How to break a restricted Android TV - no developer options, no adb, no usb device

[Lu Wei]

I have an Android TV that forbids me doing almost anything, except
installing apps by inserting usb disk.

System information: Android 4.4.2 Linux version
3.10.0_s5(***@serdbuild02)(gcc version 4.4.1
(Hisilicon_v200(gcc4.4-290+glibc-2.11+eabi+nptl)))#1 SMP Tue Jul 30
11:29:05 CST 2019 ARMv7 Processor rev3(v71)

Settings is stripped that only simple TV related items left. I cannot
enable developer options by tapping multiple times on some item. Also I
don't see any WiFi-direct related settings that I want to use Miracast
on my phone. I tried install settings.apk exported from another Android
4.2 tablet and failed.

Adb is not possible, not only that developer options is not enabled,
but also adbd is not running (seen from ps command in terminal emulator
app). "start adbd" have no effect -- maybe no permission with userID
like 10045.

Computer has no response when connecting to its USB port (male to male),
no new device found.

There is no /mnt/sdcard, instead there is /mnt/mmcblk1/mmcblk1p1, with
only one folder named Android that I cannot access. If I insert a usb
disk, it will be /mnt/sda/sda1. And it seems I cannot execute from sda1,
e.g. su binary, even it shows r_x permission (I have corresponding
SuperSu apk installed first).

Google apps are stripped, which is normal for chinese system; but while
most system allow you install by yourself, this TV failed installing
Google Account Manager app (Google Play Services and Store apps could be
installed, all exported from another Android 4.2 armv7 tablet).

Tried a bunch of rooting apps and none of them work. Frama, Towel,
Magisk, Kingroot, Kingoroot, etc...

I am confused. I posted the same to XDA-developers forum, but it is
horribly slow to visit it from my place (it loads tens of js sites and
google recaptcha is hard to display), and newsgroup is certainly more
convenient for discussing...

[Theo]

Post by Lu Wei
System information: Android 4.4.2 Linux version
(Hisilicon_v200(gcc4.4-290+glibc-2.11+eabi+nptl)))#1 SMP Tue Jul 30
11:29:05 CST 2019 ARMv7 Processor rev3(v71)
Tried a bunch of rooting apps and none of them work. Frama, Towel,
Magisk, Kingroot, Kingoroot, etc...

Given it's locked down, you would either need a bootloader unlock or an
exploit.

For such an ancient Android version I wouldn't have thought it would be
impossible to find an exploit, however I'm very surprised by the build date
- it's only 8 months old. 4.4.2 shipped in December *2013*, and yet here's
a build only 8 months old. Even Google doesn't maintain for that long.
However it's also built with an ancient compiler from 2009.
So I suspect it's a recent release of hardware with an ancient OS, and it's
possible exploits have been closed, which is why Kingoroot and friends don't
work.

This appears to be another Hisilicon V200 box - not sure if you can boot
into recovery via this procedure?

Theo

[Lu Wei]

Post by Theo

Post by Lu Wei
System information: Android 4.4.2 Linux version
(Hisilicon_v200(gcc4.4-290+glibc-2.11+eabi+nptl)))#1 SMP Tue Jul 30
11:29:05 CST 2019 ARMv7 Processor rev3(v71)
Tried a bunch of rooting apps and none of them work. Frama, Towel,
Magisk, Kingroot, Kingoroot, etc...

Given it's locked down, you would either need a bootloader unlock or an
exploit.
For such an ancient Android version I wouldn't have thought it would be
impossible to find an exploit, however I'm very surprised by the build date
- it's only 8 months old. 4.4.2 shipped in December *2013*, and yet here's
a build only 8 months old. Even Google doesn't maintain for that long.
However it's also built with an ancient compiler from 2009.
So I suspect it's a recent release of hardware with an ancient OS, and it's
possible exploits have been closed, which is why Kingoroot and friends don't
work.

I hear that Android 4 is developed for big screens like tablets, maybe
that's why the system is so old. The TV is on sale since 2018-5. And
Maybe I shouldn't have chosen "update" when it started first time and
prompted me to update!

Post by Theo
This appears to be another Hisilicon V200 box - not sure if you can boot
into recovery via this procedure?
http://youtu.be/cgKzkBlzXiQ

This video is about firmware update -- which is just like what I have
done when updating. Maybe it's a custom firmware. I can't find any
custom firmware for the TV. It is 70", which has a small user base
compared to smaller sized TVs. It has only one joystick-like input:
power button with direction. Long press it will trigger a power-off
screen. Seems no way to recovery.