# TECHNOZON Modifier X11 installation

## Compatibility

This kit is only for clean stock **NEXON X11** firmware:

- `ro.product.device=ross`
- Android 14
- `ro.build.version.incremental=250926144031`
- `kylin` bootloader, RTD1325 SoC

Do not use it on SlimBOX, RT-X2, a different X11 build, or a different SoC. The installer validates the profile before writing a partition.

## Requirements

- Windows PC.
- Working USB A-to-A cable.
- Use the rear-most USB port on the TV box.
- Stable power. Never disconnect power or USB during fastboot.
- Initially available ADB: network `IP:1325` or USB ADB.

## Automated installation

1. Extract the archive completely. Do not run scripts from inside the ZIP.
2. Run `INSTALL_FASTBOOT_DRIVER.cmd` and approve the UAC prompt. The installer adds the signed Google driver to the Windows Driver Store. When the box enters fastboot, Device Manager should show `Android Bootloader Interface`.
3. Run `VERIFY_ONLY.cmd`. It must report `VERIFY_ONLY: OK`.
4. Fully boot the X11 to the Android home screen. Do not put the box in fastboot and do not press Reset in the A/V port.
5. Connect USB A-to-A to the rear-most USB port and run `START_EN.cmd`.
6. Type `X11` to confirm the target.
7. Enter the ADB address, such as `192.168.32.78:1325`. Leave it empty for USB ADB.
8. The script validates `ross` and `250926144031`; a mismatch stops before flashing.
9. If the bootloader is locked, typing `UNLOCK` authorizes an unlock that may erase user data.
10. Keep power connected. When fastboot is required, the installer reboots the X11 automatically through ADB. A toothpick and the A/V Reset button are only for the separate emergency recovery procedure.
11. The script detects the active slot, restores the verified stock image to the inactive `init_boot`, and flashes Magisk to the active `init_boot_a` or `init_boot_b`.
12. It completes Magisk and installs the production modifier.
13. It applies AISR off, local volume, Katniss, and Google TTS.
12. It installs STESH, Subscriptions, and TV Boxes as one `STESH Apps Bundle` Magisk module. TV SMB Manager is installed as a separate Magisk module and provides an SMB/NAS client, system DocumentsProvider, seekable playback streaming to an external player, and a Samba server. It also installs the X11 performance profile, STESH boot animation, Light Sleep, legacy-su guard, and security hardening. The profile preserves the selected animation speed, disables unnecessary OEM packages, and performs a one-time ART optimization of core ATV applications. UI size and DPI remain under stock firmware control; the update removes old forced 1080p/DPI overrides. `POWER` keeps the stock sleep/wake action. One `MENU` press opens the extended power menu, double `MENU` toggles the information overlay, and double `HOME` opens recent applications. Hardening removes Aptoide and the re-signed stock X-plore mod; an official X-plore installed later is not removed. CPU frequencies, ZRAM and LMKD remain unchanged.

After the Home screen has fully loaded, wait **10 seconds** for Modifier and its background key handler to start. Only then test `MENU`, double `MENU`, and double `HOME`.

The `TECHNOZON Update` screen accepts only the signed stable manifest from `technozon.info`. Before installation it verifies the exact X11 model/build, a separate RSA manifest signature, every file's size and SHA-256, the Modifier production certificate, and each Magisk ZIP's internal `id` and `versionCode`. The updater never writes the bootloader, `init_boot`, DTB, `super`, or firmware slots. A reboot is required after Magisk component updates.

The Samba server uses authenticated access by default: guest access is disabled and the box receives a device-specific password. Guest mode can be enabled separately for a trusted local network only.

The installer creates a device-specific TV SMB Manager pairing directly on the box. Two random identifiers live under the root-only `/data/adb/tvsmbmanager` directory with mode `0600`; they are never included in the archive and are preserved during reinstall. The app verifies production signatures, the exact X11 profile, and a short-lived one-time authorization from TECHNOZON Modifier.
15. Type `REBOOT` at the final prompt. TCP ADB closes after reboot.

Logs are written to `InstallLogs`.

## Security hardening

- Removes `cm.aptoidetv.pt` for Android user 0 and disables the package.
- Sets `install_non_market_apps=0`.
- Denies `REQUEST_INSTALL_PACKAGES` for applications that previously had it.
- Sets `persist.adb.tcp.port=-1` and closes port 1325.
- Backs up the initial state for module uninstall.

The APK is not physically removed from the read-only firmware partition. A factory reset wipes `/data` and Magisk modules, so the kit must be applied again afterward.

## Maintenance and rollback

Connect USB and run `Scripts\Enable_Maintenance_TCP_ADB_USB.cmd` to open port 1325 until the next reboot. Run `Scripts\Disable_TCP_ADB_USB.cmd` to close it immediately.

Modifier 0.4.6 adds a `Persistent TCP ADB, port 1325` switch that keeps
network ADB available after reboot. Use it only on a trusted home LAN:
ADB provides root access to the box. `Close TCP ADB` disables both
temporary and persistent modes.

To revoke the current TV SMB Manager pairing, connect USB, run `ROTATE_TVSMB_PAIRING_USB.cmd`, and reboot the box. Stock rollback removes the pairing files.

Remote SMB shares are available inside TV SMB Manager and compatible SAF clients. They are not mounted globally as `/storage/...`: this X11 kernel has no CIFS filesystem support, and a foreign `cifs.ko` is unsafe. `ROLLBACK_TO_STOCK_X11.cmd` restores the verified stock `init_boot` for the active slot.

Some RTD1325 bootloaders return `OKAY` for `set_active` without actually changing the slot. The kit therefore does not rely on manual slot switching: install and rollback operate on the active slot reported by Android.

Clean NEXON firmware contains an unmanaged stock `su`; removing Magisk reduces root-access control. A full partition restore requires the original NEXON fastboot recovery package.

## Security notice

The modifier is signed with a dedicated production key. The archive contains only the public certificate, never the private key.

The box remains a `userdebug/test-keys` device with an unlocked bootloader, Android patch level `2024-03-05`, and permissive SELinux. Put it on an isolated guest network/VLAN and do not store banking data, passwords, or NAS administrative credentials on it.
