Spiffy Hacks
Enabling ADB on the InnoTV - Printable Version

+- Spiffy Hacks (http://spiffyhacks.com)
+-- Forum: Vtech InnoTab (http://spiffyhacks.com/forum-1.html)
+--- Forum: InnoTV (http://spiffyhacks.com/forum-28.html)
+--- Thread: Enabling ADB on the InnoTV (/thread-971.html)

Enabling ADB on the InnoTV - is0-mick - 03-28-2016

*** Warning ***
Please note that this is at your own risk, and you could potentially damage the unit or end up with a brick of a device.
Although you shouldn't if you backup everything like I suggest in the instructions below Wink

What you will need:
preferably a linux machine, virtual machine, or such.
A micro sd reader or sd reader with micro sd adapter.
A screwdriver to disassemble the innoTV.

Disassemble the innotv (remove 4 bungs at the left hand side with a pushpin or needle) then remove the 4 screws.
Remove the opposite side of the innotv with a long screwdriver through the 4 holes.
You should be able to unclip the two halves, and access the internal micro SD (may need to bend the pcb down slightly as the metal piece catches on the white plastic part). The metal piece also has "open" and "close" arrows printed on it.

Next I'd recommend you backup the sd card, just in case you screw anything up.
On your linux machine, insert the sd into the usb reader (mine showed up as /dev/sdb) and do:
cd ~/Desktop
sudo dd if=/dev/sdb  of=innoTVsdBackup.bin

From here, I dropped this file into a hex editor and found the partition table, which looks like this:
The above is SIZE @ Address, BUT you have to add 0x2000 onto it, as this is how much the bootloader takes up.
So the system partition starts at 0x00088000 (after we add 0x2000) and is 0x00300000 bytes long.

So now we know the position and size we can dump it.
We need to convert the 0x88000 and 0x300000 to decimal (I found out later that linux dd doesn't like hex).
0x88000 = 557056
0x300000 = 3145728

cd ~/Desktop
sudo dd if=/dev/sdb  of=innotvsystem.img  skip=557056 count=3145728

When this has finished, we can mount the dumped image, and edit the files we want to change.

cd ~/Desktop
mkdir /tmp/system
sudo mount -o loop -t ext4 innotvsystem.img /tmp/system
cd /tmp/system
sudo gedit build.prop

Find the following lines and change

to (and add the debuggable line underneath it like below)


next change the line below from


save the file and close gedit.

delete the backup file gedit automatically made with:
sudo rm build.prop~

cd ~/Desktop
sudo umount /tmp/system

write back to the SD:
***** IMPORTANT!!!! Do not do this (the mistake I made dd, doesn't support hex) *******

sudo dd if=./Desktop/innotvsystem.img bs=512 obs=512 seek=0x88000 of=/dev/sdb

The above will actually seek to 0 times 88000 which = 0, and overwrites the bootloader!
(Good job I made a backup) Wink


You actually have to use decimal and not hex for seek, so 0x88000 = 557056 so the correct command would be:

sudo dd if=innotvsystem.img bs=512 obs=512 seek=557056 of=/dev/sdb

When completed it should say something like:
3145728+0 records in
3145728+0 records out
1610612736 bytes (1.6 GB) copied, 558.687 s, 2.9 MB/s

Re-Insert the SD card, power up the InnoTV and hopefully if everything was done correctly you should be able to connect with adb to your device.

C:\Users\mick\AppData\Local\Android\sdk\platform-tools>adb shell
root@android:/ # ls


RE: Enabling ADB on the InnoTV - is0-mick - 04-04-2016

On the latest version of firmware, they have changed the boot image, so you are no longer root when connecting with adb.
You get a prompt like:
127|shell@android:/ $ su
su: permission denied

I did the following to re-enable root once I found it had been disabled.

Dump the boot.img with

sudo dd if=/dev/sdb of=innotvboot.img skip=49152 count=24576
(the 49152 and 24576 are calculated from the table in the first post 0xA000 + 0x2000 = 0xC000 (49152) and 0x6000 = 24576)

I then used a program called imgRePackerRK to unpack the image.

imgRePackerRK innotvboot.img

this will then make a folder called innotvboot.img.dump/ramdisk.dump
go there and edit the default.prop file

change the following lines from:




and save the file.

To repack:
imgRePackerRK Innoboot.img.cfg
(notice the .cfg at the end)

To re-flash:

sudo dd if=iinnotvboot.img bs=512 obs=512 seek=49152 of=/dev/sdb

Re-insert SD, and reboot Smile

127|root@android:/ # cat default.prop
ro.build.root.date=Wed Jun 17 16:37:22 CST 2015
root@android:/ #


RE: Enabling ADB on the InnoTV - jlonghi324 - 01-07-2017

I'm completely new to Linux never used it right now I'm installing it on a usb to boot it from that from there I have no idea how or where to start so I can enable adb on the innotv. I am tryng to make it so I can install apk apps on it for my kids to watch movies and shows on it. I would greatly appreciate it if u could explain this process clearer for me or do a video on how to do it. please... help me out send me an email at jameslonghi324gmail.com thank you

RE: Enabling ADB on the InnoTV - JJ Millen - 01-13-2017

Hi guys, thanks very much for your instructions above, they're great.  I'm trying to get ADB access to my son's innoTV so that I can install Kodi and for a bit of fun  Blush

Anyway I bought a spare 8Gb class 10 micro SD card - I wanted to keep the original sd card unchanged so that i don't destroy it completely (the wife would kill me!).  So to prove that my dd'ing works, I inserted the sd card into my linux machine and took an image of the original SD using the command:

dd if=/dev/sdb of=innoTVsdBackup.bin

which worked fine and created an 8Gb file

and then I swapped over sd cards in my linux machine and wrote the image down to the "new" microSD card:

dd if=innoTVsdBackup.bin of=/dev/sdb

which appeared to work, it took about 25 minutes and wrote down 8Gb.

But when I inserted the "new" microSD into the innotv and booted up, it seemed to go through the "first boot" process where the screen came up and said "updating apps" and then when this finished, although it successfully started up, it had lost my son's profile.

Do I need to write the image back down with a specific blocksize in my dd command or does the innoTV keep a record of the uuid (or something) of the microSD and therefore it knows that I've inserted a different one.  Anyone had any experience with writing down to a different microSD to the original?

Thanks guys


RE: Enabling ADB on the InnoTV - is0-mick - 01-14-2017

Hmmm Interesting. I didn't actually write to a different SD card but the problem might be that one sd card is slightly a different size sector wise than the other one.
Some have slightly more sectors than the other, and perhaps the partition that stores the user info (I think its the last partition) was too short, and therefore corrupted, and was reformatted.

I'd check the partition sizes of both cards to see if they both match or if they are different.

I did have kodi working on the innotv, you have to re-map some of the buttons if i remember, as the joystick doesn't work properly.