Skip to content
Google

Android TV and Google TV

9 TVs and sticks, cleaned up by hand by their owners using the lists in the repo.

Partly tested

Changhong AI PONT

@frogu@frogu

Partial manual session: five advertising, personalization and feedback packages disabled for user 0; dumbtv home and SmartTube installed from repository-pinned checksum-verified APKs. Google TV launcher and setup handler disabled after dumbtv home launched. After an owner-performed reboot, HOME still resolved to dumbtv and the disabled states persisted. Wi-Fi settings were lost during the session; the owner reconnected Wi-Fi, restoring ADB. The cause was not established. Android Private DNS with a public resolver serving the HaGeZi Normal list was validated by Android; pagead2.googlesyndication.com and googleads.g.doubleclick.net resolved to loopback while YouTube and Prime Video domains resolved publicly. SmartTube launched successfully, then stock YouTube was disabled for user 0, not uninstalled. Playback was not verified. Fire OS all.sh and verify.sh were not run; this is not an end-to-end tested package profile.

Developer mode

Not observed: ADB was already authorized when this session started.

IP address

Observed in the Wireless debugging screen; navigation path not established.

Needed a person
  • Play Protect older Android target warningExpand More details and choose Install anyway for the checksum-verified dumbtv home release. Play Protect was not disabled.
Notes from the owner 1
  • Android 14 SDK 34. Fire OS scripts are inappropriate. No verified debloat profile exists for this model.

Build UKNV.260603.001 · Original report

Partly tested

Hisense SmartTV 4K FFM

@aswinaasokan18-spec@aswinaasokan18-spec

Tested on a real TV on 2026-10-21 with manual ADB. Disabled for user 0, all re-enableable: com.hisense.storemode, fusion.android.tv.demo, com.google.android.feedback, com.google.android.play.games, com.hisense.service.message, com.hisense.alexa, com.google.android.katniss (voice search goes with it), com.google.android.tungsten.setupwraith, com.google.android.apps.tv.launcherx. No PROTECTED or failed disables. The first seven survived two reboots; the launcher swap survived the one after it. Netflix launched from dumbtv home and HOME returned to it. Device codename songshan.

Developer mode
  1. Settings
  2. System
  3. About
  4. Android TV OS build
  5. press OK seven times. Then Settings
  6. System
  7. Developer options
  8. USB debugging: ON.
IP address

Settings > Network & Internet > the connected Wi-Fi network

Needed a person
  • Allow USB debugging?Accept on the TV with the remote, with "Always allow from this computer" ticked. Later connects need no prompt, including after a reboot.
Notes from the owner 9
  • Google TV "Apps only mode" removes the recommendation rows but keeps a "Sponsored" hero banner at the top of the home screen. The logcat hosts around it are tv.google.com and play.googleapis.com, which the launcher and Play Store also need, so DNS cannot strip the banner. Replacing the launcher is the only fix found.
  • adb exec-out screencap -p produces a corrupt PNG: the vendor screencap prints "Init wrapper sys mutex successful" and "open mma dev failed" on stdout first. Write to /data/local/tmp and adb pull instead.
  • discover.sh flagged 0 of 136 packages. Hisense and MediaTek bloat uses names like com.hisense.service.message (promo notices) and com.hisense.storemode, which its patterns do not match.
  • The UI layer reports 1920x1080 in dumpsys display. Video still plays at 4K. HDR types 1-4 (Dolby Vision, HDR10, HLG, HDR10+) and ARC DD+ with Atmos were unchanged after the session.
  • Private DNS works with no app: settings put global private_dns_specifier <an ad-blocking DoT host> plus private_dns_mode hostname. dumpsys connectivity showed it validated, and ad hosts resolved to 127.0.0.1 after a reboot.
  • One TV and one firmware build; other Hisense Google TV models may differ.
  • all.sh, debloat.sh and verify.sh were not run: debloat.sh refuses non-Amazon hardware, and verify.sh checks Fire OS hosts. An ad-blocking Private DNS resolver was used instead of personalDNSfilter.
  • data/androidtv/packages.txt is still unpopulated. The disables listed in notes are one household's choices, not a removal list for other TVs.
  • Firmware OTA services (com.hisense.tv.ota, com.hisense.remoteupgrade) were left enabled.

