yashsingh1/xdaforums huggingface dataset:
[Shield Tablet General] Mojar7070:
[/COLOR]

Seems like you've figured it out already, but just in case, you needed to mount "system" in Twrp to get the file path seen in the file manager.

Sent from a Locked Bootloader
[Shield Tablet General] Shorty88jr:
It worked before with airplane mode on and I just turned airplane mode off and it still doesn't work. Proof airplane mode is off:https://drive.google.com/file/d/0Bwhcnn8OcgeIMk9JWG1lMnRGRTA/view?usp=sharing
[Shield Tablet General] Greg Bond:
Did not know that. Thank you, was hoping for an explanation and got one! /Greg
[Shield Tablet General] matyas69:
They looking after the TegraOTA.apk for checking if the tablet is good or not.
[Shield Tablet General] seijinzero:
This is scary.

So, I'm another noob who just desperately googled how to stop the kill switch and was brought here. I've read everything, but I'm still confused.

1) So, rooting and removing the ota will keep my tablet safe. Does this mean I can't update the OS anymore? Is this really super guaranteed to work? Like, what if Nvidia decides to tweak their Android to be more like game consoles, where you can't access any marketplaces or certain features if your OS isn't up to date?

2) Is there another layer of protection? Is it possible to change the serial number? Like, clone the new tablet? I would MUCH rather remove OTA and clone to be safe. Would that cause other problems? Does the Google Play store have a problem with it, for example?

3) this might be a stupid question, but is just permanently turning off WiFi an option as a last resort? I have an LTE model with no SIM. Can they still get me OTA somehow that way? Like, does the tablet boot up and *look* for networks or something for a second before deactivating the WiFi and LTE? I bought the tablet for gaming. So I could live with side loading games onto it from now on and treating it like a Nintendo 3DS. Not ideal at all, but is it possible?
[Shield Tablet General] imneveral0ne:
Are you just waiting on them to send you the new tablet?
[Shield Tablet General] Beave2012:
For those worried about nvidia deactivating the new tablet... They can't verify a deactivated tablet because of custom roms from the old tablets. The only verification of you not trashing the old tablet is not physically returning it. Well that is unless they have an app that reports back serial numbers of the device running the app. Either way, everyone is safe until at least the return kits arrive, (US at least). But yes, removal of the Tegra ota will keep you safe anyways.
[Shield Tablet General] P00r:
I highly doubt this story, for one chance are really high that the reason they made the recall app inside the tablet with interaction was to enter some security key, the tablet when shipped do have some partition protected and a key is required, a replacement tablet would not have this feature open..
[Shield Tablet General] Beave2012:
Interesting point. I do remember entering my serial number into the website, getting a new key to enter into the tablet, then sending back yet another key back to Nvidia. This would be nice to know that each tablet has a special key that would allow urgent updates. However, since Nvidia is the manufacturer, if there was a necessary key for this, i would get they have it already or could generate it themselves. Point being, if they need to go to the effort of bricking your new tablet because you refuse to send back the old one, they will make it abundantly clear to you that they require the tablet sent back. They won't risk the PR of bricking tablets out of spite without documented communication.
[Shield Tablet General] seijinzero:
I didn't get the new tablet yet, correct. I completed the process to claim the replacement, but like everyone else here, I'd rather keep the defective tablet for as long as it holds out. Don't charge it unattended and keep it cool. Not really sure of the relevance of this to my questions though. Is there something I'm missing? I'm not activating my replacement until I get the kill switch permanently and reliably disabled on the old one. Will they still try to deactivate my old tablet before I activate the new one?
[Shield Tablet General] An Droid:
This is expected behaviour.

Any time you modify the system partition (add, delete or modify a file in there) it will trigger the Android app optimization.

---------- Post added at 12:34 AM ---------- Previous post was at 12:19 AM ----------

1) You will be able to update to any new OTA, but won't be able to do it automatically any more. You'll have to manually download the full version of any new OTA and flash it through your custom recovery. Of course, a new OTA may introduce a new kill switch technique so you probably wouldn't want to jump into it immediately anyhow. Otherwise, you'd have to at least re-delete the TegraOTA .apk that would be reinstalled. In any case, there are no guarantees when a new OTA is released.

