Database Users

[TUTORIAL] How to Manually ROOT your RK3066 Device (UG007, iMitio MX1/2, mk808?)

These are instructions for rooting Android devices that utilize the RK3066 chipset (Cortex A9 Dual Core, MALI Quad-Core GFX).
I have tested and verified that these instructions work for the UG007 Android-on-a-stick...they *should* work with any other devices that utilize the same USB chipset. I can almost guarantee this will work on the Imito MX1/2 as you can swap ROMS from this device.
(Basically, if you have the right ADB drivers, you should be good to go)
As per every other thread you read on this site - I TAKE NO RESPONSIBILITY FOR ANY DAMAGES YOU MAY CAUSE TO YOUR DEVICE.
This is a fairly risk-free mod, but you know...$hit happens.
Okay. Let's start.
THIS TUTORIAL ASSUMES YOU HAVE ADB AND KNOW HOW TO USE IT, and that you're in a Windows environment. There are numerous places on the web where you can find this info...and I ain't yo mamma.
1. Download all the files attached to this thread.
2. Attach your RK3066 device to your computer via it's microUSB port. You'll need to have it hooked to a display too.
3. Once booted, go to system settings. Under settings > developer options, enable USB Debugging. Under settings > USB, click "connect to computer" (This may vary depending on your ROM configuration. The point here is to have debugging enabled and your computer to recognize the stick in device manager as something other than USB storage)
4. Extract the right drivers for your system (x86/x64)
5. Go to device manager on your computer. Look for the new "unknown device". Right-click, pick "update driver software"., "browse my computer".
6. Browse to wherever you extracted the drivers in step 4. Click Next. Confirm that you want to install.
7. Open a command window in the directory where you have ADB. Type "adb devices". Still nothing, right?
8. Navigate to C:\users\MYUSERNAME\.android, where "MYUSERNAME" is your User Name. (Duh?)
9. Create a file called adb_usb.ini
10. Open it in a text editor. Add the following string and save (This tells ADB to look for our Vendor ID:
0x2207
11. You should now be able to type "adb devices" at CMD and see your device.
12. Now for the fun. Extract the stuff from "pushme" to the same directory as ADB.
13. Enter the following commands (note: The "$" and "#" symbols do not get keyed in):
Code:
adb push psneuter /data/local/tmp
adb shell
$ cd /data/local/tmp
$ chmod 777 psneuter
$ ./psneuter
14. Psneuter should run and close shell when done. Enter MOAR commands:
Code:
adb kill-server
adb devices
adb shell
15. Take a good look. Is there now a "#" sign? Good. You now have root access. You may continue. If not, then proceed to go yell at me in the comments. If yes, then proceed to enter the last batch of commands to make your newfound privileges permanent:
Code:
mount -o remount,rw -t rfs /dev/block/st19 /system
exit
adb push busybox /system/bin
adb push su /system/bin
adb install Superuser.apk
adb shell
# chmod 4755 /system/bin/busybox
# chmod 4755 /system/bin/su
# mount -o remount,ro -t rfs /dev/block/st19 /system
# exit
adb reboot
After a reboot, download a root app from Play Store to see if it worked! I find Root Checker is boffo for this sort of thing:
https://play.google.com/store/apps/...tcheck&feature=nav_result#?t=W251bGwsMSwyLDNd
THANKS/CREDITS:
Aaron Orquia @ Pocketables.com for the original "universal" root method.
AMJtech's tutorial where I found working ADB drivers and the adb_usb.ini bit to get it recognized.
The guy(s) who make Super1ClickRoot for putting all the necessary files in one easy-to-find spot.

Thanks for this tutorial.
A couple of notes:
Wow !! That's a lot of extra steps for you Windows users. Mac and Linux users start at step 11 (but if you are a Mac or Linux user, you already knew that. )
Linux: If the device still does not show up in Step 11, post, and I can help (Hint: It may not be /just/ the udev stuff.)
Is step 13 necessary? adb remount works on mine. (not sure if I had to adb root first or not) but I can have a root shell via adb without psnueter.
If adb remount succeeds, skip step 14, and continue with the 3rd line of step 15.

