3.7 KiB
Modified firmware roadmap (design only – no flashing performed)
Phase 6 status
Exact stock methods and root causes are now confirmed for EPG, GEL, USB and the
storage monitor. Source-level patch specifications and offline harnesses pass.
No deployable APK/JAR/image exists: Philips platform signing, vendor build
configuration, accepted AVB signing and a proven recovery path remain blockers.
See PHASE6-DECISION.md, DEPLOYMENT-MATRIX.md and VALIDATION.md. The next
permitted live candidate is a Philips-signed Channels updated-system APK only;
no system modification was made in Phase 6.
| Target | Original path / hash | Class/method | Patch | Layer | Signing / AVB / risk |
|---|---|---|---|---|---|
| EPG | /system/priv-app/channels/channels.apk; 3A44BC...04D34F |
EpgProvider$deleteStaleDataRunnable.run, helper/pump |
typed 7-day batched retention | APK-internal + system | platform signature/shared UID; rebuild APK/DEX/odex; system AVB; medium boot risk, high TV-function regression risk |
| GEL queue | /system/app/gel/gel.apk; 29A68E...D383D7 |
enqueue site for GELWorker/GEL_WORK |
bounded/coalesced unique work + prune | APK-internal + system | platform shared UID; system AVB; medium |
| USB size | /system/framework/tvfw.jar; a0061795...8d11ad |
UsbVolumeListerImpl.getVolumes |
property-compatible StatFs fallback |
registered shared Java library | DEX/oat and client class-loader consistency; system AVB; high functional/boot risk |
| Storage policy | TPTvService APK; 75F492...41ECD |
TVStorageMonitorService |
API-based threshold, hysteresis, separate health warning | privileged APK | platform signature/system AVB; medium |
| Selective adopted data | Channels APK plus optional vold-aware helper | DB-open/migration layer | private-volume DB with internal fallback | APK/platform integration | SELinux policy and lifecycle changes; high functional risk, must not become boot dependency |
The shortened hashes above are display labels; full hashes are in the individual vendor reports.
Build/repack sequence
- Reproduce the exact Android 12 32-bit ARM DEX/minSdk environment and preserve package names, sharedUserId and manifest permissions.
- Patch from decompiled Java only as a specification; implement against smali or source, rebuild, align and sign with the firmware's platform key. A random replacement signature breaks shared UID and privileged grants.
- For
tvfw.jar, update matching shared-library preopt artifacts or force correct first-boot compilation in a test image. Verify alluses-libraryclient class-loader contexts and hidden-API/class linkage. - Integrate into inactive-slot system image, recompute filesystem/AVB metadata and sign vbmeta with an accepted key. The current locked/green production chain does not accept arbitrary images.
- Test on a sacrificial board or fully recoverable OEM engineering path before this TV. Do not mix binary changes with storage migration in the first build.
SELinux and OTA
The three functional fixes need no new SELinux access. A selective private-
volume design does: define a narrow type for reconstructible EPG data and allow
only Channels database operations after vold readiness. Never grant generic
mnt_expand_file access. Every system/vendor change invalidates stock AVB and
may be overwritten by OTA; maintain reproducible patches per firmware build.
Root boundary
The completed EPG repair and diagnosis required no root. Root/engineering image access is genuinely required for replacing APK/JAR files, policy/fstab/init, bind mounts, private-volume ownership outside app APIs, compiled-artifact management and AVB-compatible image deployment. None was attempted.