rf /system/priv-app/TegraOTA
rm -rf /system/app/TegraOTA
rm -rf /system/app/TegraOTA.apk
sync
reboot
after that it booted up into android 7 with not OTA update notification.
thank you!

hello, thanks for the contribution, but when decompressing the image of developer 6.3 of shield tv 2017 I do not know where to get the file userdata.img, could you give me where to get it?

lohengrim93 said:
when decompressing the image of developer 6.3 of shield tv 2017 I do not know where to get the file userdata.img, could you give me where to get it?
Click to expand...
Click to collapse
As I said in #13, I found the userdata.img inside the archive from nvidia (the 2015 "pro" version to be exact), and I don't know why it is missing from (at least) the 6.3 archive for the 2017 device.
If you are feeling adventurous, you can try downloading either of the 2015 zips, and use its userdata.img... maybe the 16gb one?
I would be eager to know if that works for you, since I'm unsure if the userdata.img can be mixed between different versions of the console...
JUST BE VARY CAREFUL to not mix up your directories and start flashing the wrong blobs & boots... that would be a recipe for a brickin', methinks.

crazyscow said:
I got it to work now, without ... having to update to 7.0.2
... i followed the guide in the first post...
after that it booted up into android 7 [without] OTA update notification.
thank you!
Click to expand...
Click to collapse
I'm quite pleased to hear that it worked for you... (my first success report!).

Adb root
When I attempt to run the adb root command it just errors on me at the end, do I need to have the shield booted into setup for it to work?

Insatiablejimmy said:
When I attempt to run the adb root command it just errors on me at the end, do I need to have the shield booted into setup for it to work?
Click to expand...
Click to collapse
You forgot to include (or even describe) the actual error message, so I can only guess as to what is wrong.
However, since "adb root" is the linchpin of the developer rom, I would assume that you did not flash a developer rom (or as indicated above concerning the 2017 model) are missing the "userdata.img", which could also cause this behavior.

ADB no longer working

I have the latest Google driver on Windows 10 Pro. I have the latest 29.0.6 platform tools. I open a cmd prompt with admin privileges in platform tools and run "adb devices" and I get an error that I have attached. I have uninstalled and reinstalled Google driver to no avail. I have downloaded the platform tools again to make sure it was not corrupt, that didn't help. Afer I connect to the phone with usb debugging turned on it does not ask me if I want to trust the fingerprint of the computer. Can anyone give me some help? Thank you.

first attempt
Holysmoke99 said:
I have the latest Google driver on Windows 10 Pro. I have the latest 29.0.6 platform tools. I open a cmd prompt with admin privileges in platform tools and run "adb devices" and I get an error that I have attached. I have uninstalled and reinstalled Google driver to no avail. I have downloaded the platform tools again to make sure it was not corrupt, that didn't help. Afer I connect to the phone with usb debugging turned on it does not ask me if I want to trust the fingerprint of the computer. Can anyone give me some help? Thank you.
Click to expand...
Click to collapse
Download the latest:
https://developer.android.com/studio/releases/platform-tools
Unzip in a dir.
Copy following files to test dir:
adb.exe
AdbWinApi.dll
AdbWinUsbApi.dll
fastboot.exe
Create one .bat file in the same 'test' dir:
adbreboot.bat:
@Echo off
set PATH=%CD%;%PATH%;
adb reboot
save it .... connect your device ... and run it (if necessary with admin privileges)
Good luck

Thanks for the advice but nothing happened.
I attached the folder contents. That is correct?

second attempt
Holysmoke99 said:
Thanks for the advice but nothing happened.
I attached the folder contents. That is correct?
Click to expand...
Click to collapse
Download and extract:
https://www.uwe-sieber.de/files/devicecleanupcmd.zip
On a windows X64 machine:
copy DeviceCleanupCmd.exe from extracted x64 folder to your previous test folder (with adb.exe, AdbWinApi.dll, etc...)
set the properties of DeviceCleanupCmd.exe for all users to run as administrator
create 2 .bat files:
DeviceCleanupCmdLoad.bat:
@Echo off
set PATH=%CD%;%PATH%;
DeviceCleanupCmd.exe * -t
PAUSE
DeviceCleanupCmdRemove.bat:
@Echo off
set PATH=%CD%;%PATH%;
DeviceCleanupCmd.exe * -s
PAUSE
Run the 2 . bat files (don't connect your device yet !)
Follow the instructions on the messages: ex: 'press any key to close': press any key, etc...
After that:
1. connect your device and run adbreboot.bat... see what happens
2. if no luck, run DeviceCleanupCmdLoad.bat and DeviceCleanupCmdRemove.bat again : REBOOT your windows, connect your device and run adbreboot.bat... see what happens
Good luck

It still did not work. Thanks again.

third attempt
Holysmoke99 said:
It still did not work. Thanks again.
Click to expand...
Click to collapse
- Disconnect USB between PC and device
- On device use "Revoke USB debugging authorizations" in "Developer Options"
- Reboot device
- Reconnect the device to the PC
- You should see now: the fingerprint of the computer ... allow it!
- run adbreboot.bat... see what happens

Thanks again, I have tried to revoke authorizations all day to no avail. I tried all the steps above and added revoking but it still won't give me option to trust fingerprint.

Holysmoke99 said:
Thanks again, I have tried to revoke authorizations all day to no avail. I tried all the steps above and added revoking but it still won't give me option to trust fingerprint.
Click to expand...
Click to collapse
last attempt
fully uninstall magisk (root)
update to the latest OTA firmware of google....
revoke the authorizations again

I had altered boot.img to obtain root. This morning the phone was running very slow so I did a factory reset. I updated to the latest OTA. Is magisk still on the phone?

After installing 15 seconds ADB Installer v1.4.3 your batch file worked and brought up the prompt to accept fingerprint!!!!!!!!! Thanks so much for taking the time to help me!

Holysmoke99 said:
I had altered boot.img to obtain root. This morning the phone was running very slow so I did a factory reset. I updated to the latest OTA. Is magisk still on the phone?
Click to expand...
Click to collapse
I always complete remove magisk before installing the latest OTA ... just in case

biontx said:
I always complete remove magisk before installing the latest OTA ... just in case
Click to expand...
Click to collapse
do you have to alter boot.img each time you install OTA to keep root?