Linuxslate said:
Thanks for this tutorial.
A couple of notes:
Wow !! That's a lot of extra steps for you Windows users. Mac and Linux users start at step 11 (but if you are a Mac or Linux user, you already knew that. )
Linux: If the device still does not show up in Step 11, post, and I can help (Hint: It may not be /just/ the udev stuff.)
Is step 13 necessary? adb remount works on mine. (not sure if I had to adb root first or not) but I can have a root shell via adb without psnueter.
If adb remount succeeds, skip step 14, and continue with the 3rd line of step 15.
Click to expand...
Click to collapse
Thanks for the input! Yes, yes, I know windoze makes more work. It's also pretty widespread for folks.
For step 13 - I think it depends on the device. It would be nice for others to weigh in and let me know if it's needed. If not, I can totally remove it.
Also, in the other ROM thread, I made, it's even easier to root - you just grab one of the pre-rooted ROMS and drop it in SD card...the system does the rest. Mind you, this is for the UG007.

Links UG007
If you Bluetooth connection is not working properly, try to install this custom ROM: http://blog.geekbuying.com/index.php/category/android-tv-stick-tv-box/ug007/
How to install CWM-based Recovery: http://androtab.info/clockworkmod/rockchip/
Both worked for me. I was able to connect my BT Keyboard/Mouse Pad combo

./psneuter
Failed to set prot mask (Inappropriate ioctl for device) ??

nice tutorial.. while finding the best way to work my ug007 i stumbled upon this thread via armtvtech.com
currently i only knew this tutorial to root the device, but looking at yours ill give it a try first.
digitalhigh said:
Also, in the other ROM thread, I made, it's even easier to root - you just grab one of the pre-rooted ROMS and drop it in SD card...the system does the rest. Mind you, this is for the UG007.
Click to expand...
Click to collapse
you cant install custom roms without flashmode, cant do flashmode without opening device.. or did i get it wrong!? talking about the ug007
actually you can install a custom rom once you are rooted without opening the device, here
Linuxslate said:
(Hint: It may not be /just/ the udev stuff.)
Click to expand...
Click to collapse
ehm.. im still preparing to root, i guess you hint at the android sdk?
if not ill holla back at you and complain why you didnt write it out in first place
but very good to know that i skip alot by "almost" only installing ubuntu to a vm

I may be missing something, but I couldn't get this to work on my UG007
psneuter didn't work for me, gave me an error about 'invalid ioctl' or something. But the strangest thing is that "adb shell" already shows the # in the prompt.
To confirm my suspitions, I also typed "adb root", which returned "adb is already running as root".
So I proceeded with the rest of the instructions. No errors appeared, installed Superuser and I can see su and busybox in system/bin
But when I download root checker it says it wasn't properly rooted. installing terminal and type "su" says permission denied - and that's it.
Am I missing something? I'm new to this rooting thing, so please don't be angry with my noobish questions

I managed to do it - but *not* by following this tutorial.
I used this: armtvtech.com/armtvtechforum/viewtopic.php?t=28 (Cant post links yet, sorry!)
Only ran the "TPSarky-VonDroid-Root" bat, and presto! I had root on UG007.
I even fixed the changing MAC address problem with wlan.ko from armtvtech.com/armtvtechforum/viewtopic.php?f=69&t=632&start=10 (link on page 2). I just copied it to /data/local/tmp, set permissions as rwr--r-- and then used root explorer to copy it to /system/lib/modules - now I have wifi signal every time I boot the device, and don't need to mess with my router config every time
I also manage to get xbox360 wired controller working. xpad.ko on /data/local/tmp and then insmod /data/local/tmp/xpad.ko - just connect the joystick after that, and it will be recognized. Only problem is, after a reboot I have to insmod again.
I tried doing the same thing I did with wlan.ko, but nothing happens - system won't load it on boot. Am I missing something here?

The psneuter is broken
I'm on Linux, running a RK3066, and psneuter gives "Failed to set prot mask (Inappropriate ioctl for device)". Running Ice Cream Sandwich 4.1.1, kernel 3.0.8+, build RK30_anpei10w1am-r4.0.57.20121207, A10-2 cpu.

SLotman said:
I may be missing something, but I couldn't get this to work on my UG007
psneuter didn't work for me, gave me an error about 'invalid ioctl' or something. But the strangest thing is that "adb shell" already shows the # in the prompt.
To confirm my suspitions, I also typed "adb root", which returned "adb is already running as root".
So I proceeded with the rest of the instructions. No errors appeared, installed Superuser and I can see su and busybox in system/bin
But when I download root checker it says it wasn't properly rooted. installing terminal and type "su" says permission denied - and that's it.
Am I missing something? I'm new to this rooting thing, so please don't be angry with my noobish questions
Click to expand...
Click to collapse
Try renaming old "su".
Check permissions on the su and busybox you installed.