Build RTT2.220118.001 · Original report

Partly testedAndroid 14

onn. Streaming Device 4K Pro

@OSikorsky@OSikorsky

Manual ADB session on Android 14. 16 packages disabled for user 0, plus launcherx and setupwraith for the launcher swap (18 total). dumbtv home installed and verified as HOME across a cold boot; Settings and the HOME key both re-checked afterwards. No DNS filtering was configured by choice, so no filter result is claimed.

Developer mode

Settings > System > About > scroll to Android TV OS Build > press select 7 times. Then Settings > System > Developer options > Wireless debugging: ON, and open 'Pair device with pairing code'. The Google TV remote-pairing code is a separate thing and does not authorize an ADB shell.

IP address

Settings > System > Developer options > Wireless debugging. The 'Pair device with pairing code' dialog shows the pairing endpoint; the main Wireless debugging screen shows a different connect endpoint. 'adb mdns services' lists both.

Needed a person
  • Wireless debugging pairing codePair with adb pair <host>:<pairing-port> using the six-digit code. The pairing port differs from the connect port on the main Wireless debugging screen. Port 5555 accepted connections afterwards without re-pairing.
  • Play Protect blocks the dumbtv home APKPlay Protect shows 'Unsafe app blocked - this app was built for an older version of Android' with only a 'Got it' button and no install-anyway option, because the launcher targets SDK 28 and this is Android 14. Both 'adb install' and 'pm install' then hang with no output while that dialog waits on screen; logcat shows Finsky VerifyApps verdict 3 launching PlayProtectDialogsActivity. Fix: Play Store > profile > Play Protect > gear > turn off 'Scan apps with Play Protect', install, then turn it back on.
Notes from the owner 10
  • discover.sh reports 0 candidates out of 139 packages on Google TV. Its CANDIDATE regex matches literal ads/analytics/telemetry/metrics in package names, and Google's equivalents are named adservices.api, ondevicepersonalization, federatedcompute, katniss and tungsten. Build the list by reading pm list packages by hand: a zero result is not a clean device.
  • The launcher swap survives a reboot only if setupwraith is disabled BEFORE launcherx. Disabling launcherx first leaves a window where setupwraith still answers HOME, which is the documented system_server crash-loop. With both disabled, cmd package set-home-activity tv.dumbtv.home/.Home returned Success and a cold boot landed on dumbtv home with both still disabled.
  • scripts/launcher.sh is the wrong path on Google TV: it runs the Fire OS accessibility Guard takeover, which fights launcherx (HOME intent-filter priority 2) rather than replacing it. Install the checksum-verified APK and disable the two stock HOME packages instead.
  • verify.sh exits 1 on a correct Android TV setup. Its 'home' and 'home-speed' checks look for the Fire OS accessibility hook and alarm_manager_constants min_futurity=0, neither of which exists when HOME is taken over the Android TV way. Only the 'packages N disabled' line is meaningful here.
  • debloat.sh refuses to run on non-Amazon hardware (is_fireos guard at line 8), so all.sh stops at its third step on any Android TV. The package pass must be applied by hand with pm disable-user.
  • dumbtv home requests android.permission.POST_NOTIFICATIONS on Android 14; the manifest caps its other permissions at maxSdkVersion 27. It still declares no INTERNET permission, so the no-network claim holds, but 'zero permissions' is a Fire OS 7/8 statement.
  • Observed on one onn 4K Pro build (URO4.260304.011.B1); other onn models, remotes and firmware may differ.
  • Not an end-to-end dumbtv run. debloat.sh, lockdown.sh and dnsfilter.sh were never executed; the package pass was applied by hand and verify.sh exits 1 for Fire OS reasons. status is partial for that reason, not because anything misbehaved.
  • No DNS or network-level filtering was configured, so this entry claims no telemetry result. Disabled packages stop their own traffic; GMS was untouched and still reaches Google.
  • The eight active entries now in data/androidtv/packages.txt were verified on this device across two reboots. The commented feature-removal block (katniss, Netflix) is deliberately off by default: each costs the household the remote's mic button or its Netflix hotkey.

