yashsingh1/xdaforums huggingface dataset:
[Google TV General] asuhoops8628:
Thank you for the explanation and warning. These devices will not be connected to the web/online and only are to play iptv served thru my xteve server.

Also kudos for patching the file originally for us as well :)

I needed to get root since I have 4 of these devices in one room (sort of setup like a sports bar) and need to get an IR remote working to control the YOC device. They all connect to their own TV, and since 3 of the 4tvs are the same brand, CEC control wont work, and I don't want to have 5 remotes.

Need to figure out how to modify the keymap or remote config files so each responds to its own unique set or IR commands
[Google TV General] asuhoops8628:
So an update on the above - I've successfully gotten a custom IR remote setup working with my new ONN box with the help of an FLIRC.

Has anyone messed with keymaps for this device? 2-3 days of testing and it appears that both the provided white remote AND my FLIRC will only use the "Generic.kl" file in /system/usr/keylayouts, despite having their own properly named within that folder following the Vendor_####_Product_####.kl format.

It's working through modding generic.kl, but any thoughts how to get it working properly where the FLIRC is controlled by its own independent keylayout file?
[Google TV General] dany0808:
I just got my first Onn YOC device, have not test it yet. But I do have other Onn devices and been messing with those.

If you got a YOC and it is in the previous non-locked firmware (SGZ1.221127.063.A1/9885170) or any earlier, I suggest you to try this:

1) Do not try to do ATV initial set up, it will apply OTA before you even get to launcher's menu.

2) Boot to recovery to discover which version is currently on your device, download the same version .zip OTA package to tour PC.

3) Patch boot and vbmeta, of course flash imgs, this will allow you to boot with a modded system partition.

4) Modify the system.img to disable OTA, need to unpack and repack super.img provided in the zip that you downloaded before.

In order to get OTA fully disabled you could try this:

- By hosts file ( I do not really know if it would work)

- By adding build.prop tweaks:

sys.update.disabled=true
otaupdate.service.url=null
ro.setupwizard.network_required=false
ro.setupwizard.require_gmail=0
persist.sys.usb.config=mtp,adb

[This have been tested by me but on other devices]

Of course flash super img

If device is booting ok but it still is trying to update, you can execute adb commands from here.

If device is booting ok and OTA bypass works ok, immediately after completing initial setup double check in settings app that OTA is not downloading, if it is disable WiFi and try again.

If at any stage OTA is downloading and you realize of it, just unplug your device and boot to recovery to do a Factory Reset.
[Google TV General] A.Priori:
does anyone know how to (or if) this one can be rooted?
[Google TV General] Beanicus13:
Do you still have access to this patched vendor boot? I have some devices that are still of a version that can use it (unlocked bootloader).
[Google TV General] A.Priori:
Do you mind explaining how you did this with the file linked? Thanks!
[Google TV General] chopwell20:
Thank you for lovely post.

first day with onn 2023 YOC.

device on: onn/onn_4k_gtv/YOC:12/SGZ1.221127.063.A1/9885170

jumped from FTV4k to this for google tv and android 12 experiance.

rooted with @Dionicio3 magisk patched image listed above for SGZ1.221127.063.A1/9885170. (https://xdaforums.com/t/walmart-onn-google-tv.4586587/post-89431656)

Root working okay.

Downloaded ota is -7f458c58073555f202dda7c4f0cd90b149ef98e1.zip (for unrooting) (https://xdaforums.com/t/walmart-onn-google-tv.4586587/post-88539531)

rooted as guide above thanks to OP.

considering to unroot since few have issues of forced update /ota soft bricking the device.

if vendor_boot.img extracted from aformentioned ota file flashed would unroot it to orignal bootloop-free hopfully.
[Google TV General] FayaTheBitster:
on the gen 2 4k box i found what seems to be an unused usb port if it is ill try sottering one to it to see if it works
[Google TV General] Renate:
Apparently they discovered the UART awhile ago.
[Google TV General] FayaTheBitster:
ah well then we can focus on the 2 newer ones the stick and pro model (pro being the expensive one the stick being the CHEAPEST OVERALL)
[Google TV General] Functioner:
Yes, the thread has a dozen+ posts detailing use of the uart connection to the onn YOC device, both for repair and other functionality. However, all of that only applies to the first couple of bootloader versions. The current bootloader (released around March 2024) eliminated almost all utility of the uart connection for the YOC device, so there isn't much reason to try to use the uart connection on a YOC device that is running the current bootloader. The same also applies to the other two onn google tv devices, the HD stick (XNA) and the 4K Pro (SNA).
[Google TV General] Renate:
Eh, what a bunch of party poopers.

