# Custom Firmware



## DIMIRON

Hello, I have a similar TVbox (Okko SmartBOX). I found information that TiVo Stream 4k has a SEI Robotics SEI400 board (Android TV Guide - TiVo Stream 4K). Exactly the same board on my device. Together, people from the 4pda forum created the ATV9 (Home | TvBox-Vortex) firmware untied from the operator. I suppose that it is suitable for TiVo Stream 4k. I would like it to be tested. If this really works for you, you can return the Tivo stock firmware by pressing the reset button for 20 seconds when you turn it on. I would be grateful if someone would share with me the firmware image from TiVo for research. Instructions below.
1) Unzip the downloaded archive;
2) Install ubt and adb drivers;
3) run _backup.bat;
4) If you need to enter the UBT mode, you can do this by very often pressing the Reset button on the set-top box and simultaneously connecting the computer with a THIRD micro-usb cable, the standard one does not support data transfer;


----------



## rczrider

The batch script pulls a couple of things. Which of these do you need? Probably not _data_, since that should be specific to our device and contain personal info.


Code:


update mread store logo normal 0x000000800000 backup\logo.img
update mread store recovery normal 0x000001800000 backup\recovery.img
update mread store boot normal 0x000001000000 backup\boot.img
update mread store vendor normal 0x000023600000 backup\vendor.img
update mread store system normal 0x000048000000 backup\system.img
update mread store product normal 0x000002000000 backup\product.img
update mread store data normal 0x0000c3400000 backup\data.img

Also, paging ptcfast2.


----------



## ptcfast2

Oh this is interesting - let me toy around...


----------



## ptcfast2

Okay only thing the script won't grab is the vendor partition for whatever reason. It can pull everything else. For what it's worth Okkulist 2.0.3 won't properly write to it, Okkulist 2.2.2 will but won't boot. Okkulist includes other image files such as bootloader as well, and the Tivo's is definitely different...also command to pull it is not in the backup script.

Any ideas for the vendor partition here? I can upload everything but that at this point, but if there's a way to grab it I can include it as well. I can toy around a bit more as well.



Code:


AmlUsbBulkCmd = upload store vendor normal 0x23600000 rettemp = 1 buffer = upload store vendor normal 0x23600000
Read status return failed:
strncmp != 0
ERR: AmlUsbBulkCmd failed!


----------



## rczrider

ptcfast2 said:


> Any ideas for the vendor partition here? I can upload everything but that at this point, but if there's a way to grab it I can include it as well.


I've always been a little unclear on the vendor partition. That started with Android P/Pie/9 and is specific to Treble, right? It's where the proprietary device HALs / binaries are located?

Is it possible that it doesn't have that partition and/or that it's empty (instead relying on system)?

From my time on XDA back before my Pixel days, I feel like that was the one that was a PITA most often.


----------



## DIMIRON

rczrider said:


> I've always been a little unclear on the vendor partition. That started with Android P/Pie/9 and is specific to Treble, right? It's where the proprietary device HALs / binaries are located?
> 
> Is it possible that it doesn't have that partition and/or that it's empty (instead relying on system)?
> 
> From my time on XDA back before my Pixel days, I feel like that was the one that was a PITA most often.


No, I'm sure you have a vendor section. I think its size is not 0x23600000 like mine,
this is the cause of the error. You just need to find out the size of the vendor partition. Regarding the Okkulist firmware: it works on the native kernel and bootloader, try editing the _run_flash.bat file and deleting lines from boot, recovery, etc. There should be only flash system.img and vendor.img. (It is unlikely that this will work, you need to edit vendor.img from TiVo). If the firmware still does not start, I will contact the author, he will tell you what could be the problem. At this stage, we need to know the partition table with their sizes. I know how to do this using UART, but I think there are still ways. Do you have developer mode enabled? Need adb


----------



## ptcfast2

DIMIRON said:


> No, I'm sure you have a vendor section. I think its size is not 0x23600000 like mine,
> this is the cause of the error. You just need to find out the size of the vendor partition. Regarding the Okkulist firmware: it works on the native kernel and bootloader, try editing the _run_flash.bat file and deleting lines from boot, recovery, etc. There should be only flash system.img and vendor.img. (It is unlikely that this will work, you need to edit vendor.img from TiVo). If the firmware still does not start, I will contact the author, he will tell you what could be the problem. At this stage, we need to know the partition table with their sizes. I know how to do this using UART, but I think there are still ways. Do you have developer mode enabled? Need adb


Just a heads up - the modified firmware won't start at the moment. Even just simple extracting and repacking the backed up Stream will cause the Stream not to boot. It's kind of weird, so I assume there's some verification going on even though the device is unlocked. Tried editing some other stuff to see if I could get it to boot, and same behavior even when removing some obvious stuff that would cause that behavior.

