03-28-2016, 03:30 AM
(This post was last modified: 03-28-2016, 09:24 AM by Deak Phreak.)
*** Warning ***
Please note that this is at your own risk, and you could potentially damage the unit or end up with a brick of a device.
Although you shouldn't if you backup everything like I suggest in the instructions below
What you will need:
preferably a linux machine, virtual machine, or such.
A micro sd reader or sd reader with micro sd adapter.
A screwdriver to disassemble the innoTV.
Disassemble the innotv (remove 4 bungs at the left hand side with a pushpin or needle) then remove the 4 screws.
Remove the opposite side of the innotv with a long screwdriver through the 4 holes.
You should be able to unclip the two halves, and access the internal micro SD (may need to bend the pcb down slightly as the metal piece catches on the white plastic part). The metal piece also has "open" and "close" arrows printed on it.
Next I'd recommend you backup the sd card, just in case you screw anything up.
On your linux machine, insert the sd into the usb reader (mine showed up as /dev/sdb) and do:
cd ~/Desktop
sudo dd if=/dev/sdb of=innoTVsdBackup.bin
From here, I dropped this file into a hex editor and found the partition table, which looks like this:
mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00006000@0x00004000(kernel),
0x00006000@0x0000a000(boot),0x00010000@0x00010000(recovery),
0x00020000@0x00020000(backup),0x00040000@0x00040000(cache),
0x00002000@0x00080000(kpanic),0x00004000@0x00082000(app),
0x00300000@0x00086000(system),0x00140000@0x00386000(system2),
0x00100000@0x004c6000(data),-@0x005c6000(userdata)
The above is SIZE @ Address, BUT you have to add 0x2000 onto it, as this is how much the bootloader takes up.
So the system partition starts at 0x00088000 (after we add 0x2000) and is 0x00300000 bytes long.
So now we know the position and size we can dump it.
We need to convert the 0x88000 and 0x300000 to decimal (I found out later that linux dd doesn't like hex).
0x88000 = 557056
0x300000 = 3145728
cd ~/Desktop
sudo dd if=/dev/sdb of=innotvsystem.img skip=557056 count=3145728
When this has finished, we can mount the dumped image, and edit the files we want to change.
cd ~/Desktop
mkdir /tmp/system
sudo mount -o loop -t ext4 innotvsystem.img /tmp/system
cd /tmp/system
sudo gedit build.prop
Find the following lines and change
persist.sys.usb.config=mtp
to (and add the debuggable line underneath it like below)
persist.sys.usb.config=mtp,adb
persist.service.debuggable=1
next change the line below from
persist.service.adb.enable=0
to
persist.service.adb.enable=1
save the file and close gedit.
delete the backup file gedit automatically made with:
sudo rm build.prop~
cd ~/Desktop
sudo umount /tmp/system
write back to the SD:
***** IMPORTANT!!!! Do not do this (the mistake I made dd, doesn't support hex) *******
sudo dd if=./Desktop/innotvsystem.img bs=512 obs=512 seek=0x88000 of=/dev/sdb
The above will actually seek to 0 times 88000 which = 0, and overwrites the bootloader!
(Good job I made a backup)
***************************************************************************************
You actually have to use decimal and not hex for seek, so 0x88000 = 557056 so the correct command would be:
sudo dd if=innotvsystem.img bs=512 obs=512 seek=557056 of=/dev/sdb
When completed it should say something like:
3145728+0 records in
3145728+0 records out
1610612736 bytes (1.6 GB) copied, 558.687 s, 2.9 MB/s
Re-Insert the SD card, power up the InnoTV and hopefully if everything was done correctly you should be able to connect with adb to your device.
C:\Users\mick\AppData\Local\Android\sdk\platform-tools>adb shell
root@android:/ # ls
acct
bcm4329_cybertan.hcd
bcm4329_samsung.hcd
bcm4329_usi.hcd
cache
charger
config
....
Mick
Please note that this is at your own risk, and you could potentially damage the unit or end up with a brick of a device.
Although you shouldn't if you backup everything like I suggest in the instructions below
What you will need:
preferably a linux machine, virtual machine, or such.
A micro sd reader or sd reader with micro sd adapter.
A screwdriver to disassemble the innoTV.
Disassemble the innotv (remove 4 bungs at the left hand side with a pushpin or needle) then remove the 4 screws.
Remove the opposite side of the innotv with a long screwdriver through the 4 holes.
You should be able to unclip the two halves, and access the internal micro SD (may need to bend the pcb down slightly as the metal piece catches on the white plastic part). The metal piece also has "open" and "close" arrows printed on it.
Next I'd recommend you backup the sd card, just in case you screw anything up.
On your linux machine, insert the sd into the usb reader (mine showed up as /dev/sdb) and do:
cd ~/Desktop
sudo dd if=/dev/sdb of=innoTVsdBackup.bin
From here, I dropped this file into a hex editor and found the partition table, which looks like this:
mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00006000@0x00004000(kernel),
0x00006000@0x0000a000(boot),0x00010000@0x00010000(recovery),
0x00020000@0x00020000(backup),0x00040000@0x00040000(cache),
0x00002000@0x00080000(kpanic),0x00004000@0x00082000(app),
0x00300000@0x00086000(system),0x00140000@0x00386000(system2),
0x00100000@0x004c6000(data),-@0x005c6000(userdata)
The above is SIZE @ Address, BUT you have to add 0x2000 onto it, as this is how much the bootloader takes up.
So the system partition starts at 0x00088000 (after we add 0x2000) and is 0x00300000 bytes long.
So now we know the position and size we can dump it.
We need to convert the 0x88000 and 0x300000 to decimal (I found out later that linux dd doesn't like hex).
0x88000 = 557056
0x300000 = 3145728
cd ~/Desktop
sudo dd if=/dev/sdb of=innotvsystem.img skip=557056 count=3145728
When this has finished, we can mount the dumped image, and edit the files we want to change.
cd ~/Desktop
mkdir /tmp/system
sudo mount -o loop -t ext4 innotvsystem.img /tmp/system
cd /tmp/system
sudo gedit build.prop
Find the following lines and change
persist.sys.usb.config=mtp
to (and add the debuggable line underneath it like below)
persist.sys.usb.config=mtp,adb
persist.service.debuggable=1
next change the line below from
persist.service.adb.enable=0
to
persist.service.adb.enable=1
save the file and close gedit.
delete the backup file gedit automatically made with:
sudo rm build.prop~
cd ~/Desktop
sudo umount /tmp/system
write back to the SD:
***** IMPORTANT!!!! Do not do this (the mistake I made dd, doesn't support hex) *******
sudo dd if=./Desktop/innotvsystem.img bs=512 obs=512 seek=0x88000 of=/dev/sdb
The above will actually seek to 0 times 88000 which = 0, and overwrites the bootloader!
(Good job I made a backup)
***************************************************************************************
You actually have to use decimal and not hex for seek, so 0x88000 = 557056 so the correct command would be:
sudo dd if=innotvsystem.img bs=512 obs=512 seek=557056 of=/dev/sdb
When completed it should say something like:
3145728+0 records in
3145728+0 records out
1610612736 bytes (1.6 GB) copied, 558.687 s, 2.9 MB/s
Re-Insert the SD card, power up the InnoTV and hopefully if everything was done correctly you should be able to connect with adb to your device.
C:\Users\mick\AppData\Local\Android\sdk\platform-tools>adb shell
root@android:/ # ls
acct
bcm4329_cybertan.hcd
bcm4329_samsung.hcd
bcm4329_usi.hcd
cache
charger
config
....
Mick