2) A third party custom Rom is likely the best bet.

3) Disabling Wi-Fi or Airplane mode could work, but not a guarantee either. A future OTA could be configured with a built in list of target s/n's (Most Wanted?) that it could reference during install and pull the trigger as it were. It may even be possible to override your Wi-Fi settings and enable Wi-Fi at boot to perform it's task before disabling Wi-Fi again.

---------- Post added at 12:42 AM ---------- Previous post was at 12:34 AM ----------

I think that's exactly what TegraOTA does and how the OTA server can then flag those specific devices for suicide...
[Shield Tablet General] clwilson28:
Fixed Shield Hub app stream login

I had the same issue so what I did was went to settings on shield hub app then went to game stream pc's and then it showed my pc then I hit it and then it gave me a number to add to my home computer now it works like it did before and I just streamed a game for a bit. But doing it the regular log on way doesn't work after applying this nootazip thing. I'm guessing it is the manual way of doing it
[Shield Tablet General] Bogdacutu:
Something happened last night (well, might be day, depending on your timezone). The urgent OTA is currently not getting sent out to any device anymore, not even to those who have been getting it before. Looking at my app's logs, I see that the last check that returned an urgent OTA was at 1:05 AM GMT+3, but after that no checks returned any urgent OTAs anymore.

Not sure what to make of this, but I'm thinking that this reddit post is relevant to the situation, as that guy's tablet seems to match what would happen after the urgent OTA is flashed. If Nvidia has somehow messed up the rollout and managed to hit the wrong tablets, it does makes sense that they are stopping it for now, but I haven't exactly seen a lot of cases like that reddit post.
[Shield Tablet General] clwilson28:
Ok I'm no expert but if I were Nvidia and I was reading our 'secret' posts live for everyone to read I may wanna change my strategy. If this stop the kill switch is actually working they may be changing how or when they kill the tablets. But I do agree that maybe they are hitting the wrong tablets. I can't imagine how large of an undertaking this must be for them. I don't personally think the company is equipped to deal with all this.
[Shield Tablet General] Bogdacutu:
I personally don't think they are going to change strategy; first because they don't exactly have a lot of options in how they do it, and second because we're probably going to tear it apart no matter how they do it :).
[Shield Tablet General] clwilson28:
I hope you are right.
[Shield Tablet General] ajrulez:
I have yet another question for you. Thus far you have been great answering people's questions - from level n00b to level ninja.

The way I understand, or at least imagine, how this whole process works is:

1. User A activates their new tablet. NVIDIA registers their *new* serial number with them and that indicates to them that User A has received their replacement tablet.

2. NVIDIA also has the serial number of User A's original/recalled tablet, thanks to their cool recall process.

3. Periodically - whether it is 2 hours, 2 days, 2 weeks, X time - NVIDIA will iterate through the list of old serial numbers for which the corresponding new serial numbers have been activated. Of course, they'll find User A's original tablet's serial number in this list.

4. Given your investigation so far, NVIDIA will send a kill signal to TegraOTA installed on User A's original tablet and that tablet will receive the kill signal. Kill signal will do its thing, and brick the original tablet.

5. Enter User B - same situation as User A, but User B has has already removed TegraOTA or is running a custom ROM. In this case, User B will never receive a kill signal.

6. NVIDIA will keep sending the kill signal to User B's original tablet periodically. Once N number of attempts fail, NVIDIA may realize that there's something fishy going on with User B (in reality, they will have tens of thousands of such serial numbers that never received a kill signal)

Regardless of how things are being done, they are being done over HTTP(S). Now if someone can figure out what message TegraOTA sends to NVIDIA servers to indicate that it has received the kill signal, then users can send a fake response (pretending to be from TegraOTA) to NVIDIA servers indicating that their original tablet has been killed.

Is it something that'll work? After this user's can probably return to stock with TegraOTA and keep receiving updates if they please.

Is this possible in theory? Just my 2 cents, which may not be worth much anyway.

