yashsingh1/xdaforums huggingface dataset:
[Google Pixel 8 Pro] demonjrules:
not sure if that is the case but I am just saying that is what worked for me, and yes I do admit that it is strange that it is the exact opposite of the Reddit commenter. All the messages that were missing from my XML file were set to a value of 1 while the items that did show up were set to -1. So take a look at your XML and find a known message that is missing from your restore and change it to the opposite of what the sub_id is currently.

I have a Pixel 8 pro to answer your question. Before I saw your comment, I originally did a full backup/restore from my Pixel 3A (over 200k+ messages) and it took over a day to restore so I was pretty upset seeing a lot of SMS/MMS missing. So what I did was make a backup of just 1 thread (77 messages) on the Pixel 3A, copied the XML to my computer, changed the sub_ids, copied the new XML to the Pixel 8 pro, and restored that and I saw the messages that I confirmed were missing from the previous full restore.

Edit:

I don't know how I did not notice this comment before but this person also had success by changing the value to -1

https://www.reddit.com/r/android_beta/comments/15mzaij/_/k50nw2n
[Google Pixel 8 Pro] Paz9:
a backup of my current messages that the sub_id is 1

i cant view my other xml files until im on my PC (file too large) but im going to suspect they are -1

another person in the thread just stated changing his to -1 worked?

it doesnt seem consistent...
[Google Pixel 8 Pro] Paz9:
Fields in XML backup files – SyncTech

www.synctech.com.au

sub_id - Optional field that has the id of the phone subscription (SIM). These are values like 0, 1, 2 etc. based on how the phone assigns the index to the sim being used.

sounds like if you have multiple sims you may need to use a different number?

what happens if this field is missing?

i think best thing to do would be run a recent backup of new messages

go into the XML > look at the sub_id number and that is the number you should use to replace the old backups with.
[Google Pixel 8 Pro] Paz9:
SMS Backup & Restore Fix:

Step 1. Run a new backup

Step 2. open XML file and look for SUB_ID="X" - remember this number

Step 3. open old backup XML file and replace SUB_ID with the aforementioned number found in the recent backup

Step 4. Save and restore old backup

Step 5. ???

Step 6. Profit.
[Google Pixel 8 Pro] Paz9:
SMS BR have just replied - hoping to push out an update in the next few days
[Google Pixel 8 Pro] hpower1:
The app got updated here today, so I'll test it out.

Edit: Just tested this on my P6P, all seems to work fine. Using the newest update, v10.20.001, all seemed to restore fine, no need to edit the xml file.
[Google Pixel 8 Pro] demonjrules:
I downloaded the update on the Pixel 3A/8 Pro, did a fresh backup of a single thread on the Pixel 3A, copied it to the Pixel 8 Pro, restored it and everything is there :-) going to do a full backup/restore and then I can finally switch over to my new 8 Pro as my daily driver.

Such a quick turnaround. Thanks to everyone who helped resolve this.
[Google Pixel 8 Pro] Paz9:
New update fixes the issue!
[Google Pixel 8 Pro] Paz9:
FYI - as the fix is supposed to be a temp fix in the latest update, i did still notice some irregularities doing a restore.

so i did the sub_id change and it fixed the issues i was having.

specifically, if i scroll down to the messages, it takes the message app a few seconds to load new messages, clicking into the message thread force closes the message app.

i cleared all data from /data/data/com.google.android.telephony and started from scratch editing the sub_id and it seems to not have anymore issues with force closing.

also, ensure your message app has your phone number in settings, otherwise MMS will restore in a separate thread.
[Google Pixel 8 Pro] Paz9:
has anyone noticed CPU usage of messages app increases after a restore? im not sure if its indexing or whatever, but it seems to stay up there, ive just done another restore and CPU usage (su, top command in terminal) shows it as top application.

Edit: normal behaviour, looks like it indexes in the background and takes time to finish.
[MX Player] ssswww0004:
Is it possible to add file management functions after the local network is connected to the NAS via SMB? The current local network function is too simple. After connecting to the LAN NAS, there is only playback, and other options such as sorting various files, adding playlists, view modes, fields, and advanced options are not available. This is very disadvantageous for playing LAN videos through MX. Now There are more and more home NAS. I hope MX can make the file management function of the local network the same as the local file management. I don’t know if there are any future plans. Other aspects have been done very well. Thank you!
[MX Player] MXPlayer:
Hey! Thank you for taking the time to share your valuable feedback and feature request regarding our local network functionality. We appreciate your thoughtful input, and we completely understand the importance of having comprehensive file management options when connected to a NAS via SMB.