Build URO4.260304.011.B1.15051976 · Original report

Partly testedAndroid 14

Philips 24NA 4K Google TV

@lsukev@lsukev

Manual ADB session on 2026-10-19 (repo scripts not run for the changes). 31 packages changed: 29 uninstalled for user 0 and 2 disabled (launcherx and setupwraith). The removed set included the vendor recommendation and shortcut apps, Google feedback, Play Games, ad services, federated compute, on-device personalization, the Google TV screensaver, katniss and hotword enrollment, the MediaTek system updater, and preinstalled streaming apps the owner does not watch. See the commented block in data/androidtv/packages.txt.

Developer mode

Standard Google TV path: Settings > System > About > Android TV OS build, press OK seven times, then Settings > System > Developer options and turn on debugging. The exact menu labels on this unit were not recorded.

IP address

Not recorded on this unit. On Google TV it is normally under Settings > Network & Internet > the connected network.

Needed a person
  • adb install hangs or fails silentlyadb install hung or returned without installing. Push the APK to /data/local/tmp and run pm install -r on it from adb shell; that succeeded and printed an explicit result.
Notes from the owner 7
  • launcherx and setupwraith both stayed disabled after a reboot on this build.
  • Wi-Fi dropped for about 40 s during the APK install. Reconnect with adb connect on port 5555 and check the install result before retrying.
  • Private DNS set to an ad-blocking DoT resolver validated on this build and blocked doubleclick.
  • Made by Skyworth: the vendor packages are com.smartdevice.* (DailyPlay recommendations, daily shortcuts, e-manual) plus MediaTek's system updater. All of them uninstalled for user 0 without complaint.
  • Observed on one unit and one build; other Philips/Skyworth models and firmware may differ.
  • all.sh and verify.sh were not run end to end: verify.sh checks Fire OS things, so its pass/fail says nothing about this TV.
  • katniss and the hotword packages were removed. On the TCL G08 that took voice search with it; expect the same here (not checked on this TV).

Build UKN7.260716.014 (Android 14, sdk 34) · Original report

Partly tested

Philips Google TV TA6 LT

@fabricio00101@fabricio00101

Manual ADB session (repo scripts not run): 4 packages disabled, dumbtv home installed as HOME replacing Google TV launcher; verify.sh targets Fire OS hosts so the full pass was not attempted.

Developer mode

Ajustes > Sistema > Acerca de de TV > pulsar 'Numero de compilacion' 7 veces; luego Ajustes > Sistema > Opciones de desarrollador > Depuracion inalambrica ON. Pair with the on-screen code: the pairing port is shown next to the code and is different from the connect port on the main screen.

IP address

Ajustes > Red e Internet > conexion Wi-Fi activa > estado de la conexion

Needed a person
  • Play Protect sideload rejectionFinsky answers INSTALL_FAILED_VERIFICATION_FAILURE for unknown signatures. verifier_verify_adb=0 and package_verifier_enable=0 do not reach it, and cmd role has no package-verifier role on this build. Toggle Play Protect off (Play Store > Play Protect), install, toggle it back on.
  • adb install streamed hangAfter a Play Protect rejection, adb install -r hangs with no output. Push the APK to /data/local/tmp and run pm install -r to get an explicit result.
Notes from the owner 3
  • launcherx declares mPriority=2 on its HOME filter, which beats both android.app.role.HOME and cmd package set-home-activity: HOME keeps landing on Google TV until pm disable-user com.google.android.apps.tv.launcherx. setupwraith re-enables it, so that one must stay disabled too.
  • cmd role on this build uses singular verbs (add-role-holder / remove-role-holder), not the plural forms.
  • Wireless debugging drops occasionally; adb connect to port 5555 works again without re-pairing.

Build UKNV.260227.001 · Original report

Partly tested

Philips OLED705 Android TV (TPM191E, Android 12)

@tkightly@tkightly

Tested on a real TV on 2026-10-20 by manual ADB. 29 packages disabled for user 0, none uninstalled: 11 third-party apps the household does not use, 9 nettvapp shortcuts, 7 Philips packages (demome, sticker, recommendation, nettvrecommender, usagelogger, candeebug, gel), tvlauncher and tvrecommendations. The TV survived two reboots, all HDMI, tuner and component inputs stayed registered, and Freeview Play, Ambilight/Hue, Alexa, Chromecast and PlayFi packages were left enabled. Private DNS set to an ad-blocking resolver. The owner then confirmed on the TV that the home screen, HDMI switching, Freeview Play, Prime Video, Ambilight/Hue, Alexa, casting and SmartTube all worked. Left enabled on purpose: com.vewd.core.browserui and com.seraphic.openinet.pre (likely the HbbTV / Freeview Play engines), org.droidtv.oad (firmware updates), org.droidtv.tv.frameworklogger.

