How to root a Allwinner TV Box (e.g. H616) - Android Stick & Console AllWinner based Computers

Hi everyone,
I have a TV Box " X96Q Max" with Allwinner H616 Chip. Now i want root this Device and i found a way to do this.
I am not responsible for any damage. Everyone should know what they're doing.
* I think it works for all Allwinner TV Box's. I assume that you know how to flash a TV box on your PC.
What do you need...
- a Image (Firmware) from your Device
- Tool > PhoenixSuite v1.10 (Win) or PhoenixCard* (*I just don't know if it'll work / if you don't have a flash cable)
- Tool > imgRePacker v2.06 (Win)
- Tool > Magisk Manager v23 on the TV Box. (Android)
01)
Install or Unpack the Tools and the App
02)
Unpack your .img with imgRePacker (Drag&Drop)
03)
In the Folder from the Unpacked Image, you find many .fex files, we need one "boot.fex"
04)
Copy the "boot.fex" file to your TV Box with installed Magisk Manager
05)
Start Magisk Manager and go to "Magisk" > "Install" > "Select and Patch a File" > "boot.fex"
06)
The patched file is in the Download Folder from Android. The file is a .img file
07)
Copy the patched file back to the PC and renamed it to boot.fex ( yes i know, renamed it from xxx.img to boot.fex)
08)
Copy the renamed file to your unpacked Firmware and overwrite the original boot.fex
09)
Repack your image with imgRePacker v2.06 (Drag&Drop the folder) (Before repackaging it, rename the original firmware. To avoid problems)
10)
I assume that you know how to flash a TV box on your PC.
11)
Start PhoenixSuite v1.10 and flash your repacked image to your Device.
12)
Start your Device (possibly install Magisk Manager again)
13)
Start Magisk Manager 23, you becam error message "Abnormal State". I don't know if this is normal, but root works.
You can now the root tested with e.g. root checker app
I hope the instructions help you. I'm still testing it myself

---

Here the final Image for X96Q Max - H616 - Mediafire
- with root (after Flashing you must install Magisk Manager*)
- without TWRP
* you becam error message "Abnormal State". I don't know if this is normal, but root works.
Based on the last Image X96Q_Max_20200903-2125

---

B12f13 said:
Hi everyone,
I have a TV Box " X96Q Max" with Allwinner H616 Chip. Now i want root this Device and i found a way to do this.
I am not responsible for any damage. Everyone should know what they're doing.
* I think it works for all Allwinner TV Box's. I assume that you know how to flash a TV box on your PC.
What do you need...
- a Image (Firmware) from your Device
- Tool > PhoenixSuite v1.10 (Win) or PhoenixCard* (*I just don't know if it'll work / if you don't have a flash cable)
- Tool > imgRePacker v2.06 (Win)
- Tool > Magisk Manager v23 on the TV Box. (Android)
01)
Install or Unpack the Tools and the App
02)
Unpack your .img with imgRePacker (Drag&Drop)
03)
In the Folder from the Unpacked Image, you find many .fex files, we need one "boot.fex"
04)
Copy the "boot.fex" file to your TV Box with installed Magisk Manager
05)
Start Magisk Manager and go to "Magisk" > "Install" > "Select and Patch a File" > "boot.fex"
06)
The patched file is in the Download Folder from Android. The file is a .img file
07)
Copy the patched file back to the PC and renamed it to boot.fex ( yes i know, renamed it from xxx.img to boot.fex)
08)
Copy the renamed file to your unpacked Firmware and overwrite the original boot.fex
09)
Repack your image with imgRePacker v2.06 (Drag&Drop the folder) (Before repackaging it, rename the original firmware. To avoid problems)
10)
I assume that you know how to flash a TV box on your PC.
11)
Start PhoenixSuite v1.10 and flash your repacked image to your Device.
12)
Start your Device (possibly install Magisk Manager again)
13)
Start Magisk Manager 23, you becam error message "Abnormal State". I don't know if this is normal, but root works.
You can now the root tested with e.g. root checker app
I hope the instructions help you. I'm still testing it myself
Click to expand...
Click to collapse
I just want to say thank you very much! That really worked for me in a Transpeed 6K Allwinner H616. I've been looking for it for so long, I even bricked one box, that I cannot flash any firmware anymore. Really appreciate! Best wishes from Brazil!