MK808, MK809 [model T002], and the MK802 III anyone?
Hi,
Thanks OP for this information.
I have a Samsung S3 [my first android device] which I rooted with no problem, but am a total noob when it comes to these android sticks.
One can say they are very similar, so I wont be completely in the dark. OK, now that we got that out of the way...
Can anyone please confirm whether they have used this with the MK808, MK809 [model T002], and the MK802 III,
I have ordered these from 1 from amazon and 2 from ebay and am expecting delivery shortly, therefore I just want to make sure before I go bricking them one by one...
I notice that they all have RK3066 Cortex A9 chips but are manufactured by different companies. The ones I see on eBay, although they all bear the same code MK8xx, they all look very different! I presume the MK8xx code is a universal model?? just like 80486 was to the PC? given the case does this method work universally?
I intend to set them up with XBMC media centres and to use with a Xbox controller. Any advice on the best way for achieving this would be nice too.
Thanks
:good:

Linuxslate said:
Thanks for this tutorial.
Linux: If the device still does not show up in Step 11, post, and I can help (Hint: It may not be /just/ the udev stuff.)
Click to expand...
Click to collapse
Linuxslate, I have an MK808 that shows up in lsusb as 2207:300a when I put it in "flash mode" but it never shows up via "adb devices".

I got mine the other day and it turned out to be rooted already?
I decided to install SuperSu and that's how I found out it was rooted.
Immediately, installed Busybox, System Tuner Pro and Titanium Backup.
Rob
Rob sent this from his SPH-D710 via Tapatalk

So would this possibly work on this - http://www.zoostorm.com/Products/357-zoostorm-sl8-3305-1030-tablet-pc.aspx
States it's a Rockchip RK3066 Cortex A9 Dual Core 1.5GHz, running 4.1.1 Jelly Bean, quite interested in getting one & root would be a bonus.

psneuter broken
Hello,
the psneuter attached to the first post doesn't do anything to my ug007. I have the same error others have posted here and haven't gotten a reply about.
To unlock, I used the script that's mentioned in a post above, TPSarky-VonDroid-Root. If you google that, you'll find a download link amongst the results.

Thank u very much...:thumbup:
................................................................................................

Linuxslate said:
Try renaming old "su".
Check permissions on the su and busybox you installed.
Click to expand...
Click to collapse
Can you elaborate a little bit what you mean by renaming "su"?
I'm having the same issue..
Both su and busybox are having the same permission -rwsr-xr-x.
Sent from my Transformer Prime TF201 using XDA Premium HD app

I configured one of these at work. Upon using the terminal app and typing in su I got the # sign. They seem to come from the factory rooted already.
Sent from my Nexus 4 using xda app-developers app

ageerer84 said:
I configured one of these at work. Upon using the terminal app and typing in su I got the # sign. They seem to come from the factory rooted already.
Click to expand...
Click to collapse
Not exactly: this particular su can be used only from adb console, or at least that how it was on my tablet. So you need to replace it with a Superuser apk's su to get all features of rooted android. You can get one e.g. from FDroid
--
blog

Not sure what u mean by on your tablet. Android devices don't typically come rooted but I was surprised to have root access via terminal emulator on this stick PC. I just took it out of the box and definitely didn't have to go through the adb interface on a computer to flash superuser or what have you. Is this just me or is this a typical experience with this particular device?
Sent from my Nexus 4 using xda app-developers app

self-contained sideloading, adb stupid tricks version. no PC required.

(as dhayman11 pointed out, "unknown sources" is in security settings, not developer options. but no luck anyway, like most of the settings app, it also crashes if you try to set it.)
instead, here is an extremely stupid idea that just came to me.
1. turn on adb wifi debugging
2. sideload your favorite terminal, e.g.
http://jackpal.github.com/Android-Terminal-Emulator/downloads/Term.apk
(ok I lied. you will need your desktop/laptop/phone/whatever, exactly 1 time. step 2 will be skipped forever after that 1 time.)
3. fire up said terminal from the settings->applications menu.
4. (LOL!)
$ adb devices
4a. if the above command shows no devices,
$ adb connect localhost
and proceed to step 5.
4b. if the command shows exactly 1 device, e.g. "emulator-5554", proceed to step 5.
4c. if the command shows more than 1 device (wtf?!) then you will need to specify a device of your choice ("-s somedevice") in every subsequent adb command, e.g.
$ adb -s emulator-5554 <whatever>
$ adb -s localhost:5555 <whatever>
etc.
5. e.g.
$ adb install /sdcard/Download/foobar.apk
$ adb shell
$ adb uninstall -k com.something.somethingelse
etc. etc.
6. profit? profit!