Holysmoke99 said:
do you have to alter boot.img each time you install OTA to keep root?
Click to expand...
Click to collapse
Each time before I install an OTA I remove root and magisk
Download the latest factory image for you device:
https://developers.google.com/android/images#bonito
Unzip it and copy boot.img to a dir on your device
Reinstall magisk apk with the permissions (my favorite: Magisk v20.4: MagiskManager-v7.5.1.apk)
https://github.com/topjohnwu/Magisk
Patch your boot.img with MagiskManager-v7.5.1.apk
Copy your magisk patched . img to your computer to a dir with: adb.exe; AdbWinApi.dll;AdbWinUsbApi.dll;fastboot.exe
Create 2 .bat files:
0001fastbootmagicpatched.bat:
@Echo off
set PATH=%CD%;%PATH%;
fastboot boot <FullPathTo your magisk patched img file>\magiskpatched.img
example:
fastboot boot D:\PROJECTS\NOUGAT\PIXEL3A\magisk\20200405Stable\magiskpatchedboot\magiskpatched.img
0002fastbootflashbootmagicpatched.bat:
@Echo off
set PATH=%CD%;%PATH%;
fastboot flash boot <FullPathTo your magisk patched img file>\magiskpatched.img
example:
fastboot flash boot D:\PROJECTS\NOUGAT\PIXEL3A\magisk\20200405Stable\magiskpatchedboot\magiskpatched.img
Put your device into bootloader.
Connect your device and run 0001fastbootmagicpatched.bat
Disconnect your device.
After a full start of your device, don't start any other app... put your device into bootloader again.
Connect your device and run 0002fastbootflashbootmagicpatched.bat
After de cmd window ends on your computer, press start on your device
Once fully started, all should be well on your device.
Start magisk app and adapt to your needs

System Power app
@Holysmoke99
System Power app (see attachment): could you test this app please:
Preview: see pictures in attachment.
Made for android 10 or higher.
Root is needed.
Contains a tile to be added in your quick settings: makes it more easy to take a screenshot.
Contains the following functions:
- Power off
- Restart
- Recovery
- Bootloader
- Torch (toggle torch: added v 3.1 b 30013)
- Screenshot
- Screen off
Any comments appreciated

[Guide] nVidia Shield Android TV experience upgrade 9.0.0 workarounds

I just wanted to gather resources and guidance on workarounds for caveats found in:
nVidia Shield Experience Upgrade 9.0.0 with Android 11
Scoped storage for instance.
New Google TV launcher
Caution: I'm not responsible if you end up bricking your nVidia Shield Android TV.​
Change default launcher​Launcher alternatives​FLauncher​
https://play.google.com/store/apps/details?id=me.efesser.flauncher
https://gitlab.com/etienn01/flauncher
Example: FLauncher​
Install FLauncher from Google Play store.
Open FLauncher to make sure it works.
Enable ADB over network on the nVidia Shield (developer options).
Connect ADB from a computer with android-tools.
Disable default launcher with following ADB command:
Code:
adb shell pm disable-user --user 0 com.google.android.tvlauncher
Disconnect ADB.
Press "Home" button on the nVidia Shield. This should open FLauncher.
Instructions​
https://techmogulchannel.com/tutori...lt-launcher-to-custom-launcher-windows-guide/
https://www.reddit.com/r/AndroidTV/comments/o96tun/how_to_install_a_3rdparty_launcher_as_default_on/
Set scoped storage permissions​Example: Solid File Explorer​
Markdown (GitHub flavored):
### Example session with nVidia Shield Android TV
#### Start ADB server
adb start-server
#### Connect (approve request on the Shield)
adb connect 192.168.86.36:5555
#### Solid Explorer
adb shell cmd appops get --uid pl.solidexplorer2
adb shell cmd appops set --uid pl.solidexplorer2 android:MANAGE_EXTERNAL_STORAGE allow
adb shell cmd appops set --uid pl.solidexplorer2 android:REQUEST_INSTALL_PACKAGES allow
#### Disconnect
adb disconnect
#### Turn off ADB server
adb kill-server
Instructions​
https://www.codetd.com/en/article/10481938
https://forum.xda-developers.com/t/...adb-on-note-10-updated-to-android-11.4221617/
https://developer.android.com/train...es#enable-manage-external-storage-for-testing
https://www.reddit.com/r/androiddev/comments/mscu80/as_a_user_is_it_possible_for_me_to_grant_an_old/
Roll back to 8.2.3​Download​
https://developer.nvidia.com/gameworksdownload#?search=recovery os image
Instructions​
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
https://docs.nvidia.com/gameworks/content/devices/shield_flashing_from_image.htm
https://forum.xda-developers.com/t/3321404/
https://forum.xda-developers.com/t/4392605/#post-86397133 by @perieanuo.
Other related guides by me​
Ready made Leanback Icons and Shortcuts for "regular" Android Apps
[Tool][Windows][PowerShell] Android Platform Tools Updater (ADB & Fastboot)

Thanks for this !
I just hate this google tv launcher update and those F****** ads.
Now it's clean, Flauncher looks great

Thank you for that awesome guide
I have one question regarding scoped storage permissions. I'm trying to achieve the same with Kodi like you did with Solid File Explorer.
The first command worked fine: adb shell cmd appops get --uid org.xbmc.kodi
I get the following output:
Uid mode: LEGACY_STORAGE: allow
TAKE_AUDIO_FOCUS: allow; time=+2d3h23m52s536ms ago
WAKE_LOCK: allow; time=+2d3h23m52s331ms ago; duration=+22m38s145ms
READ_EXTERNAL_STORAGE: allow; time=+14h44m6s853ms ago
WRITE_EXTERNAL_STORAGE: allow
Unfortunately, when I try to execute the 2nd command adb shell cmd appops set --uid org.xbmc.kodi android:MANAGE_EXTERNAL_STORAGE allow I get the following error:
Error: Unknown operation string: android:MANAGE_EXTERNAL_STORAGE
Is there anything that I'm missing or not possible with Kodi?