And remember, kids, drilling holes in your devices voids the warranty. :p
[Google TV General] FayaTheBitster:
i was wondering as i thought it was cool but knowing they locked the UART kinda makes me sad by a bit but eh i just use mine for SmartTube and not much else as i just like youtube with no ads my freind has a mi box 4 though whch uses my old psp charger oddly
[Google TV General] strubedo:
OK so I'm thinking about going and getting one of these at Walmart what's the first thing I need to do to check to see if it can be rooted?
[Google TV General] strubedo:
I'm trying to find a good android tv box I can root and install TWRP on does the on 4k box support root I see some people are having issues but some say that it can if not does the Nvidia shield pro support twrp because I know it can be rooted.
[Google TV General] strubedo:
Functioner do you mind contacting me please and thank you.
[Google TV General] BTK19:
It can't be rooted on the new update. I don't think the bootloader can be unlocked if it comes with the update
[Google TV General] strubedo:
OK but if I can get one without the new update it may work right? Can you recommend an android tv box that can be rooted and twrp?
[Google TV General] BTK19:
Yes but if it updates you cant root it so you would have to block updates. I don't know of one that has twrp . the first generation onn box or the Dynalink box if you can get one on eBay have LOS and are rootable
[Google TV General] xixoxix:
as of May 29, 2024, there is still no solution to unlock the bootloder on the latest firmware ?
[Google TV General] tnomtlaw:
Why did Onn do this ???
[Google TV General] Biohead:
I'm another one who's got an unused model... after checking in fastboot it IS on the older firmware.

@Functioner - is the previous rooted FW available privately, so as not to mistakenly release it for updated units?

I've already blocked googleapis.com on my network to block the update. It does however have the side effect on not being able to progress through the initial setup phase.

I was able to unlock the BL in Fastboot, accessing it via the reset button - but now pondering how to get it further...
[Google TV General] p0werpl:
Unlike the Chromecast, these devices don't force-update on first boot. You can connect it and set it up like you normally would, then block android.googleapis.com (it's best to do this via AdAway rather than on the router as the latter might block all Play Store access across devices).

The rootable update is this: https://android.googleapis.com/packages/ota-api/package/7f458c58073555f202dda7c4f0cd90b149ef98e1.zip.
[Google TV General] Zacharybinx34:
Wifi Internet randomly stops working until forced restart.

Many random display connection problems where it loses signal entirely with the receiver/tv until I turn it all off and on again.

This thing is crazy buggy
[Google TV General] BTK19:
There is update on the 2023 version of the box.181mb, Security Patch Level update and minor bug fixes.
[Google TV General] BTK19:
It appears the update breaks adb
[Google TV General] Functioner:
How so?
[Google TV General] BTK19:
If i type in adb devices nothing shows up. adb reboot bootloader gives no devices or emulators connected. adb work's on my dynalink box and my phone so it appears the update broke it on the Onn. Just tried on my 2021 Onn Box and it works there also
[Google TV General] Functioner:
Did you try connecting to adb both with usb and wi-fi?
[Google TV General] BTK19:
Yes i did.
[Google TV General] BTK19:
Nevermind just tried again and its working didn't work the first few times
[Google TV General] treypop:
how do I recover from a soft brick. I'm stuck at the onn. screen after I tried flashing something 😅
[Google TV General] Functioner:
Which partition(s) did you flash? You can flash back the original partition(s) using dnl burn mode (adnl).
[Google TV General] treypop:
vendor_boot I'll do some googling and try to figure out how dnl burn mode works
[Google TV General] ziddey:
guessing you can't get in recovery either by holding the button?
[Google TV General] freddyjuarez:
I'm having the problem where only first time running the command adb devices after installing adb-setup-1.4.3 it works if i do adb devices second time it doesn't work

And yes i have tried both regular CMD and administrator cmd
[Google TV General] sharon999:
Sounds like if some more technical minded person can patch it manually we can use that image.