---

Hi
How can i root my Android tv box X96 Mate plus
Android 10 (android tv)
Cpu Allwinner h616
4G Ram
64g Rom
Firmware installed
xmate_plus_20201118-1659
Thanks

---

falciatrice10 said:
Hi
How can i root my Android tv box X96 Mate plus
Android 10 (android tv)
Cpu Allwinner h616
4G Ram
64g Rom
Firmware installed
xmate_plus_20201118-1659
Thanks
Click to expand...
Click to collapse
See Post #1.

---

Thanks for this B. I just did this on my Transpeed 6K. Your link for X96Q Max - H616 wouldn't unzip so I used the Transpeed_H616_20211225_1600 firmware I found. It seems to be the newest but it is not rooted. Or at least, it wasn't.
Here is my rooted image if anyone would like to try it.
Magisk Rooted 1600 FW
This wasn't hard, but these processes are all over the place (or in Chinese) so it wasn't exactly easy either. Maybe I can write it down so it's a little easier to follow. My biggest problem was the device driver in Phoenix. Gotta watch out for that second "unknown device".
I also used Phoenix Suite 1.18 which worked.
Phoenix Suite 1.18
Thanks again B!
Now what do I do with my rooted tv box?!

---

So, I tried to write this down.
WIN10 (and 11)
Make sure USB Debugging is turned on for the TV Box.
Extract PhoenixSuite to a folder on your Desktop, but don't open yet.
Copy the IMG file to Desktop.
Open Device Manager
Disconnect USB cable from PC and TV Box.
Disconnect Power cable from Box.
DRIVER INSTALL (1/2)
Connect USB to the Box then to PC. It will power on through USB. Wait for Boot to complete.
Check Device Manager in the USB Devices Section.
It should install automatically and display the ADB Device under USB Devices.
But the ADB driver is in the Phoenix folder if you need it.
DRIVER INSTALL (2/2)
Disconnect the USB cable from the PC.
Launch Phoenixsuit.exe from the Phoenix folder.
Select the Firmware anchor.
Select the Image button and browse to your IMG file.
Select your wipe options (wipe it).
DO NOT PRESS UPGRADE!
Press and hold the Reset button hidden in the AV hole.
I have a torx driver that fits the hole snug so I didn't have to "hold" the button down.
The button needs to be pressed during all of the next part. So hold it!
Connect the USB cable to the PC.
You will see Device Manager flash a few times. Wait for it to finish.
Now you will have a new Unknown Device listed. Keep holding the Reset button!
Right click the Unknown Device and select Update Driver.
Select Browse then point it to the AW Driver folder in the Phoenix Suite folder.
When you select OK it will install the driver and the Firmware flash will start automatically.
Just wait for it to finish. It takes a few minutes so hold that button!
At the end you will get a LiveProc box with Chinese and a Yes/No.
Ignore it and disconnect the box and release the reset button.
Close the LiveProc box by selecting Yes.
Power up the box normally and check it out.
Boot will take a little longer.
Run Magisk.

---

iago197 said:
Eu só quero dizer muito obrigado! Isso realmente funcionou para mim em um Transpeed 6K Allwinner H616. Eu estive procurando por isso por tanto tempo, eu até bloqueei uma caixa, que eu não consigo mais flashar nenhum firmware. Realmente apreciado! Muitas felicidades do Brasil!
Click to expand...
Click to collapse
Olá, desculpe o transtorno, mas quero te perguntar uma coisa, como você conseguiu desbloquear o bootloader da sua caixa de tv transpeed 6k? Tentei fazer o flash do boot.fex.img pelo fastboot e só deu erro, vi alguns vídeos e me parece que é por causa do bootloader, procurei várias vezes como desbloquear o bootloader mas não consigo t encontrar qualquer maneira.

---

is it working to root X96h? allwinner 603, android 9

---

Sergio_090 said:
Olá, desculpe o transtorno, mas quero te perguntar uma coisa, como você conseguiu desbloquear o bootloader da sua caixa de tv transpeed 6k? Tentei fazer o flash do boot.fex.img pelo fastboot e só deu erro, vi alguns vídeos e me parece que é por causa do bootloader, procurei várias vezes como desbloquear o bootloader mas não consigo t encontrar qualquer maneira.
Click to expand...
Click to collapse
Hi rename the File from boot.img to boot.fex Not to Boot.fex.img < that can't Work

---

ahmednscc said:
is it working to root X96h? allwinner 603, android 9
Click to expand...
Click to collapse
Try it out, your own risk.