No_Reason said:
Thank you for that awesome guide
I have one question regarding scoped storage permissions. I'm trying to achieve the same with Kodi like you did with Solid File Explorer.
The first command worked fine: adb shell cmd appops get --uid org.xbmc.kodi
I get the following output:
Uid mode: LEGACY_STORAGE: allow
TAKE_AUDIO_FOCUS: allow; time=+2d3h23m52s536ms ago
WAKE_LOCK: allow; time=+2d3h23m52s331ms ago; duration=+22m38s145ms
READ_EXTERNAL_STORAGE: allow; time=+14h44m6s853ms ago
WRITE_EXTERNAL_STORAGE: allow
Unfortunately, when I try to execute the 2nd command adb shell cmd appops set --uid org.xbmc.kodi android:MANAGE_EXTERNAL_STORAGE allow I get the following error:
Error: Unknown operation string: android:MANAGE_EXTERNAL_STORAGE
Is there anything that I'm missing or not possible with Kodi?
Click to expand...
Click to collapse
Are you using the latest version of Android platform-tools? I also got some errors when following a guide, turned out the command syntax had changed a little with newer versions of adb.
https://developer.android.com/studio/releases/platform-tools#downloads

I just switched to the latest version of Android platform-tools.
adb version is giving me:
Android Debug Bridge version 1.0.41
Version 32.0.0-8006631
But I still get the same error message as mentioned above
Any idea, why it's still failing? Does the app itself need to support this?

hi,
i downgraded but the flashing is not really like described here
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
those 2 are incorrect:
- fastboot flash dtb mdarcy.dtb.img
- fastboot flash vbmeta vbmeta.img
in my case i did (the files were in "c:\adb\822" folder, i used official 8.2.2 recovery image, but tested the same for 8.2.3 and 8.2.0)
fastboot flash staging ./822/blob
fastboot flash boot ./822/boot.img
fastboot flash recovery ./822/recovery.img
fastboot flash system ./822/system.img
fastboot flash vendor ./822/vendor.img
fastboot flash dtb ./822/tegra210-darcy-p2894-0050-a08-00.dtb
(attention i choosed /tegra210-darcy-p2894-0050-a08-00.dtb because my shield was this version, to be checked before flashing in settings/about...)
I tried with and without dtb and with and without erasing user data from fastboot menu (the last option)
I guess mdarcy.dtb.img and vbmeta.img are from other recovery archives, my test was done 27 jan 2022, maybe nvidia modified those recovery archives?
anyway, for inexperienced users it should be more clear what to flash, in what order, why writing this and that, the tutos for this downgrade are a mess. someone on reddit says we should format all those partitions but he says it at the end of his post, so if you respect command orders and reboot shield you're screwed.
my 2 cts, you should write ALL partitions provided by nvidia in archive after unlocking bootloader (maybe formatting them before??? but with UPS attached, risky thing btw), reset shield, relock bootloader and maybe reset shield from bootloader menu or gui.
i hope a pro take this in hand explaining for us
in the process i managed to fry my 'away' usb port power (it works well as debug port but his power control chip is dead, tried already deactivating usd debug and usb file sharing and reflashing 3 times like i described before, but it's clearrly a hardware issue). well, this one it's on me, I had olimex usb separator with power supply conected and after reflash i set that away usb as normal port, mayhe the two devices (shield and olimex usb-iso isolator tried to power the +5V line at once and the nvidia one was the weaker one). normally nvidia should entered protected mode, but i'm not the hw designer on that one

Any you guys know how to force landscape android tv 9, whole apks I used to forces doesn't work, I have 2015 and 2017 models, please help.

No_Reason said:
I just switched to the latest version of Android platform-tools.
adb version is giving me:
Android Debug Bridge version 1.0.41
Version 32.0.0-8006631
But I still get the same error message as mentioned above
Any idea, why it's still failing? Does the app itself need to support this?
Click to expand...
Click to collapse
Hmm. I'm certainly no expert at this. But what you say about the app need to support it might make sense. With the get command on Solid Explorer, I saw that permission that I could set, but you can't.

baba702 said:
Any you guys know how to force landscape android tv 9, whole apks I used to forces doesn't work, I have 2015 and 2017 models, please help.
Click to expand...
Click to collapse
Tried hotfix 3?
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481434/shield-experience-upgrade-90-hotfix-image/

o-l-a-v said:
Tried hotfix 3?
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481434/shield-experience-upgrade-90-hotfix-image/
Click to expand...
Click to collapse
Thank you I didn't know about it I'll try

Ok just I installed hotfix 3 but I'm still have several issues, now button mapper doesn't work and the screen rotation doesn't work, any help

baba702 said:
Ok just I installed hotfix 3 but I'm still have several issues, now button mapper doesn't work and the screen rotation doesn't work, any help
Click to expand...
Click to collapse
If you use button remapper so change default launcher, use the method in the original post instead to just disable the default launcher app. Else, ask the button remapper developer I guess.
For the 2nd problem (orientation), I think there is a adb command to set it. Google it and see what you find.
Edit: Orientation, found some related info:
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481782/shield-experience-upgrade-90-known-issues/3206852/