Developer mode

Settings > All settings > Android settings > Device Preferences > About > press OK on Build seven times. Then Device Preferences > Developer options > USB debugging ON. Before that, adb connect is refused on 5555.

IP address

Settings > Network > the active connection's status

Needed a person
  • Allow USB debuggingAccept on the TV and tick Always allow from this computer.
Notes from the owner 10
  • The JointSpace API answers on 1925 (HTTP) and 1926 (HTTPS); GET /6/system reports os_type MSAF_2019_P although the set runs Android 12 after updates. Do not infer the Android version from it; use getprop.
  • The TV boots into live TV (org.droidtv.playtv), not the home screen.
  • scripts/discover.sh flagged only org.droidtv.recommendation. Its name heuristic misses Philips telemetry: org.droidtv.gel (GatheringService), org.droidtv.candeebug (CollectionService) and org.droidtv.usagelogger.
  • The org.droidtv.nettvappNNNN packages are web-app shortcuts (Couchplay, Arte, Megogo, Deezer, Divan.TV, PlayWorks, Toon Goggles, Fishing TV, Flix Premiere). The name is only in resources.arsc; dumpsys does not show it.
  • Play Protect did not block adb install of dumbtv home or SmartTube.
  • Private DNS (settings global private_dns_mode hostname) validated on first try over Ethernet.
  • One set, one firmware; other Philips chassis may differ.
  • developer_mode and ip_location are the paths the owner was given, and ADB worked after following them; the exact menu labels were not re-checked on screen.
  • all.sh, debloat.sh and verify.sh were not run: they read Fire OS lists. The verify paths below are the catalog's Fire OS host lists.
  • data/androidtv/packages.txt remains unpopulated; the app removals here were this household's choices, not a list for other TVs.

Build Philips/PH9M_EA_5599/PH9M_EA_5599:12/STT2.230526.001/4215:user/release-keys · Original report

Partly tested

TCL Smart TV Pro G08

@maam00@maam00

Tested on a real TV on 2026-10-17 and 2026-10-18 using manual ADB and local companion tools. The saved change log contains 21 successful disabled-user results; packages were disabled for user 0 rather than uninstalled. The owner confirmed the setup worked. The companion's 123 panel and a Netflix deep link were confirmed on the TV. The final setup retained Google TV home, Gemini and TCL Intelligent picture processing. Kernel: 5.15.180-android14-11. This is a device report, not a package-list contribution or a claim that the complete dumbtv pass was tested.

Developer mode

Settings > System > About > Android TV OS Build (below Kernel Version) > press OK seven times. Return to System > Developer options > Debugging. USB debugging was enabled, but did not initially open a network connection; enable Wireless debugging and open Pair device with pairing code.

IP address

Settings > System > Developer options > Wireless debugging. Its pairing dialog shows IP address & Port for adb pair; use the connection endpoint from Wireless debugging or ADB mDNS discovery for adb connect.