---

gottogo said:
So, I tried to write this down.
WIN10 (and 11)
Make sure USB Debugging is turned on for the TV Box.
Extract PhoenixSuite to a folder on your Desktop, but don't open yet.
Copy the IMG file to Desktop.
Open Device Manager
Disconnect USB cable from PC and TV Box.
Disconnect Power cable from Box.
DRIVER INSTALL (1/2)
Connect USB to the Box then to PC. It will power on through USB. Wait for Boot to complete.
Check Device Manager in the USB Devices Section.
It should install automatically and display the ADB Device under USB Devices.
But the ADB driver is in the Phoenix folder if you need it.
DRIVER INSTALL (2/2)
Disconnect the USB cable from the PC.
Launch Phoenixsuit.exe from the Phoenix folder.
Select the Firmware anchor.
Select the Image button and browse to your IMG file.
Select your wipe options (wipe it).
DO NOT PRESS UPGRADE!
Press and hold the Reset button hidden in the AV hole.
I have a torx driver that fits the hole snug so I didn't have to "hold" the button down.
The button needs to be pressed during all of the next part. So hold it!
Connect the USB cable to the PC.
You will see Device Manager flash a few times. Wait for it to finish.
Now you will have a new Unknown Device listed. Keep holding the Reset button!
Right click the Unknown Device and select Update Driver.
Select Browse then point it to the AW Driver folder in the Phoenix Suite folder.
When you select OK it will install the driver and the Firmware flash will start automatically.
Just wait for it to finish. It takes a few minutes so hold that button!
At the end you will get a LiveProc box with Chinese and a Yes/No.
Ignore it and disconnect the box and release the reset button.
Close the LiveProc box by selecting Yes.
Power up the box normally and check it out.
Boot will take a little longer.
Run Magisk.
Click to expand...
Click to collapse
Just a quick question. My box is stuck on Android logo. Looks like bootloader is corrupted. I tried to install image via PhoenixSuit but keep getting "device not found" . When I do reset button in the AV hole there is a red light and nothing happens. I keep thinking the reset button has stopped working. Your above method makes sense but I cannot get into the box to enable USB Debugging. Any help will be highly appreciated.

---

Mine seemed to lock up one time on the Android screen. Even after rebooting it would hang on the logo.
I eventually let it sit like that for a very long time. Hours and hours I think. Then it suddenly finished booting up. I think that may be it's recovery process. You could try leaving it and see what happens. Otherwise, I really don't have any ideas.
I'm am not impressed with this device at all. In fact, make an offer and maybe I'll sell you mine.

---

Can you include twrp preinstalled? Or at least does anyone know of a TWRP.img for this box!

---

gottogo said:
Thanks for this B. I just did this on my Transpeed 6K. Your link for X96Q Max - H616 wouldn't unzip so I used the Transpeed_H616_20211225_1600 firmware I found. It seems to be the newest but it is not rooted. Or at least, it wasn't.
Here is my rooted image if anyone would like to try it.
Magisk Rooted 1600 FW
This wasn't hard, but these processes are all over the place (or in Chinese) so it wasn't exactly easy either. Maybe I can write it down so it's a little easier to follow. My biggest problem was the device driver in Phoenix. Gotta watch out for that second "unknown device".
I also used Phoenix Suite 1.18 which worked.
Phoenix Suite 1.18
Thanks again B!
Now what do I do with my rooted tv box?!
Click to expand...
Click to collapse
Do you still have this stock firmware or a link to it? I flashed forgetting to unlock the bootloader like a dummy. Transpeed_H616_20211225_1600

---

Well of course I do, don't be ridiculous.
FILE

---

dbkalyan said:
Just a quick question. My box is stuck on Android logo. Looks like bootloader is corrupted. I tried to install image via PhoenixSuit but keep getting "device not found" . When I do reset button in the AV hole there is a red light and nothing happens. I keep thinking the reset button has stopped working. Your above method makes sense but I cannot get into the box to enable USB Debugging. Any help will be highly appreciated.
Click to expand...
Click to collapse
i have same problem, are you already unbrick your device?i cannot install driver and reset button not working

---

Kept trying reset button and one day it worked. It's older model and need to hold onto reset button for longer than normal.

---

Hi,
my H313 chinese box is already rooted, and I'd like to do a complete backup of my stock rom (Android10 , on eMMC).
I looked around, but I only found tools to flash downloaded ROMs, or to backup APKS , not to clone the full content of my eMMC. :/
My goal is being able to safely install other roms on eMMC , and being able to go back to my bootable android if something goes wrong.
I can reboot into recovery and have the "Mount /system" option working, could it be useful?
Tnx!