ok here is a slightly-less incoherent form of the senior-moment-reply I posted earlier
several days ago it occurred to me to alternatively use sshd for terminal access, because:
-a) I feel a little unsafe leaving adb wifi enabled all the time (ok it's only a small thing to turn it on and off, but still) - and for security reasons there is no way to enable/disable it programmatically e.g. from a script/shell/terminal/app (well theoretically this is not exactly true, but practically it is)
-2) some people (i.e. me) would like to do shell/terminal remotely sometimes, rather than on the AFTV (and other people don't have/want a keyboard)
ssh access makes a great alternative to Term.apk, but the problem is:
- Term.apk and/or (pick your favorite android ssh server) don't have permission to run e.g. "pm install foo.apk" - it will fail. (btw 'pm' is a great command, take a look sometime at all the options. it shares a lot of functions as the adb command itself. 'am' is another fun command...)
- so, the hilarious workaround of enabling adb wifi, "adb connect", and then finally "adb shell" or "adb install" etc., is still required. (b/c the adb user is in the 'shell' group, among others - giving it permission to run /system/bin/pm) - oh well.
for random reference:
Code:
127|[email protected]:/ $ id
uid=2000(shell) gid=2000(shell) groups=1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)
[email protected]:/ $ exit
[email protected]:/ $ id
uid=10009(app_9) gid=10009(app_9) groups=1015(sdcard_rw),1028,3003(inet),50009(app_40009)
(also note it appears the adb shell user might possibly have 'mount' abilities, but since the /dev/block/sd* nodes permissions' are really locked up, who knows...)

reboot disemmcwp doesnt work

Hi, "adb shell reboot disemmcwp" doesnt work for me on 2017G 7.1.1 (B05).
Some weeks ago i used a different command that worked. But i cant remember this command and cant find it anymore via google.
Does anyone know which command it is?!
thanks.

It depends on where you're doing this at. Are you using CMD or terminal on the phone?

nolimit78 said:
Are you using CMD or terminal on the phone?
Click to expand...
Click to collapse
cmd as admin and also with terminal (root).

Spillunke said:
cmd as admin and also with terminal (root).
Click to expand...
Click to collapse
I just used 'adb reboot disemmcwp' and it worked.

This command doesnt work for me.
No effect with CMD or terminal. There is an other similar command that works.
EDIT: im not sure, but is it maybe a problem of magisk? I use Magisk, not SuperSu. Would it work with SuperSu?

PUSH

Spillunke said:
PUSH
Click to expand...
Click to collapse
Did you try it? What was the error? Its very bad practise to just say "it did not work".

After booting up, i cant deinstall system apps for example.
Now i switched to an other stock rom and now i can deinstall systemapps, but there are still problems: cant delete files in system/ but this seems to be an magisk based issue.

Spillunke said:
After booting up, i cant deinstall system apps for example.
Now i switched to an other stock rom and now i can deinstall systemapps, but there are still problems: cant delete files in system/ but this seems to be an magisk based issue.
Click to expand...
Click to collapse
try mount -o rw,remount,rw /system (as root)
if that doesnt work, try this in terminal in twrp.

Zobat said:
try mount -o rw,remount,rw /system (as root)
if that doesnt work, try this in terminal in twrp.
Click to expand...
Click to collapse
All in one line or are this 3 single commands?

hi guys.
this simple process is so hard for me but somehow i managed to reboot disemmcwp
i learned that my ZTE HSUSB driver not properly installed (check through you device manager).
after properly installed it, i manage to pair with my laptop
before
C:\adb>adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
error: device unauthorized.
after
C:\adb>adb shell
[email protected]:/ $
so just type
C:\adb>adb shell
[email protected]:/ $ reboot disemmcwp

colmanjr said:
hi guys.
this simple process is so hard for me but somehow i managed to reboot disemmcwp
i learned that my ZTE HSUSB driver not properly installed (check through you device manager).
after properly installed it, i manage to pair with my laptop
before
C:\adb>adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
error: device unauthorized.
after
C:\adb>adb shell
[email protected]:/ $
so just type
C:\adb>adb shell
[email protected]:/ $ reboot disemmcwp
Click to expand...
Click to collapse
msm8974? you sure you have an axon7?