If I restore the backed up images as-is without modification, Stream is working again. So at least we have a backup and restore method for stock firmware.

Will keep digging, but if you could perhaps ask the author if there's anything he knows as well it would be appreciated.


----------



## ptcfast2

For what it's worth for those reading this - if we can get custom stuff flashed to these (like some of the other devices using the same board) most of the issues can be fixed and the entire device can be improved. There's a possibility that some DRM related things might not work (the device is licensed for Netflix, as an example, but I'm not 100% familiar if Netflix just cares about root only - which the fixed firmware won't have), but the goal is going to be avoiding root (Netflix won't work with root as an example...) and simply working on massaging the device to be stable and expose as many features we can / removing Tivo bloat.

I've already done a bunch of work on including fixes for the bugs we've found, I'm just stuck on getting the image to boot. There's something finicky here that I'm trying to figure out since this is a relatively new device.

It will be relatively easy to flash the device with new firmware for the average user, and will be completely guided with a way to go back to your prior firmware as well.


----------



## rczrider

ptcfast2 said:


> For what it's worth for those reading this - if we can get custom stuff flashed to these (like some of the other devices using the same board) most of the issues can be fixed and the entire device can be improved.


FWIW, I'm only returning mine because I'm almost at the end of my 30-day return period. I don't use it anymore; it's too buggy and I don't need another device sitting around that I don't use (especially when I can get a refund).

That said, my current thought is to buy another one closer to June 25, when the extended promotion ends. My hope is they'll have released at least one additional firmware update. Or maybe you fine folks will have done your magic and gotten custom / stock firmware working on it.


----------



## usamac

rczrider said:


> My hope is they'll have released at least one additional firmware update.


Unsure of whether it will be a full update or a hot-fix, but one of their reps had this to say recently.


----------



## rczrider

usamac said:


> Unsure of whether it will be a full update or a hot-fix, but one of their reps had this to say recently.


No idea, but CEC doesn't bug me because I don't use it. I want the device to stop freezing and for Plex and Kodi to stop flashing black.

I'm not opposed to being patient, but the 30-day return policy is what decided it for me. I don't need to be patient; I can just return it and order another one if and when they provide and update.


----------



## usamac

rczrider said:


> No idea, but CEC doesn't bug me because I don't use it. I want the device to stop freezing and for Plex and Kodi to stop flashing black.
> 
> I'm not opposed to being patient, but the 30-day return policy is what decided it for me. I don't need to be patient; I can just return it and order another one if and when they provide and update.


Yea man, the black flashing is what bothers me. I just quoted that because they appear to be close to having an updare released.. who knows what all gets corrected


----------



## ptcfast2

usamac said:


> Yea man, the black flashing is what bothers me. I just quoted that because they appear to be close to having an updare released.. who knows what all gets corrected


I was able to solve the black flashing by turning off DTS entirely on the Stream. Stupid, but it seems to only resolve itself if it's only Dolby Digital enabled from what I could tell. Coupled with allowing only Dolby passthrough via Plex I have not had any black flashes.


----------



## usamac

ptcfast2 said:


> I was able to solve the black flashing by turning off DTS entirely on the Stream. Stupid, but it seems to only resolve itself if it's only Dolby Digital enabled from what I could tell. Coupled with allowing only Dolby passthrough via Plex I have not had any black flashes.


The update made it cut back for me alot, so muh that I thought it had been resolved.. after more use today, I've learned it's definitely not fixed but somehow been reduced. Almost, like its a codec issue. I've noticed is more frequent with h265 streams.


----------



## ptcfast2

usamac said:


> The update made it cut back for me alot, so muh that I thought it had been resolved.. after more use today, I've learned it's definitely not fixed but somehow been reduced. Almost, like its a codec issue. I've noticed is more frequent with h265 streams.


Yeah there's some funky stuff going on in general. On the bright side, I'm still working on this little guy. Making progress - should have something available next week.


----------



## MPyro

With your custom firmware would it allow audio passthrough ?


----------



## usamac

ptcfast2 said:


> Yeah there's some funky stuff going on in general. On the bright side, I'm still working on this little guy. Making progress - should have something available next week.


not to be pushy.. just curious.. any update?


----------



## wizziwig

This thread appears to have stalled. These are now so cheap I'm thinking of picking one up again to experiment.

Are recent devices and firmware still unlocked?


----------



## vladlenas

wizziwig said:


> This thread appears to have stalled. These are now so cheap I'm thinking of picking one up again to experiment.
> 
> Are recent devices and firmware still unlocked?


if only try with this firmware TiVo Stream 4K


----------



## wizziwig

vladlenas said:


> if only try with this firmware TiVo Stream 4K


That looks like some sort of recovery firmware for bricked devices?

Looking at the Russian forums linked through the first post, it sounds like their very similar devices (based on same sei400 reference design) received a bootloader update that locked out custom firmware.

