ONN 4K Box

2021-08-08T23:25:04Z

Tchebb: Add basic fastboot and rooting info

__FORCETOC__
{{Disclaimer}}
This page will be dedicated to a general overview of descriptions and information related to the ONN 4K streaming box.
[[File:ONN_4K_Box_Stock_Photo.png|200px|left|thumb]]
[[Category:AndroidTV]]

== Getting to fastboot mode ==
There are two implementations of fastboot on this device: one is in U-Boot and is a traditional bootloader fastboot, which can write basic flash partitions like <code>boot</code>, <code>cache</code>, and <code>userdata</code>. The other is in the recovery and is Android's [https://source.android.com/devices/bootloader/fastbootd fastbootd], which additionally knows how to write to Android dynamic partitions like <code>system</code> and <code>vendor</code>.

To enter the bootloader fastboot, you can run <code>adb reboot bootloader</code> while booted into Android. Alternatively, you can enter it directly from power off by connecting the device to a computer over USB while holding the side button and waiting for a USB device with VID:PID <code>1b8e:c003</code> to show up. This device is the bootloader's implementation of Amlogic's proprietary USB download protocol, and you can use it to enter fastboot: first, download or clone [https://github.com/superna9999/pyamlboot pyamlboot], which implements the Amlogic protocol. Then, run <code>./bulkcmd.py fastboot</code> (don't worry if it prints an error), and the device should re-enumerate with USB VID:PID <code>18d1:0d02</code>, which signifies fastboot mode.

To enter fastbootd, you can run <code>adb reboot bootloader</code> while booted into Android. There's also likely a command to boot into this mode from Amlogic download mode, since that mode lets you send arbitrary commands to U-Boot, but my device is not currently in a working enough state for me to find and test that command.

== Rooting ==
It's been reported that patching <code>boot.img</code> with Magisk, following Magisk's standard instructions for that, and reflashing it to the <code>boot</code> partition using fastboot is sufficient to root the device with no loss of functionality.

== aml_autoscript ==
while booting into recovery for any reason, U-Boot will look for USB mass storage devices on the OTG port and, if it finds one, exec a script from its root called aml_autoscript if it finds one and then boot an image called recovery.img if it finds one.

== Tear Down ==
The ONN 4K streaming box is pretty easy to get apart once all the clips holding the case together are undone. In this tear down we used a razor blade but a guitar pick or similar small and durable piece of plastic is recommended.
<gallery>
File:ONN_4K_Top.jpg
File:ONN_4K_Bottom.jpg
File:ONN_4K_Open_Split.jpg
File:ONN_4K_Open_Split_Board_Out.jpg
File:ONN_4K_Board_Top.jpg
File:ONN_4K_Board_Bottom.jpg
File:ONN_4K_Board_Top_EMF_Removed.jpg
File:ONN_4K_Board_Top_EMF_Removed_Cleared.jpg
</gallery>

Exploitee.rs - User contributions [en]

ONN 4K Box