If you have done this can you make your already magisked image available for everyone?

Or can we use a custom os now like lineage without patching anything ??
[Google TV General] mad4some:
deleted
[Google TV General] the.real.p3y0t3:
Has anyone got serial console working on the 2023 model?
[Google TV General] the.real.p3y0t3:
So I bought one of these units yesterday, tore it apart photographed it then proceeded to brick it in spectacular fashion. Things were looking pretty grim; 98% of all fastboot commands rejected, yadda yadda. adnl saved the day, however. Oddly enough, it wouldnt let me flash back the stock boot.img... I had to use the magisk patched one that I thought bricked it in the first place. Anyhow, what I did was flashed the bootloader from the OTA thats floating around first, then my patched magisk boot after the stock one failed. Commands are (in this order, for me anyways):

adnl oem disk_initial

adnl Partition -P bootloader -F bootloader.img

adnl Partition -P boot_b -F boot.img

adnl reboot

...and she booted right up, like nothing ever happened
[Google TV General] the.real.p3y0t3:
So can we all agree to disagree about the status of the bootloader is on these gen2 boxes... People keep referring to the fastboot flashing unlock\unlock_critical commands as if they unlocked the BL.. This is not true. Those two commands allow you to flash the boot partition - etc. (flashing unlock) and the bootloader partition (flashing unlock_critical). This gives you just enough rope to hang yourself with if, lets say, you didn't tick that OEM Unlocking switch. Which, as many have found out, is greyed out on these new boxes... Making it kinda difficult to unlock the device. With all that said, it still wiped my install like the BL unlock should; it didnt TEL:L ME it was going to... It just did. Anyhow, I believe the prop ro.oem_unlock_supported is what decides whether yiou can slide that unlock switch... Food for thought
[Google TV General] Functioner:
I agree that we disagree.

It is true. When the "fastboot flashing unlock" is executed, the following appears in the uart console:

lock state: 10101000
cb_flashing cmd_parameter: flashing unlock
cb_flashing: unlock
avb2: 1
unlocking device. Erasing userdata partition!
10422272 blocks erased: OK
erased in 136 ms
unlocking device. Erasing metadata partition!
32768 blocks erased: OK
erased in 4 ms
lock_d state: 10100000
*** Warning - ## defenv_reserve ##, using default environment

Saving Environment to STORAGE... OK

The bootloader is unlocked when it will boot modified bootable partitions on the emmc. It will do so after the "fastboot flashing unlock" command is successfully executed.

Yes, the bootloader will erase the userdata partition as part of executing the "fastboot flashing unlock" command. As you say, "like the BL unlock should", so this is expected.

The oem slider in developer options has no effect on this device, it doesn't matter if it is enabled or not, because the bootloader doesn't recognize the status of the setting.
[Google TV General] cynewulff:
TLDR: I was also able to get the bootloader unlocked. Also the UART console for this device can get you into Fastboot reliably if you open the device and solder 3 wires onto the board

I bought the device this morning, thinking it was the older model that had established Lineage OS support ...

Started up the box and turned on the Developer settings and Turned on USB debugging ... found the OEM unlock setting greyed out .. was my first hint that something wasn't right ... but I pressed on

Using adb to reboot to bootloader worked fine ...

fastboot seemed ok .... fastboot flashing unlock and fastboot flashing unlock_critical seemed to work ... but when I flashed the dtb/dtbo/recovery for (what I didn't realize then) was the older model ... the box bricked ... one strange line of garbage on the tv screen ... no adb device ... a fastboot device, but listed as an Amlogic Device and not Fastboot ...