I
o-l-a-v said:
If you use button remapper so change default launcher, use the method in the original post instead to just disable the default launcher app. Else, ask the button remapper developer I guess.
For the 2nd problem (orientation), I think there is a adb command to set it. Google it and see what you find.
Edit: Orientation, found some related info:
https://www.nvidia.com/en-us/geforce/forums/shield-tv/9/481782/shield-experience-upgrade-90-known-issues/3206852/
Click to expand...
Click to collapse
I give whole the permite but doesn't work the buttons remapper, something with YouTube vanced is the problem, I unistalled and that works, rotation I tried with whole permite included the energy optimization access but no work

perieanuo said:
hi,
i downgraded but the flashing is not really like described here
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
those 2 are incorrect:
- fastboot flash dtb mdarcy.dtb.img
- fastboot flash vbmeta vbmeta.img
in my case i did (the files were in "c:\adb\822" folder, i used official 8.2.2 recovery image, but tested the same for 8.2.3 and 8.2.0)
fastboot flash staging ./822/blob
fastboot flash boot ./822/boot.img
fastboot flash recovery ./822/recovery.img
fastboot flash system ./822/system.img
fastboot flash vendor ./822/vendor.img
fastboot flash dtb ./822/tegra210-darcy-p2894-0050-a08-00.dtb
(attention i choosed /tegra210-darcy-p2894-0050-a08-00.dtb because my shield was this version, to be checked before flashing in settings/about...)
I tried with and without dtb and with and without erasing user data from fastboot menu (the last option)
I guess mdarcy.dtb.img and vbmeta.img are from other recovery archives, my test was done 27 jan 2022, maybe nvidia modified those recovery archives?
anyway, for inexperienced users it should be more clear what to flash, in what order, why writing this and that, the tutos for this downgrade are a mess. someone on reddit says we should format all those partitions but he says it at the end of his post, so if you respect command orders and reboot shield you're screwed.
my 2 cts, you should write ALL partitions provided by nvidia in archive after unlocking bootloader (maybe formatting them before??? but with UPS attached, risky thing btw), reset shield, relock bootloader and maybe reset shield from bootloader menu or gui.
i hope a pro take this in hand explaining for us
in the process i managed to fry my 'away' usb port power (it works well as debug port but his power control chip is dead, tried already deactivating usd debug and usb file sharing and reflashing 3 times like i described before, but it's clearrly a hardware issue). well, this one it's on me, I had olimex usb separator with power supply conected and after reflash i set that away usb as normal port, mayhe the two devices (shield and olimex usb-iso isolator tried to power the +5V line at once and the nvidia one was the weaker one). normally nvidia should entered protected mode, but i'm not the hw designer on that one
Click to expand...
Click to collapse
this is really good info - seriously. I'm about to downgrade to 8.2.3 on the 2017_16gb model and I'm trying to take it all in. Weird how there's not a ton of good information on this. Did you follow any other videos or guides?

Alekos said:
this is really good info - seriously. I'm about to downgrade to 8.2.3 on the 2017_16gb model and I'm trying to take it all in. Weird how there's not a ton of good information on this. Did you follow any other videos or guides?
Click to expand...
Click to collapse
hi,
i did kinda mixup of some guides like
https://www.reddit.com/r/ShieldAndroidTV/comments/s3yqe1
(also tested like he said, first fastboot erase boot/staging/recovery/system/vendor, then write those)
the procedure was as simpliy as this:
__________________________________________________________________________________________________________________
How to downgrade your Shield TV Pro back to 8.2.3 (Android 9)
The first step is to go to Settings, Device Preferences, About, tap build number 7-8 times for developer options and enable USB debugging and allow debugging through your PC. Before you reboot to the bootloader, plug in a keyboard or your Shield Controller to continue, then input adb reboot bootloader (must have drivers installed), unlock bootloader, and factory reset, reboot and unplug the USB and power for a full unlock or else you'll get "write failed" when flashing.
first, wipe partitions:
fastboot erase boot
fastboot erase staging
fastboot erase recovery
fastboot erase system
fastboot erase vendor
second, flash partitions (i saved/unzipped in c:\adb\823 the files, that's why "./823/" appears below)
fastboot flash boot ./823/boot.img
fastboot flash staging ./823/blob
fastboot flash recovery ./823/recovery.img
fastboot flash system ./823/system.img
fastboot flash vendor ./823/vendor.img
I relocked bootloader at the end
fastboot oem lock (or via bootloader GUI)
Just used a simple usb keyboard ( a french one, "A" was in the place of "Q" key) and bootloader use US layout as default for keyboard.
The USB cable must be a quality one, mine was USB3 one, 1m long.

Hey, so you guys don't recommend updating to Android 11 on the 2017 Shield TV?
I'm still running Android 9 (NVidia Experience 8.2.3) and everything works well. Will I gain anything by updating?

Ghisy said:
Hey, so you guys don't recommend updating to Android 11 on the 2017 Shield TV?
I'm still running Android 9 (NVidia Experience 8.2.3) and everything works well. Will I gain anything by updating?
Click to expand...
Click to collapse
I'd wait for next stable/ non-hotfix release, and then check feedback on Reddit and the nVidia forum before doing the jump.
But I won't bother rolling back to 8.2.3 either, 9.0.0 works OK for me. If you're hosting Plex server on your Shield, definitely wait. I only use it as a media player, nothing fancy.

o-l-a-v said:
I'd wait for next stable/ non-hotfix release, and then check feedback on Reddit and the nVidia forum before doing the jump.
But I won't bother rolling back to 8.2.3 either, 9.0.0 works OK for me. If you're hosting Plex server on your Shield, definitely wait. I only use it as a media player, nothing fancy.
Click to expand...
Click to collapse
Well, I guess 9.0.1 is the stable one apparently: https://9to5google.com/2022/02/15/shield-tv-9-0-1-update-android-11/
I need to wait for the developer image because I want to root my Shield TV again. Although there's no guide here that's up to date unfortunately...

baba702 said:
I
I give whole the permite but doesn't work the buttons remapper, something with YouTube vanced is the problem, I unistalled and that works, rotation I tried with whole permite included the energy optimization access but no work
Click to expand...
Click to collapse
For the screen orientation setting, have you tried something as simple as a "forced rotation" app? I've used that for apps that normally come up in portrait that i wanted to force into landscape mode (ie YouTube Vanced, Magisk Manager, etc).
Here's one that's worked for me in the past (side loaded):
https://m.apkpure.com/set-orientation/com.googlecode.eyesfree.setorientation