Your suggestion for enhancing our local network features, is indeed an excellent idea. You will be pleased to know that we have shared the same with the relevant team for further review.

We're are also delighted to hear that you've found MX Player to be a great choice for your needs in other aspects. If you have any more ideas or suggestions in the future, please don't hesitate to share them with us. Your insights help us make MX Player better for all our users.

Thank you for being a part of the MX Player community, and we look forward to serving you even better in the future.
[Android Q&A, Help & Troubleshooting] 4pr3ndiz:
Hello Guys, I would like your advice to get started in the world of ROM customization. If this is not the right place for the question, please forgive me.

I tell you the following, I have a smartphone from a few years ago and it no longer receives any updates, and I would like to use it these days but with Android 13, but I can't get updates for it, for this reason I want to get into cooking my own custom ROM.

I have very basic knowledge, all suggestions are welcome.
[Android TV General] plausibledeniability:
EDIT 18 May 2024:​

I'll be leaving the original thread intact below for anyone who needs it. See this comment for more information on rooting the Hisense U6H.​

Original thread title:

Rooting Hisense U6H (UART/U-Boot)​

Original thread body:

Hi friends,

I have UART through the service port of my Hisense U6H Tv. The OS shell runs as the shell user but I can interrupt the boot process to get to a U-Boot shell. I am trying to root the tv using Magisk.

It is my understanding that to do this I need to get the boot image. After many attempts I believe I was able to get this image by doing the following:

Get the partitions of the mmc:

Spoiler content hidden.

Get the information for boot_a:

Spoiler content hidden.

Write the boot_a partition to memory address 0x25000000:

Spoiler content hidden.

Start usb conncted in slot 0:

Spoiler content hidden.

Fatwrite the memory to a .img:

Spoiler content hidden.

After dumping the boot image I unlocked the bootloader and flashed the image to both boot_a and boot_b. The tv succesfully started. To me, this indicates that the dumped image is valid. I was also able to flash an empty vbmeta image from the mtkclient github to both vbmeta_a and vbmeta_b and the tv continued to work.

I patched this image with Magisk on the tv and flashed it to boot_a and boot_b with fastboot, but the tv gets stuck at the unlocked bootloader warning screen. I tried again and flashed vbmeta_a and vbmeta_b with the empty version which did not fix it. Both attempts required recovering from a usb. Is the problem the dump? Is there a way to verify it beyond flashing it and seeing that it did work? Do you have any other ideas? Thank you :)

I also have some extra info that you might find relevant / interesting:

Spoiler content hidden.
[Android TV General] Functioner:
Does u-boot give any verbose output during the boot process that might show why booting with the modified boot image is failing?

Have you unpacked the boot image to check the kernel? Post a copy of the boot image if you can.

It could be that avb or other checking is still done even if the bootloader is "unlocked" using the set_device_state command. If there is verbose output during bootup, perhaps the failure could be seen.

Perhaps try just loading the patched image into ram and do bootm to boot it without flashing the modified image.
[Android TV General] Renate:
Depending how the boot is packed you can make a trivial mod like the spelling of a message or something.

If that boots then you know it's not vbmeta or AVB0.

There's still FEC, but I've not seen that on a boot image.
[Android TV General] plausibledeniability:
Thank you both for taking the time to share your thoughts.

Here is the section of the log leading up to the crash with empty vbmeta + magisk patched boot image:

Spoiler content hidden.

ALT: https://paste.ee/p/zJHrD

From what I can tell this doesn't much differ from a successful boot with just vbmeta flashed:

Spoiler content hidden.

ALT: https://paste.ee/p/O6yvz

The line `Bad Signature on 0:57: expected 0x5840, got 0x0000` which appears in the output is interesting. The output of `mmc part` (in original post) displays partitions 0-56, but there is no partition 57 listed. It also appears as part of the output of `mmcbininfo`:

Spoiler content hidden.

I unpacked the boot.img and have the files - is there something specific I should do / look at? Here is the terminal output of unpacking with osm0sis/mkbootimg:

Spoiler content hidden.