After much fiddling and googling, the found the adnl and adnl_burn_pkg utilities (I run linux) they seemed to be responsive to the box ... think this is called "burn mode"

What I found more helpful was the UART ... pulled the board out of the case, soldered on 3 wires for RX/TX/Gnd and pluged them into my always handy pl2303-based USB to UART dongle (blue casing) ... tried the typical 115200 baud and got garbage ... played with baud rates and finally found that 921600 baud worked and showed UART console output

With the UART working I could start picocom (again linux) and found a message fly by to press any key to interupt boot ... I cycled power and pressed the keys rapidly and it gave me a console with a "s4_ap222#" prompt ... typing help at this prompt gave tons of commands .... I found that typing "fastboot usb 0" would boot the board into fastboot mode ...

Seems like I have a reliable way to get into fastboot mode now whenever I need to from the UART ... even if things are bricked ...

But even then from fastboot I kept flashing the lineage stuff for dopinder and an original factory image for dopinger ... and watching the UART would always see the kernel struggling to boot and/or struggling to find the right device tree (dtb) ... could never get even just recovery started up ... very confusing ...

FINALLY found this thread and the big light-bulb came on that this is a new device! Of course the old kernel wouldn't work right ... of course the dtb/dtbo needed to be correct for this device ...

Basically just sharing all this just in case it helps somebody else out there working on getting this thing up and running ...

Does anybody around here know if anybody is working on getting TWRP/Lineage up and going yet on this device? Does it have a codename? Is there a factory oem set of images anywhere? (boot.img recovery.img dtb.img ... etc etc)

I can test on my setup if that would be helpful ..
[Google TV General] Functioner:
The ota with the firmware is in the second post to this thread, but for some reason it does not include the dtb. If you need the dtb to restore your device, I can pull it from my device if you'd like.

Note that the ota is in payload.bin format, so you'll need to use something to extract it. Like the various python scripts that extract payload.bin.
[Google TV General] cynewulff:
Thanks for the breadcrumb on the python script to break apart the OTA payload.bin, I figured it out and have many of the stock pieces from the extraction.

Still can't get the device to fully boot again however, most likely because I still have some of the wrong stuff flashed to it. Earlier today I had flashed the super.img for dopinder which probably wrecked all kinds of havoc ... the kernel does start, but stops very quickly and purposefully reboots the device to bootloader mode ... which does put me in fastboot mode for what it's worth ...

If you could send me your dtb.img and recovery.img ... maybe I can at least get back to booting into a recovery ...
[Google TV General] Functioner:
I forgot, the 2nd Gen onn device uses efi partitioning, rather than partitioning via a copy of the dtb stored in the reserved partition (dtb is still used later in the boot process before the kernel loads, but not for the aml partitioning).

You can check if your efi got hosed by running this command at the uart prompt:

amlmmc part 1

If no partition table is shown, then you'll need to repair the efi partition table.

It's the same on every device, so it can be restored. I'll pull that if you don't have a partition table shown after executing the above command at the uart prompt.

vendor_boot devices that use generic kernel image don't use a distinct recovery partition.

The recovery image is at an offset within vendor_boot, after the boot image.
[Google TV General] cynewulff:
That command gives a reasonable looking EFI partition setup, tons of partitions ... way too much output to post here ...

I've noticed I have a super partition instead of system in the EFI ... this is probably why fastboot is complaining it can't find a system_a partition when I attempt to flash it? ... my boot output is telling me it is not finding a good hash for system just prior to loading the kernel (which it seems to do anyway) ... probably need to figure out how to reconstruct a super.img file from the pieces ...

(wow this is all so different since when I used to tinker around building JellyBean roms back in the day ...)
[Google TV General] Functioner:
Only adnl needs the slot designation when specifying the partition to flash.

For fastboot flashing, fastboot automatically determines the active slot and appends it. So, when flashing using fastboot, you just specify system rather than system_a. Likewise for the other partitions that use slots.

Of course, all of the dynamic partitions need to be flashed using fastbootd rather than bootloader fastboot. You probably already know this:

fastboot reboot fastboot <- to get to fastbootd to flash all of the dynamic partitions.

fastboot reboot bootloader <- to get back to bootloader fastboot from fastbootd.

There is always the possibility that given all of the stuff that you did earlier, that the active slot got changed. If so, change it back to the original value before you flash anything.
[Google TV General] cynewulff:
Thanks for the reminders on fastbootd and active slots ... unfortunately that is not it ... it won't write a system.img file ... here is what I'm seeing ...