o-l-a-v said:
I just wanted to gather resources and guidance on workarounds for caveats found in:
nVidia Shield Experience Upgrade 9.0.0 with Android 11
Scoped storage for instance.
New Google TV launcher
Caution: I'm not responsible if you end up bricking your nVidia Shield Android TV.​
Change default launcher​Launcher alternatives​FLauncher​
https://play.google.com/store/apps/details?id=me.efesser.flauncher
https://gitlab.com/etienn01/flauncher
Example: FLauncher​
Install FLauncher from Google Play store.
Open FLauncher to make sure it works.
Enable ADB over network on the nVidia Shield (developer options).
Connect ADB from a computer with android-tools.
Disable default launcher with following ADB command:
Code:
adb shell pm disable-user --user 0 com.google.android.tvlauncher
Disconnect ADB.
Press "Home" button on the nVidia Shield. This should open FLauncher.
Instructions​
https://techmogulchannel.com/tutori...lt-launcher-to-custom-launcher-windows-guide/
https://www.reddit.com/r/AndroidTV/comments/o96tun/how_to_install_a_3rdparty_launcher_as_default_on/
Set scoped storage permissions​Example: Solid File Explorer​
Markdown (GitHub flavored):
### Example session with nVidia Shield Android TV
#### Start ADB server
adb start-server
#### Connect (approve request on the Shield)
adb connect 192.168.86.36:5555
#### Solid Explorer
adb shell cmd appops get --uid pl.solidexplorer2
adb shell cmd appops set --uid pl.solidexplorer2 android:MANAGE_EXTERNAL_STORAGE allow
adb shell cmd appops set --uid pl.solidexplorer2 android:REQUEST_INSTALL_PACKAGES allow
#### Disconnect
adb disconnect
#### Turn off ADB server
adb kill-server
Instructions​
https://www.codetd.com/en/article/10481938
https://forum.xda-developers.com/t/...adb-on-note-10-updated-to-android-11.4221617/
https://developer.android.com/train...es#enable-manage-external-storage-for-testing
https://www.reddit.com/r/androiddev/comments/mscu80/as_a_user_is_it_possible_for_me_to_grant_an_old/
Roll back to 8.2.3​Download​
https://developer.nvidia.com/gameworksdownload#?search=recovery os image
Instructions​
https://developer.download.nvidia.c...ar/howtoflash/How-To-Flash-Recovery-Image.txt
https://docs.nvidia.com/gameworks/content/devices/shield_flashing_from_image.htm
https://forum.xda-developers.com/t/3321404/
https://forum.xda-developers.com/t/4392605/#post-86397133 by @perieanuo.
Other related guides by me​
Ready made Leanback Icons and Shortcuts for "regular" Android Apps
[Tool][Windows][PowerShell] Android Platform Tools Updater (ADB & Fastboot)
Click to expand...
Click to collapse
Do you need to be rooted to Set Scoped Storage permissions or install an alternative launcher?
Is there a guide for rooting the Nvidia Shield 2017 using linux?
Thanks.
bdika

Easiest Way To Root Android 11 on Surface Duo

first off, huge shout out to @JengaMasterG for TWRP for these devices. Without him, this super simple method wouldn't be possible.
What You'll Need
- Android 11 most recent update
- TWRP: TWRP for Surface Duo (credits to @JengaMasterG )
- Unlocked Bootloader
- ADB/Fastboot: ADB/Fastboot Install (what i use)
- Magisk
video
YT Tutorial
Bootloader Unlock
1.) Enable Developer Options via tapping Build Number over and over in the About Device part of settings
2.) Enable USB Debugging and OEM Unlock
3.) Plug device into the computer, and type the following command in cmd.exe, hit enter
Code:
adb devices
4.) You may get a pop up on screen requesting permission, always allow it
5.) Type the following and hit enter
Code:
adb reboot bootloader
6.) Once in the bootloader, your device might not be recognized right away and will need the driver manually installed via Device manager (see video for that)
7.) Once device is recognized, type the following command
Code:
fastboot flashing unlock
8.) Allow the unlocking of the Bootloader on device screen. this will erase everything
9.) Allow the device to fully boot up, enable USB Debugging again and continue the tutorial!
Instructions
1.) Rename Magisk-vxx.x.apk to Magisk.zip
2.) Enable USB Debugging
3.) Type the following to make sure your computer sees the device (in cmd.exe)
Code:
adb devices
4.) You may get a pop up on your device's screen asking for adb permission, check the always allow and hit ok
5.) Type the follow command to reboot to bootloader (in cmd.exe)
Code:
adb reboot bootloader
6.) Once you're in the booloader and its unlocked, download the TWRP image from above
7.) Use the following fastboot command to boot into TWRP
Code:
fastboot boot twrp.img
8.) Once TWRP boots, keep your device plugged in via usb and type the following command into cmd.exe and hit enter
Code:
adb shell twrp sideload
9.) Once in sideload, you can type the following with magisk.zip and root your device!
Code:
adb sideload magisk.zip
10.) Use the following command to reboot and you're done!
Code:
adb reboot
congrats! you're rooted!

LETS GOOOO!! HEROOO!! Super easy and working on the latest December 2022 update! Felt way safer as well, not so much concern over twrp as we only booted into it, and then I just used the standard magisk and it worked excellent without worrying about all types of patches and versions aside from the latest twrp for android 12 from @JengaMasterG!
Thank you! I think the renaming the magisk file from apk to zip was probably what I was doing wrong trying to follow the other methods, on top of driver errors, that were solved by uninstalling all the drivers for the duo on my surface pro, which revealed a native 'Surface Fastboot' driver. Combine that with the 15 second ADB and it's .bat ready to go command line interface, idk... it wen't so smooth and worked perfectly.
Now I can try to see if I can improve my experience with some go to methods.. I really want to enable immersive mode and hopefully increase overall volume, if possible (many devices this can be done with engineeringmode, idk yet but hopefully it does have one and hopefully I can also calibrate the gyroscope)... obviously adblock without vpn is on the menu.... can utilize the full autoruns app to stop apps from starting up at boot like in windows... and then get into some other customizations.