I'm afraid I'm not very familiar with android, u-boot, or uart so apologies if I am missing something obvious, but I don't see anything specific in the logs for the patched image. Here are some logs from different boots for comparison:

Stock boot - https://paste.ee/p/TLuDI

Unlocked bootloader - https://paste.ee/p/fG2xY

Fastboot flashed the dumped boot image - https://paste.ee/p/PhJnj

Fastboot flashed the empty vbmeta - https://paste.ee/p/MLGKt

Fastboot flashed the patched image + empty vbmeta - https://paste.ee/p/NxDub

The first 4 boot to the setup screen, only the patched image fails to start.

I'm sure I'm just missing something but at this time I am not even able to get the tv to boot regularly from u-boot. Here is the output of trying to run the stock environment bootcmd `mmc read.p 0x25000000 boot_a 0x1F00000; bootm 0x25000000`:

Spoiler content hidden.

trying to boot the dumped boot image using `fatpartload usb 0:1 0x25000000 boot.img 0 0x1F00000; bootm 0x25000000`:

Spoiler content hidden.

and trying to boot the patched image using `fatpartload usb 0:1 0x25000000 magisk.img 0 0x1F00000; bootm 0x25000000`:

Spoiler content hidden.

Please bear with me as I have never done anything like this before. Any suggestions for what to do / resources on how to do this? What change is required if it is vbmeta or AVB0 getting in the way? If the lightly modified image works, what would the problem with the magisk patched image be?
[Android TV General] Renate:
I see lots of log, but I don't see the boot image.

I see:

avb_footer.c:41: ERROR: Footer magic is incorrect.

So maybe you're erasing or flashing things to boot which aren't the full size of the partition?
[Android TV General] plausibledeniability:
I am hesitant to share the boot image, but here you go. All passwords are my username.

I do not believe the footer magic error is related as that appears even with the stock boot image. I may have the sizes wrong for dumping from u-boot. Is there another way to get them apart from what I presented in the original post?
[Android TV General] Functioner:
The size is probably correct because the end of the boot image has the avb magic in the proper place:

View attachment 6020653

Using a hex editor, you could change one byte of the cmdline strings that are at the very beginning of the boot image. For example, you could change loglevel=1 to loglevel=7

View attachment 6020654

Probably some other preboot commands need to be run prior to executing bootm. Post a log of the env (via printenv).

Taking a quick look at the kernel in the boot image, it may be scrambled, encrypted, or encoded in some way such that it will be decoded properly if you don't modify it, but will be decoded improperly if it is modified. I'm not sure about this though. I just don't recognize that kernel format.
[Android TV General] plausibledeniability:
I made the change from loglevel=1 to loglevel=7 and after flashing with fastboot was met with a more verbose boot!

Here is the output of `printenv` in u-boot:

Spoiler content hidden.
[Android TV General] Renate:
Yeah, that looks all normal:

Header2: 1,660 (0000067c)
Kernel: 19,825,992 (012e8548) 00000800
Ramdisk: 8,849,996 (00870a4c) 012e9000
DTB: 23,359 (00005b3f) 01b5a000
Signature: 704 (000002c0) 01b60000
Padding: 3,796,992 (0039f000) 01b61000

It's just that if your magisk'ed boot image is smaller than 32,505,856 bytes then you retain the old AVB footer which has the wrong offset to the AVB header. I don't know if anything cares.
[Android TV General] Functioner:
Did you take a look at the extracted kernel? It doesn't appear to be in a standard format to me:

View attachment 6020842

My suspicion is that u-boot (bootm) processes the emmc copy of the boot image in memory before booting it, and the magisk patching breaks this.
[Android TV General] Functioner:
This probably means that the unlock works and android verified boot (and/or the bootloader) is not enforcing the integrity of the boot image before booting it. I've never seen avb verification pass with modified cmdline strings in the boot image header.

My guess is that u-boot (bootm) does further processing of the emmc source boot image in ram before booting it, and the magisk patching breaks this, so either the boot doesn't complete or u-boot attempts to boot a garbage result (from processing bad boot image input).

The way I'd approach this is to dump u-boot from ram and disassemble the arm hex in order to look at bootm. This is a lot of work though.