PS: I know it is easier said than done to decrypt the response that TegraOTA sends to NVIDIA servers, and also with SSL in place it may not be easy to send such a fake response.
[Shield Tablet General] Bogdacutu:
HTTPS is not used (which means that people who can MITM your connection can also force your tablet to install any OTA, which is at least very bad).

TegraOTA does not send any response to Nvidia servers. It checks for updates, downloads the update that it is given and installs it, no communication inbetween (this is somewhat simplified, but for urgent OTAs that's how it works; they also can't know exactly which tablet downloaded the update). And nothing stops them from trying to send it again once you "trust" TegraOTA and let it run freely.
[Shield Tablet General] ajrulez:
Got it :good: Thank you for explaining (and yes, MITM is B.A.D). I assumed TegraOTA sends some response like "Bruh, I killed it".

Cheers, and thanks again for your time/effort for the community.
[Shield Tablet General] wiQbold:
Hi

I looked in your nomoreota.zip

It is only a question.

delete("/system/app/TegraOTA.apk");

did it has to be look like this

delete("/system/app/TegraOTA/TegraOTA.apk");

??
[Shield Tablet General] Bogdacutu:
no, /system/app/TegraOTA.apk is for Android 4.4, I'm also deleting the entire /system/app/TegraOTA folder for 5.0+
[Shield Tablet General] seijinzero:
I have had extremely bad luck with custom roms in the past. I found a few threads that say changing the SN/MAC is possible, but not a lot of feedback or discussion to back it up. Any thoughts? Will having 2 devices with the same ID cause problems? I would think yes, but maybe not if the MAC is unchanged? I didn't see any mention of the kill switch looking for MAC IDs. I do also have a broken tablet. If I manage to clone that one, will apps and marketplaces think my sheild is that old crappy tablet?

Is there any indication when the kill switch is applied? Is it a long timer that starts when the replacement is requested? Or triggered upon activating the new one? If I don't activate the new one, and just keep it in the box as a backup until the defective one finally breaks, is that an option?

I really wish they would just stop this kill switch plan. Instead, give me a disclaimer I have to click away when I boot it up from being powered off. "This tablet has been recalled due to safety hazard. Continue at your own risk."

And final question, can someone please explain how the kill switch works again? I read it from the earlier posts, but it was just a tiny bit too technical for me. The only part I don't get is how it is so permanent. There's no way to reflash it? I never thought such a thing was possible, that they would build a permanent self destruct button into a device. No tool exists to access and restore a device if it's bricked by some virus or file corruption? Sorry to be annoying with all the questions.
[Shield Tablet General] :
The way Bogdacutu explained it, NVidia added a "functionality" in the update software that allows them to silently flash updates on your tablet. The update software periodically checks for updates on the NVidia server and if one is found that is flagged as "urgent" (that happens when your replacement tablet is registered as active once you booted it up) it downloads the OTA update and flashes it silently, which zeroes out parts of your system that are necessary for booting up the tablet.

Given you can't boot it up, you can't flash it so it's permanent, software-wise you could as well be trying to flash a potato. It might be possible by wiring directly on the hardware and manually flashing the chip but I don't know how to do that (and I guess I am not alone :P).
[Shield Tablet General] topcat36:
Makes me think now... Any brand maker could add some kind of code in their firmware that allows a special update to brick the device, let's say.... after the warranty is over, so you are forced to buy a new one. Almost everything is networked today, so....

"And that's the way the cookie crumbles" :D
[Shield Tablet General] Bogdacutu:
it can probably be done that way, but the necessary hardware is more expensive than just getting a brand new tablet