cqqx2 said:
LETS GOOOO!! HEROOO!! Super easy and working on the latest December 2022 update! Felt way safer as well, not so much concern over twrp as we only booted into it, and then I just used the standard magisk and it worked excellent without worrying about all types of patches and versions aside from the latest twrp for android 12 from @JengaMasterG!
Thank you! I think the renaming the magisk file from apk to zip was probably what I was doing wrong trying to follow the other methods, on top of driver errors, that were solved by uninstalling all the drivers for the duo on my surface pro, which revealed a native 'Surface Fastboot' driver. Combine that with the 15 second ADB and it's .bat ready to go command line interface, idk... it wen't so smooth and worked perfectly.
Now I can try to see if I can improve my experience with some go to methods.. I really want to enable immersive mode and hopefully increase overall volume, if possible (many devices this can be done with engineeringmode, idk yet but hopefully it does have one and hopefully I can also calibrate the gyroscope)... obviously adblock without vpn is on the menu.... can utilize the full autoruns app to stop apps from starting up at boot like in windows... and then get into some other customizations.
Click to expand...
Click to collapse
Hello! I'm rooted, but I can only read and can't write. I am Android version 122022.821.13 of Att.
So I can't delete the apk inside the system directory

linlin2az said:
Hello! I'm rooted, but I can only read and can't write. I am Android version 122022.821.13 of Att.
So I can't delete the apk inside the system directory
Click to expand...
Click to collapse
Newer Android versions, especially stock ROM, generally doesn't let you write to the system partition. Only ROMs can do that, unless you can find a way to change the partition permissions. Root alone will not allow it, no matter what you do. I used to know of a TWRP script to fix that and make the system writable, but it doesn't work on andorid 11/12/13 anyway

How To Guide How to root Google Pixel Watch using Magisk

Google Pixel Watch Root Guide using Magisk​
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Readme​Note that this rooting process was performed with a special USB-C cradle provided by the Google Team. I would not recommend flashing the device without a stable connection to the pins under the wrist strap. I might attempt to make a 3D printed enclosure that uses pogo pins. Additionally, this process will wipe the device.
Rooting Process​
Enable developer options on the watch by going to Settings > System > About > Versions > Tap Build number until you unlock developer mode
While here, note down the Build Number. It will look like RWD9.XXXXXX.XXX.XX.
Go into Developer options and enable ADB debugging
Install the latest version of ADB and Fastboot tools on a computer
https://developer.android.com/tools/releases/platform-tools
Connect watch to computer using USB and allow permanent ADB debugging access on the watch
Verify your access works by running
Code:
adb devices
Download the appropriate (LTE or Bluetooth/WIFI) firmware at the link below, making sure to download the version that matches the build number from Step 2.
Factory Images for Google Pixel Watch Devices | Google Play services | Google for Developers
developers.google.com
Verify the checksum of downloaded firmware using
Code:
sha256sum name-of-firmware.zip
Unzip the downloaded zip, then unzip the image-rXX zip inside the original zip. Then, transfer the boot.img file to the watch using
Code:
adb push boot.img /sdcard/Download
Install a file manager on the watch because it does not include one by default. We will need it to select the boot.img file the Magisk app. I used File Manager TV USB OTG Cloud from the Play Store. I recommend launching the app and granting Files and media permissions all the time like it asks you to do in the popup.
Install the latest version of the Magisk APK from the Github link below on the watch by running
Code:
adb install name-of-magisk.apk
Releases · topjohnwu/Magisk
The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.
github.com
Launch the Magisk app, click Install, choose Select and Patch a File, then browse to the downloaded boot.img file
Click Let's Go and the magisk-patched boot image will be created in the Download folder
Transfer the image back to your computer using
Code:
adb pull /sdcard/Download/name-of-patched-image
Run
Code:
adb reboot bootloader
to reboot the watch into Fastboot
Verify the device shows up by using
Code:
fastboot devices
Unlock the bootloader of the watch using
Code:
fastboot flashing unlock
Confirm the message on the watch to unlock and wipe the device
Flash and boot the newly created Magisk image using
Code:
adb flash boot name-of-patched-image.img
Select Start in Fastboot to start the watch
After waiting an extremely long time, the watch will hopefully start and will need to be setup again
Reinstall the Magisk app using
Code:
adb install name-of-magisk.apk
Launch the app and it might prompt that it needs to restart the watch
To prevent the broken Superuser request popup where the grant button is off the screen, I recommend changing the Automatic Response prompt setting in the Magisk app to Grant. To change the option, swipe up on the Prompt text
With the watch started and setup, start an adb shell by running
Code:
adb shell
Then, run su to escalate to root privilege. The shell should change symbols from $ to # and running
Code:
whoami
should result in root
Bypassing SafetyNet​
Download the YASNAC - SafetyNet Checker APK from GitHub:
Releases · RikkaW/YASNAC
Yet Another SafetyNet Attestation Checker. Contribute to RikkaW/YASNAC development by creating an account on GitHub.
github.com
Install it on the watch using
Code:
adb install name-of-yasnac.apk
(Optional) Open the app and run the SafetyNet Attestation to verify your device fails
Download the SafetyNet Fix Magisk module from GitHub:
Releases · kdrag0n/safetynet-fix
Google SafetyNet attestation workarounds for Magisk - kdrag0n/safetynet-fix
github.com
Transfer it to watch using
Code:
adb push safetynet-fix-v2.4.0.zip /sdcard/Download
Start an adb shell with the watch using
Code:
adb shell
Elevate to root privileges with
Code:
su
Install the module with
Code:
magisk --install-module /sdcard/Download/safetynet-fix-v2.4.0.zip
Once installed, restart your watch
Now, run YASNAC SafetyNet Attestation again, and you should pass!
Interfacing with the USB Pins​The USB pins are under the watch band closest to the secondary button. From left to right, the pins are voltage, data+, data-, and ground. Google's VRP program provides the watch cradles by invitation only (still waiting for mine ). As such, a DIY solution needs to be created to make this process more accessible.
Picture courtesy of @ShinyQuagsire​The most reliable solution I can think of currently is using PCBite SP10 probes to connect to the USB pins. Once I get my PCBite, I will post a setup picture.
Another solution I'm going to try is inserting pogo pins into a replacement silicone watch band to connect to the USB pins.
Similarly, the pins have a 1.27mm spacing which you can find headers for online. That in combination with some helping hands could give a somewhat janky connection.
Troubleshooting​
If booting the Magisk image results in a bootloop, you can unbrick the device by flashing the corresponding stock boot.img image using
Code:
adb flash boot boot.image
If Magisk doesn't see the file, try doing the following to your file browser app:
Settings > Apps & Notifications > App permissions > Files and media > AppName > Allow all the time
Tips​
You can get into FastBoot mode by tapping on the top left and bottom right of the screen at the same time as the device is booting when the white "G" logo appears.
Wireless debugging allows you to do almost all of this guide except booting the patched boot.img file in Magisk. To enable wireless debugging, go to Settings > Developer options > Check Debug over Wi-Fi. Then, in developer options still, go to Wireless debugging and turn it on. From here, you can connect to your watch remotely from your PC using
Code:
adb connect watchip
Thanks​Huge thanks to Asmita Jha (Twitter @aj_0x00) who was there during the first 2 days of the rooting attempts and helped troubleshoot throughout. Additionally, big thanks to Stack Smashing (Twitter @ghidraninja) for giving us the idea to patch the Magisk file on the watch itself, instead of patching the boot image on another device running Magisk. Additionally, thanks to the Google team who gave us access to device and the prototype cradles to interface with the watch reliably.
Future Plans​To make the process more accessible, a cheap interfacing solution needs to be created. Please reach out if have any questions, concerns, or information that would make the process easier. You can find me on Twitter @breaddisease
https://twitter.com/breaddisease
Thanks!