[ROOT] Allwiner T3-K2001m (Android 6.0.1) (Seicane H605E)

I found solution how to root this cheap head unit.
Allwiner T3-K2001m (Android 6.0.1) (Seicane H605E).
Files: https://mega.nz/#!jAEH1SgY!1EjuwpWNyp5yzAYqmrZr6fEuPpZOkcPP0PKzclVsEhM
For this you need adb.
Extract all files to ur usb flash and connect to ur head unit.
Commands:
ADB commands:
Code:
adb connect 192.168.xx.xx (just write ur android local ip)
adb shell
for adb connect im use hostspot on android and connect me laptop to hotspot wifi, this is solution if you dont have internet on street .
Click to expand...
Click to collapse
When you enter to shell, write this commands:
Code:
mount -o remount,rw /system
cp /storage/udisk/arm/su /system/bin/su
chmod 0755 /system/bin/su
cp /storage/udisk/arm/su /system/xbin/su
chmod 0755 /system/xbin/su
su --install
su --daemon&
setenforce 0
mount -o remount,ro /system
When you complete all ,open "supersu-2-82.apk" with file manager on your head unit and install it, when done just open super su and wait when popup " http://prntscr.com/kvh560 " just click normal and wait two minutes when done, restart your android. Done, now you have root.

Can you please explain the procedure of connecting adb over wifi with head unit as i cant do same

androidindia said:
Can you please explain the procedure of connecting adb over wifi with head unit as i cant do same
Click to expand...
Click to collapse
example:
1. turn your head unit to "Portable wi-fi hotspot"
2. connect your pc to your created wifi.
3. open cmd on ur pc and write"ipconfig" and look for your wifi adapter and look ip:
http://prntscr.com/kwcrik
mine default gateway: 192.168.43.1
so now you can connect with adb.
4. adb connect 192.168.43.1
5. done you connected , me pc pic.: http://prntscr.com/kwcs1b

i did what you had advised but got error message
C:\ADB>adb connect 192.168.43.1
unable to connect to 192.168.43.1:5555

Broken link
Hi wongerlt!
The link from mega . nz is broken. Can you post another link?
Thanks!!!

broken link

Hi, I'm trying to root a K2001N on android 7.1.1........it appears ADB over wifi isn't available......and I don't seem to be able to get USB going with a Male to Male cable any tips?

Please update links
What version of Super SU did you use?

The link to the files seem to be broken. Does anyone have the files or another way to root please?
I have a K20M_2001M_NWD 20180517.

i not remember which files was, if someone remember archive name from mega.nz tell me.
adbx.zip
drive.google.com

Root Tutorial for alps 8227L demo. Looking for feedback

Hi all, I came across this root tutorial in a post from last year and was hoping to get some feedback on it. Risks involved? Potential for brick or boot loop? The tutorial uses supersu and I'm aware that it may now have security risks. This radio will never be online so it's not a concern. The tutorial was posted in a 8227L thread so it was supposedly done on this model but there wasn't much follow up.
According to AIDA64 my device specs are:
Model: alps 8227L demo
4x ARM Cortex A7 @ 1118mhz
32 bit ARMv7
CPU Revision: r0p3
1GB RAM
16GB ROM
Android Version: 6.0 Marshmallow
Kernel: 3.18.22
API Level 23
Android Security Patch Level: 2017-11-05
Build ID: YT9218_00002_V001
##############TUTORIAL###############
ROOT!
Root has to be done through ADB.
Attention! Incorrect actions can lead to a bootloop (endless loading) of the radio. To fix it, you will need a flashing and, as a result, a complete erase of all data; so, proceed at your own risk!
Requirements: P.C. (I prefer my laptop) and your head unit must be able to connect to the same wifi as the PC (I used my mobile phone's hotspot for wifi and connected my laptop and headunit to it)
Download adb (platform-tools-latest-windows.zip) from here
Download SuperSU apk and SuperSU zip files from here
Extract platform-tools-latest-windows.zip to C:\adb
Extract SR5-SuperSU-v2.82-SR5-20171001224502.zip.
Open the armv7 folder
Select all files in the armv7 folder and right click, Copy
Paste the files into the c:\adb directory
In the same folder, create a notepad file and paste in the following text:
Code:
service rooting /system/bin/su --daemon
class main
priority 10
user root
oneshot
seclabel ubject_r:system_file:s0
now save this file as "rooting.rc"
Open command prompt on your PC as administrator (in windows 10, in the "type here search" type "cmd")
type in "cd c:\adb"
Move over to the headunit and download "What is my IP address" from the google play store.
open up what is my ip address and write down your headunit's ip address (should be something like 192.168.3.4)
Go back to the play store and download "Terminal Emulator for Android"
open Terminal Emulator for Android
Go back to your pc and in the command prompt window, execute the following code:
(my adb worked without additional commands, immediately after opening the emulator)
(any sentences to the right of // means NOTE; so, don’t copy that part)
Code:
adb connect <IP devices>: 5555 // For example adb connect 192.168.3.4/10555
adb shell // Go to Shell
su @#zxcvbnmasdfghjklqwertyuiop1234567890,. // In the shell, we switch to superuser mode using the password
remount // Remount so that all further commands are immediately executed from the superuser
adb shell setenforce 0 // Further on the instruction manual from the articles
adb push su /system/xbin/su
adb push su /system/bin/su
adb shell chmod 06755 /system/bin/su
adb shell chmod 06755 /system/xbin/su
adb shell /system/bin/su --install
adb push rooting.rc /system/etc/init/rooting.rc
get back on you headunit,
get the SuperSU apk we downloaded from before and get it installed onto your headunit. (I put mine onto my google drive and downloaded and installed from there)
open it and look for a GRANT command.
Press GRANT to allow superuser access.
NOTE: If you get a request to update the binary file, click reject
go back to your pc. we are going to Reboot your headunit with the reset command
Code:
adb shell reboot
The radio will reboot twice, don't panic.
check with root checker
You should be ROOTED!
EDIT: here is a video:

the text file should contain:
Code:
service rooting /system/bin/su --daemon
class main
priority 10
user root
oneshot
seclabel u:object_r:system_file:s0

nismo2013 said:
the text file should contain:
Code:
service rooting /system/bin/su --daemon
class main
priority 10
user root
oneshot
seclabel u:object_r:system_file:s0
Click to expand...
Click to collapse
it works..no need to find the ip address or use a terminal emulator..you do have to add a extra line of code..

but since your at Android 6, just use KingRoot..much easier

codecxbox said:
but since your at Android 6, just use KingRoot..much easier
Click to expand...
Click to collapse
Thanks for the reply. I used kingroot on an old samsung galaxy s4 I had years ago and it made my device run like garbage. I would prefer the adb method above. In your other comment you sad no ip or terminal emulator is needed. Then you said I do need an extra line of code. Do you mean an extraline of code in order to skip the ip and terminal em? Or the tutorial above needs one more line of code as it is?

nismo2013 said:
Thanks for the reply. I used kingroot on an old samsung galaxy s4 I had years ago and it made my device run like garbage. I would prefer the adb method above. In your other comment you sad no ip or terminal emulator is needed. Then you said I do need an extra line of code. Do you mean an extraline of code in order to skip the ip and terminal em? Or the tutorial above needs one more line of code as it is?
Click to expand...
Click to collapse
you skip the ip add line and the use of the terminal emulator..
you should use these extra lines:
adb push su /vendor/bin
chmod 0677 su /vendor/bin
btw, you have to enable OEM Bootloader unlock at the usb debugging menu..press 4 times the build number and usb debugging will be enabled..after that, connect your cable to your pc, turn off and on your head unit, you should be able to adb devices with a serial number...
I recommend you to do each step copypasting at the adb prompt and pressing enter at each one..as soon you get adb superuser enabled, youre good to go...DONT UPDATE SUPERSU IF IT TELLSVYOU THAT THE BINARY NEEDS TO BE UPDATED!

your build 9816 Im never did that one, but probably you wont need to [email protected], cuz these builds 9*** already have su built in, but there not system wide..test # at adb shell before anything, and then push your su to all partitions..

codecxbox said:
you skip the ip add line and the use of the terminal emulator..
you should use these extra lines:
adb push su /vendor/bin
chmod 0677 su /vendor/bin
btw, you have to enable OEM Bootloader unlock at the usb debugging menu..press 4 times the build number and usb debugging will be enabled..after that, connect your cable to your pc, turn off and on your head unit, you should be able to adb devices with a serial number...
I recommend you to do each step copypasting at the adb prompt and pressing enter at each one..as soon you get adb superuser enabled, youre good to go...DONT UPDATE SUPERSU IF IT TELLSVYOU THAT THE BINARY NEEDS TO BE UPDATED!
Click to expand...
Click to collapse
Thanks for the additional info. I'm still a beginner when it comes to rooting and have never done adb. The reason I wanted to use the network method is the head unit is installed in my car and I only have a desktop pc. I could borrow a laptop but its not readily available. I'd also have to buy a M to M usb cable since the otg usb on the radio is full size.
One of the first things I did was enable developer options and unlock the oem bootloader. But thanks for the heads up! I also read to not undate the super su binary. Random question.. but can magisk manager be installed on top of supersu? On magiskroot.net in the install info it says it can hide supersu root.
Can you please do an edit to the lines I enter into command prompt so I'm sure I get it right? I entered the actual ip address of the head unit. Can you please correct the formatting if it's wrong?I thought I want port 5555 but in the tut above he's using /10555. My current commands are:
Code:
adb connect 192.168.0.3/5555
adb shell
su @#zxcvbnmasdfghjklqwertyuiop1234567890,.
remount
adb shell setenforce 0
adb push su /system/xbin/su
adb push su /system/bin/su
adb shell chmod 06755 /system/bin/su
adb shell chmod 06755 /system/xbin/su
adb shell /system/bin/su --install
adb push rooting.rc /system/etc/init/rooting.rc
*NEXT INSTALL SUPERSU ON HEAD UNIT AND GRANT SUPER USER ACCESS - DO NOT UPDATE BINARY - FOLLOWED BY*
adb shell reboot