then people will just buy devices from other companies
[Shield Tablet General] j4rp0:
Guys... why would nvidia worry about if we keep both tablets?? They have the obligation of sending a new one because they sold us a defective one, maybe disable the old one if it's potentially dangerous to the user... but disable the new one?? I don't see any sense on that and don't know why Nvidia would want to do that.
[Shield Tablet General] seijinzero:
That's the part I don't get. If you can delete something, why can't you put it back? There's no way to connect it via USB and use some kind of program to write to it? Like, how do they get the firmware on the device in the first place? I highly doubt they write to storage before assembling the unit, right? Nothing in their developer kit or anything?
[Shield Tablet General] Bogdacutu:
Yes, there is nvflash, but using it requires a key that only Nvidia has (and that is unique for each device, and unreadable from the device itself)
[Shield Tablet General] thisisjason:
I was just about to ask if OTA Check was down, but I guess I have my answer. Wow, if they've actually been killing new tablet. Together with people getting replacements still having the Y01 battery, Nvidia really doesn't seem to be handling this recall well if this is true.
[Shield Tablet General] Singularity_iOS:
Does using nandroid (I have never used it in the past, so I don't know) to create a complete copy of the new tablet and install it on the old include the new ones serial? Or not because it's hardwired into the tablet or something? Again, never used nandroid so don't know how this stuff works.
[Shield Tablet General] Bogdacutu:
No, it's hardwired into the tablet
[Shield Tablet General] _Concat_:
I've only rooted and installed a custom ROM once and that was a while ago. I'm a little hazy on everything I need to do. Can someone confirm or help me out?

Step 1: Root device (can I just use latest kingroot apk and then I'm done? Why do people install supersu afterwards? Is it because kingroot installs untrusted apps?)

Step 2: Install CWM (looks like I can this from the CWM ROM Manager apk once rooted?)

Step 3: Reboot into recovery and install nomoreOTA.zip

I need my hand held a little bit on this and just need to know the best way to root my device (5.1.1) and get CWM on there.
[Shield Tablet General] j4rp0:
try this guide:

http://xdaforums.com/shield-tablet/development/root-root-lollipop-t2945044
[Shield Tablet General] Shorty88jr:
Ok I will try that thanks. I am wondering why removing the ota files would mess the login up? Those should not be connected unless they are working on a way to count the number of bricked tablets via the shield hub accounts?

---------- Post added at 05:02 PM ---------- Previous post was at 05:00 PM ----------

I can see the headlines right now kill switch destroys thousands of new tablets. Epic fail by Nvidia if they are killing the wrong ones.
[Shield Tablet General] _Concat_:
Thanks. This route sounds complicated... I don't trust myself not to mess it up. It's also for OTA 2.0 not 3.1

Kingroot, install CWM, flash nomoreOTA sounds so simple... will this not work?
[Shield Tablet General] w0rtez:
Just do this... same as you saying,

1. Root with kingroot. (optional step is to replace it with SU because some ppl dont trust kingroot)

2. Download Flashify from playstore.

3. Flashify your recovery. I did TWRP. You can CWM if you want.

4. Flash NoMoreOTA.zip from recovery. You can also use ESFileExplorer and delete it manually in /System/App/TegraOTA thats what it does.

5. If you want to go futher you can Flash your custom rom like BlissPop, but you need a few steps before you can proceed. You will be safe AFAIK or have read either deleting it manually or flashing NoMoreOTA.zip
[Shield Tablet General] seijinzero:
Thank you! I knew there had to be something. Maybe the next step after this is to find a way to crack that? Patch the part of the program that needs a key? Even with deleting the OTA folder, I still feel like I have a bullseye on my back. It would be nice to know I can fix it if something goes wrong.
[Shield Tablet General] Mojar7070:
It is a bit complicated, but trust me it's the "safest" (things could go wrong if done improperly) and most trusted way to unlock and root the shield tablet. Also, it will come in handy if you ever want to go back to stock.

Sent from my A0001
[Shield Tablet General] Bogdacutu:
unless you can bruteforce AES128 (with known plaintext), it's not happening anytime soon
[Shield Tablet General] MusikMonk:
And if you do manage to do that, you would be able to sell your method to NSA (or your alternative of choice) for so much money that you could buy your pet a couple of SHIELD tablets to play with.
[Shield Tablet General] Frankenscript:
Presumably the old tablets have refurb value to Nvidia. Each one they receive can be reconditioned with new battery etc. Then resold as a refurbished unit. If they clear $100 per device it's easily worth it to them. I assume anyone keeping the tablet when asked to return it is depriving Nvidia of some level of value. They aren't going to chuck the returns into a dumpster!

My expectation is that the first RMA units go out, and a while later they get X% of that number back. Those get refurbed and sent to the next batch of RMA filers.