This is awesome!
Now we just need a way to source that craddle or design one.

Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?

KineSight said:
Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?
Click to expand...
Click to collapse
I'm unsure about this so far! Both of my phones don't work with the Google Pixel Watch app (degoogled OP7P and old S8+) so I can't setup my Google account with the watch to use Google Wallet. Additionally, I can't install a SafetyNet checker without the USB cradle I'll get back to you if I figure something out!

How did you get the file manager to show the .img file? I installed the same file manager, pushed the file via adb, but the file manager can't see any .img files. I tried renaming it to 'boot.jpg', pushed that, the file manager sees it, but then Magisk fails with unknown/unsupported image type.

ClarkIV said:
How did you get the file manager to show the .img file? I installed the same file manager, pushed the file via adb, but the file manager can't see any .img files. I tried renaming it to 'boot.jpg', pushed that, the file manager sees it, but then Magisk fails with unknown/unsupported image type.
Click to expand...
Click to collapse
You might need to allow the app Files and media permissions all the time, like this:
Settings > Apps & Notifications > App permissions > Files and media > AnExplorer > Allow all the time

KineSight said:
Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?
Click to expand...
Click to collapse
I fail SafetyNet without the Universal SafetyNet Fix Magisk Module. However, I was able to install the SafetyNet Fix module with the following:
Code:
adb push safetynet-fix-v2.4.0.zip /sdcard/Download
adb shell
su
cd /sdcard/Download
magisk --install-module safetynet-fix-v2.4.0.zip
With this, I now pass SafetyNet! Still have to try Google Pay

breaddisease said:
Google Pixel Watch Root Guide using Magisk​
Readme​Note that this rooting process was performed with a special USB-C cradle provided by the Google Team. I would not recommend flashing the device without a stable connection to the pins under the wrist strap. I might attempt to make a 3D printed enclosure that uses pogo pins. Additionally, this process will wipe the device.
Rooting Process​
Enable developer options on the watch by going to Settings > System > About > Versions > Tap Build number until you unlock developer mode
Go into Developer options and enable ADB debugging
Install the latest version of ADB and Fastboot tools on a computer
Connect watch to computer using USB and allow permanent ADB debugging access on the watch
Verify your access works by running
Code:
adb devices
Download the latest version of the appropriate (LTE or Bluetooth/WIFI) Google Pixel Watch OTA firmware at the link below. Note that the latest version is at the bottom of the list (thanks Google)
https://developers.google.com/android/ota-watch
Verify the checksum of downloaded firmware using
Code:
sha256sum name-of-firmware.zip
Unzip the downloaded zip, then transfer the boot.img file to the watch using
Code:
adb push boot.img /sdcard/Download
Install a file manager on the watch because it does not include one by default. We will need it to select the boot.img file the Magisk app. I used File Manager TV USB OTG Cloud from the Play Store
Install the latest version of the Magisk APK from the Github link below on the watch by running
Code:
adb install name-of-magisk.apk
Releases · topjohnwu/Magisk
The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.
github.com
Launch the Magisk app, click Install, choose Select and Patch a File, then browse to the downloaded boot.img file
Click Let's Go and the magisk-patched boot image will be created in the Download folder
Transfer the image back to your computer using
Code:
adb pull /sdcard/Download/name-of-patched-image
Run
Code:
adb reboot bootloader
to reboot the watch into Fastboot
Verify the device shows up by using
Code:
fastboot devices
Unlock the bootloader of the watch using
Code:
fastboot flashing unlock
View attachment 5925307
Confirm the message on the watch to unlock and wipe the device
Flash and boot the newly created Magisk image using
Code:
adb flash boot name-of-patched-image.img
Select Start in Fastboot to start the watch
After waiting an extremely long time, the watch will hopefully start and will need to be setup again
Reinstall the Magisk app using
Code:
adb install name-of-magisk.apk
Launch the app and it might prompt that it needs to restart the watch
With the watch started and setup, start an adb shell by running
Code:
adb shell
Then, run su to escalate to root privilege. The shell should change symbols from $ to # and running
Code:
whoami
should result in root
View attachment 5925313​Bypassing SafetyNet​
Download the YASNAC - SafetyNet Checker APK from GitHub:
Releases · RikkaW/YASNAC
Yet Another SafetyNet Attestation Checker. Contribute to RikkaW/YASNAC development by creating an account on GitHub.
github.com
Install it on the watch using
Code:
adb install name-of-yasnac.apk
(Optional) Open the app and run the SafetyNet Attestation to verify your device fails
Download the SafetyNet Fix Magisk module from GitHub:
Releases · kdrag0n/safetynet-fix
Google SafetyNet attestation workarounds for Magisk - kdrag0n/safetynet-fix
github.com
Transfer it to watch using
Code:
adb push safetynet-fix-v2.4.0.zip /sdcard/Download
Start an adb shell with the watch using
Code:
adb shell
Elevate to root privileges with
Code:
su
Install the module with
Code:
magisk --install-module /sdcard/Download/safetynet-fix-v2.4.0.zip
Once installed, restart your watch
Now, run YASNAC SafetyNet Attestation again, and you should pass!
Troubleshooting/Tips​
If booting the Magisk image results in a bootloop, you can unbrick the device by flashing the corresponding stock boot.img image using
Code:
adb flash boot boot.image
Additionally, you can get into FastBoot mode by tapping on the top left and bottom right of the screen at the same time as the device is booting and the white "G" logo appears.
If Magisk doesn't see the file, try doing the following to your file browser app:
Settings > Apps & Notifications > App permissions > Files and media > AppName > Allow all the time
Wireless debugging allows you to do almost all of this guide except booting the patched boot.img file in Magisk. To enable wireless debugging, go to Settings > Developer options > Check Debug over Wi-Fi. Then, in developer options still, go to Wireless debugging and turn it on. From here, you can connect to your watch remotely from your PC using
Code:
adb connect watchip
Thanks​Huge thanks to Asmita Jha (Twitter @aj_0x00) who was there during the first 2 days of the rooting attempts and helped troubleshoot throughout. Additionally, big thanks to Stack Smashing (Twitter @ghidraninja) for giving us the idea to patch the Magisk file on the watch itself, instead of patching the boot image on another device running Magisk. Additionally, this wouldn't be possible without the help of the Google team who gave us access to device and the prototype cradles to interface with the watch reliably. Huge thanks to everyone running Hardwear.io this year where this method was discovered during the Hardpwn hardware hacking contest.
Future Plans​To make the process more accessable, a cheap interfacing solution needs to be created. My idea is to 3D print an enclosure and use pogo pins. Please reach out if have any questions, concerns, or information that would make the process easier. You can find me on Twitter @breaddisease
https://twitter.com/breaddisease
Thanks!
Click to expand...
Click to collapse
Cool