First, try to get your firmware, it may be full or update, doesnt matter..just in case your hu bricks..
Second, like I told you, check if superuser is already enabled..
If you only have a desktop pc, download adb lite, and decompress it to c:/adb
Get a usb to usb cable, or cut 2 usb data cables and twist or solder green to green, white to white, red to red and black to black..

I highly reccomend you to download these apks..
busybox.apk from sterikson
CX Explorer.apk or Mixplorer.apk (these you need to obtain system modifications)

Magisk doesnt play well with HU, cuz these android builds contains su watchdogs that turn off any apps that attempt to modify system files..if your goal is to install Viper4Android, then its going to be a battle but it can be done..

I just read that you have the hu installed to your car..in that case you will have to use ADB WIFI, and process everything from your phone..there is a problem, you might need to get a wifi router, cuz these hu units dont do direct wifi..in that case, you need the real ip address of your hu and adb connect hu ip address

If your goal is to install TRWP, its almost impossible..adb fastload doesnt work, its needs access to a keyboard, and as you happen to experience, these units wont recognize a usb keyboard..the way to install TRWP is forcing it through SP Tool, but you need a very specific TRWP image, most likely you never get one..but its not necessary to obtain root, no problem

Kingroot is sounding better by the minute haha. I may just try that and then use a task kill app to stop the ram sucking crap it tries loading into the backgound processes. If kingroot fails to gain access, I hope you don't mind but I'll be back with more questions on the adb wifi process. I already have a wifi router so I'm good there. The tut above does it over wifi and desktop with the files sitting in c:/adb like you said.
A few things I have discovered about this head unit which may apply to other chinese hu.. As I'm sure you know, the bluetooth stack is missing the HID profile and while I was able to pair a gamepad, I couldn't use it. The same went for bluetooth controlled led strips. The work around for a gamepad or keyboard/mouse on these HU is, get a device that is android compatible but uses a 2.4ghz dongle. I plugged it in, drivers loaded and it started working. Check out the Rii RK707 which is an all in one. $23 on gearbest. Gamepad took getting used to but I installed retroarch and the quake 3 arena port and both worked flawlessly with a gamepad. Dead Trigger also worked perfect. I just google searched for the files and then side loaded to the HU. I also put a 3 port usb splitter on the otg and everything works fine together; storage and gamepad.
I also figured out how to gain 8GB free space. If you go to settings, then storage/internal and scroll to other, I saw mine had 8GB of files. I tapped other and then browse and saw 3 folders called amap, amap8 and amapauto or something like that. These are included chinese gps map files. I deleted the folders and my device went up to having 9GB free space and it's been running fine. I was able to install a bunch of games to verify the free space is actually there. I have seen people trying to re-partition their devices and being happy to gain 2GB free. This is the way to do it. The HU also runs less laggy with the extra space.
For external storage like a usb thumbdrive, I think these units claim to supprt 32GB. I can veryify that up to 128GB works fine. I have a 128GB verbatim store n go and keep all of my mp3 and movie files there.
Hope you find some of this helpful.

codecxbox said:
First, try to get your firmware, it may be full or update, doesnt matter..just in case your hu bricks..
Second, like I told you, check if superuser is already enabled..
If you only have a desktop pc, download adb lite, and decompress it to c:/adb
Get a usb to usb cable, or cut 2 usb data cables and twist or solder green to green, white to white, red to red and black to black..
Click to expand...
Click to collapse
Good idea! I have some phone data cables with broken micro usb plugs I can cut and solder together.
How should I check if superuser is enabled? Can I install the supersu apk and try tapping GRANT? I just assumed I didn't have it because AIDA64 came back with "no root" when I ran it.