The program would not be self sustaining because not enough units will come back, but it would offset part of the cost to them.

Marc
[Shield Tablet General] bluegizmo83:
If that were the case, then why wouldn't nvidia ask for ALL the recalled tablets back? Its been verified that most people in other countries outside the USA are not required or even asked to send them back... On top of that, nvidia isn't even sending refurbished tablets to people who participated in the recall. My replacement tablet was a brand new tablet in a sealed retail box with all accessories (wall wart, USB cable, stylus, booklet).
[Shield Tablet General] tecnoworld:
The problem I see in this method is point #2:

'Gain root on previous build via towel root.'

How can this be done considering that the tablet has build v.3.0?
[Shield Tablet General] bluegizmo83:
Using fastboot is by far the easiest way to root... Download twrp-2.8.7.1-shieldtablet.img from here and place the file into the folder where your adb and fastboot files are located: http://xdaforums.com/shield-tablet/development/wip-twrp-2-8-0-1-unofficial-t2877117

1. Boot the tablet into fastboot by powering off, then hold volume down + power

2. Connect to PC with USB cable

3. open command prompt in windows and navigate to you adb/fastboot folder

4. Unlock bootloader - in command prompt type: fastboot oem unlock

5. Flash twrp recovery - in command prompt type: fastboot flash recovery twrp-2.8.7.1-shieldtablet.img

6. Using volume buttons on tablet to navigate, choose recovery and press power button to boot into twrp recover then flash the nomoreota.zip
[Shield Tablet General] Frankenscript:
There are lots of possibilities here. I'm not certain of any of this. I'm just speculating. But I have arranged and managed recalls of equipment in the past, so I'm familiar with the basic equations. It comes down to two things:

1. Liability. Providing a reasonable return path that complies with local laws is a big one. In the US it's legal to return-ship the devices with potentially bad batteries. In some other countries, it's not. In the countries where it's not legal, all they can do is recommend you dispose of it locally. In the US, this doesn't mean they HAVE to collect the old devices, just that they have to make a decent effort.

2. Cost. Once liability is satisfied, they only do what makes the right economic case. In the US and possibly a few other countries, return shipping is legal and not expensive compared to the residual value of the tablet. Let's assume they don't use any of the returned units in the replacement batch. OK, fine. But they still get 10s of thousands of return units from the US. It costs a bit to return it, put a new battery in it, and package with replacement accessories. Including labor I'm guessing $40 per unit, more if the screen needs to be replaced due to scratches. They can then dump these on the market as factory refurbs that would sell for $250-$300. Even factoring in a middle man and distribution, they probably net $75-150 per unit all told. Not bad. Times 20,000-40,000 units... a couple $M. Definitely worth doing.

But keep in mind it's VERY COMMON in "return and replace" scenarios to use the returned units, refurbed, as the units sent out to replace defective products. You start by sending out new units, then use refurbed units to the extent possible, supplementing with new units to make up the volume. Doing it this way, it keeps costs down. And, you don't loose value through a reseller of refurbs... each refurb (let's say $40 cost) eliminates using a higher-cost new unit.

If there's a clear statement from Nvidia that they don't care whether they get them back or not, I'll keep mine (disposing safely of the battery) to play around with. Otherwise I'll send the old unit back after thoroughly wiping it. If they get some value out of it, that's fine by me. I'm pleased that they are taking the issue seriously and sending us non-defective tablets.

Marc
[Shield Tablet General] bluegizmo83:
OK yeah I see your point, that definitely makes sense. :good:
[Shield Tablet General] ferengi4:
Question

I rooted my tablet and I checked every folder and file, but I cant seem to find the TegraOTA application. Does that mean I dont have it or I am missing it somehow?

Also I checked that website link:

Serial number: (Removed just to be safe)

Next OTA: none

Is OTA urgent? unknown
[Shield Tablet General] Mojar7070:
it should be in /system/app. what app are you using to browse the folders?? what root method did you use?? Depending on the root method you use, you may not have the correct permissions to see the folder.
[Shield Tablet General] ferengi4:
I followed someones instructions from a previous post and used Kingroot?, and I checked the app folder with ES file explorer.