Was trying to determine if anything similar happened over here on the Tivo Stream 4K. Are people still able to enter the UBT mode on latest firmware?


----------



## vladlenas

wizziwig said:


> Was trying to determine if anything similar happened over here on the Tivo Stream 4K. Are people still able to enter the UBT mode on latest firmware?


I can only confirm that you can run in UBT on the latest firmware without any problems. Press the reset button, connect to the computer and after 10 sec. release the button.


wizziwig said:


> That looks like some sort of recovery firmware for bricked devices?


Not quite so, this is a user-debug firmware with full root access from adb and shell, with the ability to mount -o remount,rw / and disable verity.
P.S. There is no way to return to the stock user firmware.
PP.SS. It is built on the basis of beta firmware 5211, there is already an adaptive DV and HDR mode and has the number 5222.


----------



## jwort93

vladlenas said:


> I can only confirm that you can run in UBT on the latest firmware without any problems. Press the reset button, connect to the computer and after 10 sec. release the button.
> 
> Not quite so, this is a user-debug firmware with full root access from adb and shell, with the ability to mount -o remount,rw / and disable verity.
> P.S. There is no way to return to the stock user firmware.
> PP.SS. It is built on the basis of beta firmware 5211, there is already an adaptive DV and HDR mode and has the number 5222.


Does Netflix still work on the user-debug firmware?

Sent from my iPhone using Tapatalk


----------



## vladlenas

jwort93 said:


> Does Netflix still work on the user-debug firmware?


Yes, there is everything that is in the user firmware. DRM keys, DV, etc ...
I want to warn you again. With this firmware, there is no rollback to the stock and there will be no updates.


----------



## Vm19

vladlenas said:


> Yes, there is everything that is in the user firmware. DRM keys, DV, etc ...
> I want to warn you again. With this firmware, there is no rollback to the stock and there will be no updates.


Is it possible to make a backup and then restore it?


----------



## vladlenas

Vm19 said:


> Is it possible to make a backup and then restore it?


You can make a backup without any problems, but you can't return to the stock with it.


----------



## TreeHugger2000

vladlenas said:


> You can make a backup without any problems, but you can't return to the stock with it.


Are there any newer version of debug firmware/custom firmware yet? thank you


----------



## vladlenas

TreeHugger2000 said:


> Are there any newer version of debug firmware/custom firmware yet? thank you


I do not know.


----------



## sfalvey

I'm having problems flashing the user-debug firmware. I can only connect to the stream 4k with adb over TCPIP I just dont see it over USB on my mac using either of the usb ports on the stream. So after issuing adb shell reboot fastboot, fastboot cannot find a device.

I have also tried flashing using a USB key by pressing and holding reset to go into USB burning mode. After a wait it then falls back to android recovery which only has reboot and wipe as the only two options.

Any recommendations on how to get this firmware flashed?


----------



## a11d3lete

vladlenas said:


> Yes, there is everything that is in the user firmware. DRM keys, DV, etc ...
> I want to warn you again. With this firmware, there is no rollback to the stock and there will be no updates.


just flashed it with usb burning, as soon as i connected to wifi, i was forced updated to 5614


----------



## Resinous

vladlenas said:


> I can only confirm that you can run in UBT on the latest firmware without any problems. Press the reset button, connect to the computer and after 10 sec. release the button.
> 
> Not quite so, this is a user-debug firmware with full root access from adb and shell, with the ability to mount -o remount,rw / and disable verity.
> P.S. There is no way to return to the stock user firmware.
> PP.SS. It is built on the basis of beta firmware 5211, there is already an adaptive DV and HDR mode and has the number 5222.


Can anyone explain how to STAY on a debug build? I tried USB Burn tool and downgraded to the debug build with root on XDA forums, build is like 2155. But after flashing if I don't factory wipe data in recovery i get a boot loop. When i wipe data I'm in the debug build with the OEM Unlock option, BUT, as soon as the device boots it forces me to update back to non-debug 5614 build and reactivate the device on Tivo website. How the hell do i stay on debug build long enough to unlock Oem Unlock toggle..I'm going crazy


----------



## bobbymo

Resinous said:


> Can anyone explain how to STAY on a debug build? I tried USB Burn tool and downgraded to the debug build with root on XDA forums, build is like 2155. But after flashing if I don't factory wipe data in recovery i get a boot loop. When i wipe data I'm in the debug build with the OEM Unlock option, BUT, as soon as the device boots it forces me to update back to non-debug 5614 build and reactivate the device on Tivo website. How the hell do i stay on debug build long enough to unlock Oem Unlock toggle..I'm going crazy


You can skip the update by disabling net connection right after you associate with the wifi. It is a timing thing. Also, you can block the update server from your router.
Have you upgraded to 10 yet?


----------



## bobbymo

Does someone have a dump of the misc partition by any chance or can get one?


----------