nismo2013 said:
Kingroot is sounding better by the minute haha. I may just try that and then use a task kill app to stop the ram sucking crap it tries loading into the backgound processes. If kingroot fails to gain access, I hope you don't mind but I'll be back with more questions on the adb wifi process. I already have a wifi router so I'm good there. The tut above does it over wifi and desktop with the files sitting in c:/adb like you said.
A few things I have discovered about this head unit which may apply to other chinese hu.. As I'm sure you know, the bluetooth stack is missing the HID profile and while I was able to pair a gamepad, I couldn't use it. The same went for bluetooth controlled led strips. The work around for a gamepad or keyboard/mouse on these HU is, get a device that is android compatible but uses a 2.4ghz dongle. I plugged it in, drivers loaded and it started working. Check out the Rii RK707 which is an all in one. $23 on gearbest. Gamepad took getting used to but I installed retroarch and the quake 3 arena port and both worked flawlessly with a gamepad. Dead Trigger also worked perfect. I just google searched for the files and then side loaded to the HU. I also put a 3 port usb splitter on the otg and everything works fine together; storage and gamepad.
I also figured out how to gain 8GB free space. If you go to settings, then storage/internal and scroll to other, I saw mine had 8GB of files. I tapped other and then browse and saw 3 folders called amap, amap8 and amapauto or something like that. These are included chinese gps map files. I deleted the folders and my device went up to having 9GB free space and it's been running fine. I was able to install a bunch of games to verify the free space is actually there. I have seen people trying to re-partition their devices and being happy to gain 2GB free. This is the way to do it. The HU also runs less laggy with the extra space.
For external storage like a usb thumbdrive, I think these units claim to supprt 32GB. I can veryify that up to 128GB works fine. I have a 128GB verbatim store n go and keep all of my mp3 and movie files there.
Hope you find some of this helpful.
Click to expand...
Click to collapse
Didnt know about the 2.4 dongle, thanks for the tip! I guess the dongle should translate a usb keyboard, as its supposed to be HID compliant..give it a try!
My HU didnt contain Chinese maps, but there was a load of Baidu crap I deleted, gained some 250mb..Happy with the results!

nismo2013 said:
Good idea! I have some phone data cables with broken micro usb plugs I can cut and solder together.
How should I check if superuser is enabled? Can I install the supersu apk and try tapping GRANT? I just assumed I didn't have it because AIDA64 came back with "no root" when I ran it.
Click to expand...
Click to collapse
SuperSU from Chainfire rides upon su, so if su is not properly working, SuperSu reports that theres no root..
a quick way to know if you could be a superuser is looking at the build.prop at /system..if it says ro.xxxx.userdebug instead of ro.xxxx.user, then chances are that su is installed..but you would need to give permissions to su to modify anything, thats why the chmod command..
get to c:\adb
type adb devices you should see devices and a serial number
type adb shell you should see a $ prompt, means you dont have superuser privileges
if you see a # prompt, then you do have superuser

this is my modified routine:
adb shell
su @#zxcvbnmasdfghjklqwertyuiop1234567890,.
remount
adb shell setenforce 0
adb push su /system/xbin/su
adb push su /system/bin/su
adb push su /vendor/bin/su
adb shell chmod 06755 /system/bin/su
adb shell chmod 06755 /system/xbin/su
adb shell chmod 06755 /vendor/bin/su
adb shell /system/bin/su --install
adb push rooting.rc /system/etc/init/rooting.rc
adb shell reboot system

Reading again, you said that BT devices work, like a dongle..but at the fastboot prompt, neither HID or BT drivers get loaded, its like a safe mode boot..only way to emulate that Key Up, Key Down is opening the HU and search for a test point on the board, usually its works as a Key Down

codecxbox said:
Didnt know about the 2.4 dongle, thanks for the tip! I guess the dongle should translate a usb keyboard, as its supposed to be HID compliant..give it a try!
My HU didnt contain Chinese maps, but there was a load of Baidu crap I deleted, gained some 250mb..Happy with the results!
Click to expand...
Click to collapse
The usb keyboard and mouse also worked! I did quite a bit of research on gamepad and keyboard options once I saw 2.4ghz would work and narrowed it down to these 2. The Rii RK707 which is an all in one. It has a led keyboard and mousepad on one side, and flip it over and its a gamepad. Standard LB and RB plus incremental L and R triggers. Works well but the shape takes time to adjust to. https://www.gearbest.com/keyboards/pp_3002324601977019.html
The other which I'm still waiting to arrive is the EasySMX ESM-9110. Visually it's a copy of an xbox one controller but has nice rgby leds in the ABXY buttons. It also has programmable underside buttons like a scuf. Great reviews. https://www.aliexpress.com/item/4000574045231.html
Each are under $30 if you don't mind waiting for shipping from china. Everything else was either cheap junk or over my budget.