breaddisease said:
You might need to allow the app Files and media permissions all the time, like this:
Settings > Apps & Notifications > App permissions > Files and media > AnExplorer > Allow all the time
Click to expand...
Click to collapse
Thanks! That was it. Now the computer just refuses to recognize it as a fastboot device. It recognizes it with the watch fully on, so I know my wiring and pins are correct.

ClarkIV said:
Thanks! That was it. Now the computer just refuses to recognize it as a fastboot device. It recognizes it with the watch fully on, so I know my wiring and pins are correct.
Click to expand...
Click to collapse
Nice, good to hear! What's the output of
Code:
sudo fastboot devices
Or, if you're on Windows, an elevated terminal with
Code:
fastboot devices

Y'all realize that we already managed to root the watch a long time ago? https://forum.xda-developers.com/t/pixel-watch-successfully-bootloader-unlocked.4508253/
A lot of questions are also answered there.

Yes, it breaks safetynet. You can install this magisk module to get it back.
KineSight said:
Does Rooting it break the Google Pay functionality or SafetyNet (if it has one) ?
Click to expand...
Click to collapse

Tiebe said:
Y'all realize that we already managed to root the watch a long time ago? https://forum.xda-developers.com/t/pixel-watch-successfully-bootloader-unlocked.4508253/
A lot of questions are also answered there.
Click to expand...
Click to collapse
I was not aware that it had been done already! Thanks for the info! I thought I was the first

breaddisease said:
I was not aware that it had been done already! Thanks for the info! I thought I was the first
Click to expand...
Click to collapse
Sadly, no.
Another small thing: You shouldn't download the OTA zip, but the factory images. The OTA zip doesn't always have full boot image, and only a patch image (boot.img.p), which is used in the updating process for patching the current boot image to the newer version. The factory images always have a full boot image.
Other than that: great guide!

Tiebe said:
Sadly, no.
Another small thing: You shouldn't download the OTA zip, but the factory images. The OTA zip doesn't always have full boot image, and only a patch image (boot.img.p), which is used in the updating process for patching the current boot image to the newer version. The factory images always have a full boot image.
Other than that: great guide!
Click to expand...
Click to collapse
Ok, thanks! I updated step 6 and 8 accordingly.
Would it be an issue if someone flashed an un-updated watch with the latest boot.img? Like should I recommend flashing the appropriate version's boot.img, or updating to the latest version before flashing the latest boot.img? Thanks!

breaddisease said:
Ok, thanks! I updated step 6 and 8 accordingly.
Would it be an issue if someone flashed an un-updated watch with the latest boot.img? Like should I recommend flashing the appropriate version's boot.img, or updating to the latest version before flashing the latest boot.img? Thanks!
Click to expand...
Click to collapse
Always flash the boot.img of the version that you're currently on. Happy to help!

@breaddisease
I've also noticed that the safetynet module patched by Displax seems to work better in most cases than the original one by kdrag0n. The one by Displax is just a fork of the one by kdrag0n, with some changes.

breaddisease said:
Nice, good to hear! What's the output of
Code:
sudo fastboot devices
Or, if you're on Windows, an elevated terminal with
Code:
fastboot devices
Click to expand...
Click to collapse
I'm on Linux and 'sudo fastboot devices' didn't list any device. I can communicate via ADB over USB so I know the cable is working. In fastboot mode, the device doesn't show up under 'lsusb' either. I have tried USB 2 and 3 ports.

ClarkIV said:
I'm on Linux and 'sudo fastboot devices' didn't list any device. I can communicate via ADB over USB so I know the cable is working. In fastboot mode, the device doesn't show up under 'lsusb' either. I have tried USB 2 and 3 ports.
Click to expand...
Click to collapse
Are you providing it power through the left pin? Maybe its required for fastboot

breaddisease said:
Are you providing it power through the left pin? Maybe its required for fastboot
Click to expand...
Click to collapse
Yes, I am powering it. Verified by the watch showing its charging when fully booted. Were you on Linux or Windows for this? If Linux what Distro?