$ fastboot set_active a

Setting current slot to 'a' OKAY [ 0.006s]

Finished. Total time: 0.007s

$ fastboot reboot fastboot

Rebooting into fastboot OKAY [ 0.000s]

< waiting for any device >

Finished. Total time: 16.739s

$ fastboot devices

GUSA2322040405 fastbootd

$ fastboot flash system system.img -S 128M

Sending sparse 'system' 1/5 (131052 KB) OKAY [ 7.031s]

Writing 'system' FAILED (remote: 'No such file or directory')

fastboot: error: Command failed

$ fastboot flash system system.img

Sending sparse 'system' 1/3 (262108 KB) OKAY [ 14.069s]

Writing 'system' FAILED (remote: 'No such file or directory')

fastboot: error: Command failed
[Google TV General] Functioner:
Probably the base dynamic partition structure within the super partition still consists of whatever it is within the super.img that you flashed that was constructed for the prior generation device.

The prior generation device included super_empty_all.img within ota packages, that could be flashed from bootloader fastboot (rather than fastbootd), so that later, when booting to fastbootd, the base dynamic partition names were already established. The 2nd Gen ota packages do not include a super_empty_all image.

There is a tedious process to manually delete/create partitions within super using fastbootd:

https://source.android.com/docs/core/architecture/bootloader/fastbootd

Or, I've sent you a pm with a link to the super.img from my device. You can try to flash that with adnl, or bootloader fastboot, or using dd from the uart console prompt that is present after booting to recovery in permissive mode, or using one of the other utilities that are available from the u-boot shell prompt, such as:

usb_update - Burning a partition with image file in usb host

If none of that works, maybe just exchange the device and start over.
[Google TV General] cynewulff:
Thanks, I've got the file now. Will be out for a bit this morning, then I will tinker around with your recommendations.

I already ordered a Dynalink 4k Android TV (wade) last night ... I'll use that to put together the original setup I had in mind ... however I think I'm keeping this unit to continue learning and tinkering on.
[Google TV General] cynewulff:
Nice, flashing that super file got the device back up and booting to Android TV again. Thanks Functioner!
[Google TV General] cynewulff:
I'd like to be able to fastboot boot (not flash) into a recovery to get adb and adb shell access. I figure a recovery built for s905y4 might be enough? Are there any other devices out there with s905y4 that have recovery built?
[Google TV General] JoKeRzBoX:
If you just want adb (and not the twrp UI), I had success using the twrp for Slingbox android 11 available here:

TWRP временное

TeamWin recovery (TWRP) - модифицированный неофициальный recovery, который выпускается для большинства устройств, работающих под управлением Android.Обладает гораздо более широкими возможностями, чем родной recovery. Создание и восстановление резервной копии прошивки. Для Android 9 1.

slimboxtv.ru

To temporarily boot this recovery:

fastboot boot twrp.img
[Google TV General] cynewulff:
Bingo. Can confirm this works great. Thanks JoKerzBoX.
[Google TV General] mooneydude:
any luck with this?
[Google TV General] SETSAE:
So any update on root for the 23 model ?
[Google TV General] Functioner:
Edit: March 2024

This method is no longer useful on YOC devices

that have been updated to the following version of the firmware:

onn/onn_4k_gtv/YOC:12/SGZ2.230609.049.A1/11261715:user/release-keys

The above firmware includes changes to the bootloader as described here.

Steps to use (assumes that the bootloader is already unlocked):

install magisk 26.1:

adb install Magisk-v26.1.apk

adb reboot bootloader

fastboot flash vendor_boot vendor_boot-magisk_patched-26100.img
[Google TV General] treypop:
So would you suggest flashing the stock vendor_boot partition before an update and flashing back to this one after the update is complete?
[Google TV General] Functioner:
A differential/incremental update will just fail if a partition is modified. It won't hurt anything. If you want the differential update to go through, just restore the modified partition to an unmodified state, and then the next time the update tries to execute, the update will work.

A new update likely will include a new vendor_boot partition. Maybe the old modified one will still work, but best practice would be to modify the new vendor_boot partition that is included in the update. Perhaps by then, some version of magisk will be able to successfully patch the vendor_boot image for this device.