Maybe an easier route would be to see if a modified system partition (extracted from super) would work with the device unlocked and vbmeta patched (not to an empty vbmeta, but patched). Try a hex edit to start. If it works, the uart shell user could be changed to a root user. There is some risk this could mess the device up. I don't have enough experience with this SoC to know the risks.

With the device unlocked, does "fastboot boot boot.img" work to boot the image you dumped?
[Android TV General] Renate:
It's an uncompressed kernel. The start is the vector table.

Moreover, I can extract the kallsyms:

kallsyms kernel /r /d
c0008000 (start)
c0db00e0 kallsyms_addresses [85652]
c0e03b30 kallsyms_relative_base
c0e03b40 kallsyms_num_syms
c0e03b50 kallsyms_names
c0f12b20 kallsyms_markers [335]
c0f13060 kallsyms_token_table
c0f133d0 kallsyms_token_index
c12f0548 (end)
[Android TV General] Functioner:
Great. Maybe the OP can try the magisk patched boot image with the loglevel set to 7 in the boot image header, in order to see if the kernel starts and if the boot failure is after the kernel starts.

If the magisk patched kernel starts properly and proceeds sufficiently far, my theory about additional processing by bootm is probably wrong. With additional loglevel, the failure within the kernel might be easier to see.

Magisk usually keeps the size of the boot image the same, so the avb footer would likely be in the same location, but other avb data might be moved, but the offset is usually patched by magisk to account for this.
[Android TV General] plausibledeniability:
As the boot makes it to the unlocked bootloader warning screen, I think the problem is beyond u-boot. I tested this by setting loglevel=7 for the magisk image to try and get more output. The log of the magisk patched image ends like this:

Spoiler content hidden.

Full log here: https://paste.ee/p/ihqJH

The 'Recovery Boot!!!' section repeats until power is pulled. It looks like the problem might be related to the init process?

I can explore the u-boot option if it comes to it, but it is something I'd rather like to avoid. Generally, how risky is modifying the system partition?

No. The 'boot' command isn't found and fastboot fails with the following output:

Spoiler content hidden.
[Android TV General] Functioner:
Since magiskinit started,

[ 5.724304] magiskinit: open /proc/bootconfig failed with 2: No such file or directory

that means u-boot definitely handed off to the kernel.

What else is going on, I'm not sure. I'll review the full log.
[Android TV General] plausibledeniability:
Stopping here was caused by Magisk. While combing through the usb restore log I saw line 2883:

init: processing action (ro.boot.slot_suffix=*) from (/system/etc/init/update_engine.rc:8)

There is an existing check in magisk for non standard slot_suffix arguments here. I added a condition for "*" and the new patched image made it a bit further. This boot was similar to the magisk boot posted in my previous reply, but ended with:

Spoiler content hidden.

Full log: https://paste.ee/p/gi4JZ

Here are the other logs:

Spoiler content hidden.

@Renate @Functioner Thank you both for helping me get this far! Did either of you have another idea or notice something strange in the logs? If not, I think this may be an issue that needs to be raised with Magisk.
[Android TV General] Functioner:
That code was added to magisk specifically for raven, although it is intended for single slot devices using the "normal" label.

I do remember that when that code was first added to canary, it broke some a/b slot devices. I think those issues have been fixed by now (the current release version), but the last canary before they broke was version 25205.a468fd94, in case you want to try it.

The only other thing I can think of would be trying to use the ramdisk in vendor_boot instead. But your device doesn't seem to use generic kernel image with vendor_boot partitions, unless they are named differently.
[Android TV General] plausibledeniability:
Using the canary had the same result as using the latest. Full log here: https://paste.ee/p/hFkCU

Could you explain this a bit more and why it would be needed?
[Android TV General] jerrydevis:
Hey @plausibledeniability, Can you please send the link of Cable you used to connect to your TV, I am also trying to connect to UART with Serial Port given on my TV but I am confused which cable to buy.
[Android TV General] plausibledeniability:
Sure! I've been using a generic CP2102 usb to ttl like this one on AliExpress. To use the service port on the tv I cut a cable with a 3.5mm jack and connected it to the usb according to this post.
[Android TV General] jerrydevis:
Thanks for the link!

one more question..

