Jay-Tech (JTC) TV Android hacks

Back in January I bought a cheap 55" TV, mainly to use as a low-latency monitor. On a random note, I haven't watched TV in years, all my TVs have been used as monitors in the past 10+ years.

The model is UHD SMART TV S55U5515MQ and uses a dual-core running at 1.2GHz with 1.5GB RAM. It's running a version of Android TV 6.0.

I think a very similar set is with a model name of Genesis, distributed by the same company - Jay-Tech.

Was not expecting much for the price but it does a decent job as a monitor, with relatively low latency and relatively good resolution support.

However the software on it is quite bad, even wrote the company to ask some questions but never heard back from them:

there is no color calibration, even though it has a green tint from the factory
there are YouTube notifications of new videos when the TV connects to a network, even with no account set up
could not find a way to save the program list on USB as listed in the manual
there's a Home and a Standard mode backlight control, no idea what they do
there are loud WiFi connection notification popup and sounds, cannot be disabled

The only way to manage the apps is through a strange app, Aptoide TV. The preinstalled apps cannot be uninstalled. Setting up a YouTube account still does not let you disable notifications and YouTube videos anyway don't play.

I was not familiar with Android TV but own more than 20 other Android devices, so should not be an issue to "massage" the installation a bit.

Connecting

ADB seems to be enabled out of the box, with root settings already there. So go into your Smart TV --> Settings -> Network and write down the WiFi IP address. Let's say it's 192.168.1.2.

On your computer, download ADB ( e.g. from https://developer.android.com/studio/releases/platform-tools ) and run:

adb connect 192.168.1.2

You should now be connected to the TV's Android system. From now on, We will be doing everything from the command line.

Hidden settings

Run adb shell and afterwards dumpsys | grep "SETTINGS". This will show a list of Android intents that have "settings" in their name.

\android-platform-tools>adb shell

shell@cv6a538_international:/ $ dumpsys | grep "SETTINGS"

requestIntent=act=android.settings.INPUT_METHOD_SETTINGS

Action: "com.google.android.gms.location.reporting.SETTINGS_CHANGED"

...

WRITE_SETTINGS: mode=3; rejectTime=+2039d21h29m24s539ms ago

com.google.android.gms.settings.UDC_SETTINGS:

com.google.android.gms.usagereporting.UR_SETTINGS:

com.google.android.finsky.family.MEMBER_SETTINGS:

com.google.android.gms.location.settings.CHECK_SETTINGS:

android.settings.LOCATION_SOURCE_SETTINGS:

android.settings.SETTINGS:

com.google.android.gms.people.settings.INTERNAL_SETTINGS:

com.google.android.googlequicksearchbox.TRAFFIC_CARD_SETTINGS:

com.cultraview.settings.CTVSETTINGS:

com.android.settings.action.EXTRA_SETTINGS:

com.google.android.gms.icing.PRIVACY_SETTINGS:

...

I ran through all the interesting options, but there was not much to discover there. There are a few more Google Account controls that would otherwise be hidden (e.g. location reporting), but, as of this time, the only new actions I've discovered are com.android.settings.action.EXTRA_SETTINGS and android.settings.DSP_SETTINGS.

To start a hidden action:

adb shell am start -a com.android.settings.action.EXTRA_SETTINGS

You can play with your set as well and see if you discover something new.

Removing bundled apps

The included installer (Aptoide) doesn't let you uninstall any of the bundled software. They included also Google Play Store, but it doesn't detect apps installed from outside it. There is even a third app manager, in the base firmware of the TV, called "Manage my apps".

To list all the installed apps and packages:

\android-platform-tools>adb shell
shell@cv6a538_international:/ $ pm list packages
package:com.android.bcm.bluetooth
package:com.google.android.googlequicksearchbox
package:com.android.providers.media
package:com.android.wallpapercropper
package:com.cultraview.settings
package:com.cultraview.ctvmenu
package:com.android.documentsui
...
package:com.vanced.manager
package:com.mstar.tv.tvplayer.ui
package:com.android.browser
...
package:com.android.backupconfirm
package:com.cv.apk_manager
package:com.cultraview.osupdate
package:com.android.provision
package:com.android.statementservice
package:com.google.android.gm
package:com.android.ctvguide
package:org.adaway
package:com.cultraview.launcher
package:com.android.providers.settings
package:com.android.sharedstoragebackup
package:com.zeasn.deviceportal.asdprovider.cetus.pub
package:com.mediatek.autopair
package:com.android.webview
package:com.cultraview.demovideo
package:org.myklos.adbhelper
package:com.mstar.android.pppoe
package:com.ctv.hotelsetting
package:com.android.onetimeinitializer
package:com.android.keychain
package:com.google.android.gms
package:com.google.android.gsf
package:com.ctv.factorytest
package:com.android.packageinstaller
...
package:com.mstar.bluetooth3dservice
package:cm.aptoidetv.pt.cultraview_tv
package:com.cultraview.newfilemanager
package:com.cultraview.upgrade
package:mstar.factorymenu.ui
package:com.google.android.youtube.tv
...
package:com.ctv.newfactorytest

There are a few interesting-sound packages names there, but we might explore that in a future post.

To uninstall a package with root credentials, first run adb shell and then:

pm uninstall -k --user 0 com.google.android.youtube.tv

pm uninstall -k --user 0 com.netflix.mediaclient

You are then free to install it again from the Play Store or via sideloading.

Changing notification volume

To get a list of available settings there are several commands that you can run.

System settings:

\android-platform-tools>adb shell settings list system

accelerometer_rotation=0

...

volume_alarm=6

volume_bluetooth_sco=7

volume_music=30

volume_music_headphone=10

volume_music_headset=10

volume_music_speaker=15

volume_notification=5

volume_ring=5

volume_system=7

volume_voice=4

window_animation_scale=1.0

Global settings:

\android-platform-tools>adb shell settings list global

Phenotype_flags=phenotype_test_setting

adb_enabled=1

airplane_mode_on=0

...

desk_undock_sound=/system/media/audio/ui/Undock.ogg

device_name=JTC Android TV

device_provisioned=1

...

wifi_max_dhcp_retry_count=0

wifi_networks_available_notification_on=1

wifi_on=1

wifi_p2p_device_name=SmartTV

wifi_scan_always_enabled=0

wifi_sleep_policy=2

wifi_watchdog_on=1

wireless_charging_started_sound=/system/media/audio/ui/WirelessChargingStarted.ogg

Secure settings:

\android-platform-tools>adb shell settings list secure

accessibility_display_magnification_auto_update=1

accessibility_display_magnification_enabled=0

...

double_tap_to_wake=1

dropbox:data_app_anr=disabled

dropbox:data_app_crash=disabled

dropbox:data_app_wtf=disabled

enabled_input_methods=com.android.inputmethod.latin/.LatinIME:com.google.android.googlequicksearchbox/com.google.android.voicesearch.ime.VoiceInputMethodService

...

send_action_app_error=1

serial_blacklist=

show_note_about_notification_hiding=0

sleep_timeout=-1

speak_password=0

ssl_session_cache=file

touch_exploration_enabled=0

trust_agents_initialized=1

user_full_data_backup_aware=1

user_setup_complete=1

...

There are some interesting settings in there, again something to explore in the future. For now, let us disable the notification sounds:

adb shell settings put system notification_sound_set 0

adb shell settings put system volume_notification 0

adb shell settings put global wifi_networks_available_notification_on 0

Hack Correlation

Search This Blog