Did you get root user in console(uart shell)?
[Android TV General] Taconut:
Hi @plausibledeniability, I'm also trying to patch my boot.img on my U6G, but I can't seem get the U-Boot prompt to show up. I tried sending a continuous stream of Ctrl-Cs, spaces, escapes, etc over the service port, but no matter what, I just end up at the shell. How would I go about interrupting the boot process? Is there a pin I need to short or something during boot?

Also, for jerrydevis and anyone else who's curious about the shell that's accessible over the the UART connection, it's the `shell` user, the same one accessible via `adb shell`, so it won't give you any additional privileges.
[Android TV General] Renate:
The ABL has whatever secret modes and secret triggers built into that the OEM feels like.

It can include whacky things like buttons (number of times pushed, long push), multiple corner touches on the display, etc.

The good news is that the UART usually gives you pretty good feedback.

The bad news is that some of this stuff is tricky.

Often you need to disassemble the code to figure out what it's checking for.

For instance, I figured out by disassembly what an ABL was looking for on UART.

(This does not mean that your device is anything like this.)

It was looking for backspace or direction arrows, but:

// \010 "real" backspace does not work
// \177 rubout works
// \033\133\102 VT-100 right arrow works

To get to recovery, you had to hit this key 100+ times (but only after it started counting).

You had to watch the ABL messages and start clicking after it was ready.

You couldn't do this by tapping, you needed a program.

To get to EDL, you had to hit the key 50+ times, but less than 100 times.

I eventually wrote a little program, that monitored the ABL messages for the right time then injected 60 or 110 keys.

This program won't do you any good as it was looking for particular messages and your device probably doesn't react the same.
[Android TV General] Taconut:
Thanks for taking the time to respond! Is there a way to get ahold of the bootloader image? I don't have direct access to /dev/block/mmcblk* from the user shell and I'm not sure how else I'd go about getting it. As far as disassembly goes, I can't imagine this would be the hardest thing in the world to disassemble given the amount of logs and source code available, so I'd like to give it a shot.

Also, interestingly, when sending the key codes you mentioned, I was able to get to some other prompt. The prompt looked like "<< MTK >>" and it had a minimal set of commands like "update" "boot" and "debug" as well as a command to show a logo on the screen. I wasn't able to reproduce the prompt, but I'm guessing it was that mode where you can flash a pkg file via usb, so it's probably not that useful.
[Android TV General] Renate:
Usually with a UART you can see it says the reboot reason and give cryptic info to how it's detecting buttons.

Oh, well if this thing is a Mediatek, then it usually shows up in BROM and then preloader when you boot it normally, without even doing anything.

If you are running Windows you can run enumusb /l /v0e8d to see if it has ever been seen.

Get enumusb.exe in my sig, under Windows.

There has to be a specific init service running from int.rc called console if the same UART that came up when booting is going to present an Android shell.
[Android TV General] plausibledeniability:
I hold the enter key while the tv is booting.

I don't believe I've seen a prompt when using the usb recovery feature. If you have any more information about this, I'd love to hear.

Unfortunately I've not yet had success getting the device into BROM or preloader for the Mediatek tools.

It's worth noting that command will also show an output if you've been connected to the device while it is in fastboot.
[Android TV General] Taconut:
Thanks! That worked. Now I'm also stuck at the unlock screen, but at least now I can try stuff.
[Android TV General] Renate:
It shows you the first time that something connected.

With the /v0e8d it will show only Mediatek.

0e8d/0002 is BROM, 0e8d/2000 is preloader, anything else is something else.
[Android TV General] plausibledeniability:
This is good to know, thank you. Fastboot is 0e8d/5000.
[Android TV General] zhuhailiang:
工厂菜单下打开 串口调试 等系统启动完成后 输入1969 可以获得权限 可以操作系统分区的东西
[Android TV General] Renate:
@zhuhailiang we use English here, please do your own translating.
[Android TV General] plausibledeniability:
Thank you to everyone who has helped me get this far - it has been done! I achieved root in the early hours of 13 March 2024:

View attachment 6104282

If you want to learn why Magisk would not work:

Spoiler content hidden.

If you want to take a stab at rooting your device, you have some work to do:

Spoiler content hidden.

I am aware the logs previously posted in this thread are no longer available. The relevant details are largely available in the thread, however, if anyone would like to see the logs I can go about re-uploading.
[Android TV General] Iridule:
This gives me something to try today. Would this process be the same for U6HF...the Amazon version?