Needed a person
  • Wi-Fi pairing codeOpen Pair device with pairing code on the TV and use its current code and pairing port with adb pair. Then connect to the connection endpoint. The earlier Google TV remote-control pairing code cannot be reused here.
  • Accessibility service enabled but not boundTclAppBoot logged "callee doesn't have OP_AUTO_START permission". Grant the app's AUTO_START app-op with adb -s "$ADB_SERIAL" shell cmd appops set <package> AUTO_START allow, then rebind its accessibility service. This session toggled the service entry in enabled_accessibility_services; preserve other services when doing so. Confirm the service appears under Bound services in dumpsys accessibility. The same service was confirmed bound after a TV reboot.
Notes from the owner 7
  • ro.product.model contains spaces (Smart TV Pro); adb devices -l uses model:Smart_TV_Pro. A literal underscore-only getprop check rejected the correct TV until the spaces were normalized. Always select the device explicitly when more than one Android device is connected.
  • Wireless TLS debugging was unavailable after overnight standby. The already-authorized computer could reconnect on TCP port 5555 without another prompt. That port was not available at initial setup; do not assume that an unpaired TV accepts a first connection there.
  • The tested remote delivered keycode 4056 for 123, 190 for YouTube and 4184 for TCL TV to an accessibility key filter. The companion remapped 123 to its side panel and YouTube to YouTube TV while passing the mic key through to Google's assistant. These codes are observations for this remote and firmware, not a mapping for every TCL remote.
  • Turning off microphone access silenced the hotword capture but left katniss:interactor running. Disabling com.google.android.katniss stopped the capture but also removed the remote mic/voice-search path. It was re-enabled and the Google Assistant role restored for the final setup.
  • Observed on one G08 build; other TCL models, remotes and firmware may differ.
  • dumbtv's all.sh and verify.sh were not run. No dumbtv launcher or DNS filter result is claimed. The verify paths below are the catalog's existing Fire OS host lists, not a verified Google/TCL DNS policy.
  • data/androidtv/packages.txt remains unpopulated. This entry does not enable debloat.sh on Android TV or recommend the local removal list for other households. Package profiles need a separate contribution.

Build tcl9618-user 14 UTT2.250416.001 AU14 release-keys · Original report

Partly tested

Xiaomi Mi TV (MiTV-MSSP3, Android TV 9)

@frogu@frogu

Manual partial session: removed six owner-selected third-party apps, installed checksum-verified repository-pinned dumbtv home and SmartTube stable, and disabled stock YouTube rather than deleting it. Four analytics and feedback packages disabled for user 0. HOME resolved to dumbtv after disabling com.google.android.tvlauncher and the setup handler. After a reboot, HOME selection and all seven disabled package states persisted; Wi-Fi and ADB returned. Android Private DNS using a public resolver with the HaGeZi Normal list blocked pagead2.googlesyndication.com and googleads.g.doubleclick.net while Prime Video resolved. After reboot, the first blocked-domain check and the Prime Video check passed again. Prime Video and other owner-selected streaming apps were retained. SmartTube stable launched successfully before the beta was removed. Playback was not verified. Fire OS all.sh and verify.sh were not run; this entry does not establish a reusable package removal profile.

Developer mode

Not observed: network ADB was enabled before the session.

IP address

Not established in this session.

Needed a person
  • Allow USB debuggingOwner accepted the authorization dialog on the TV. Do not retry unauthorized connections in a loop.
Notes from the owner 4
  • Android 9 SDK 28, build PI.4663 release-keys. No verified generic Android TV removal profile is supplied.
  • Installation failed with Requested internal only, but not enough space. Removing owner-selected apps freed enough storage; no cache or unrelated app data was cleared.
  • PatchWall was disabled reversibly for user 0 with adb -s "$ADB_SERIAL" shell pm disable-user --user 0 com.mitv.tvhome.atv. Restore it with adb -s "$ADB_SERIAL" shell pm enable --user 0 com.mitv.tvhome.atv. Disabling it also prevents its MiTV+ installation prompt; it does not by itself remap the remote button. No system APK was deleted and no files under /system were changed.
  • On this physical remote the Mi button delivered Android keycode 191; left and down delivered 21 and 20. A separate locally built accessibility helper consumed only key 191 and invoked the global Back action. The owner confirmed that Mi worked as Back with PatchWall disabled. The helper is not included in this repository, and persistence of this later button mapping across reboot was not tested. An ADB-injected keycode 192 also launched PatchWall, but was not the physical Mi button code; injected events did not validate the accessibility mapping.

Build PI.4663 release-keys · Original report

Partly testedAndroid 9

Xiaomi Mi TV Stick (MiTV-AESP0, Android TV 9)

@pfTheTrial@pfTheTrial

Tested on a real stick on 2026-10-19 with manual ADB from Windows (Git Bash). Xiaomi has not shipped a security patch for this model since 2022-08-05. SmartTube 32.56 (dumbtv's pinned APK) installed and loaded its home feed. This is a device report, not a package-list contribution; the list in quirks is what this one household chose, not a recommendation for others.

Developer mode

Settings > Device Preferences > About > Build, press OK seven times. Back in Device Preferences, Developer options > USB debugging.

IP address

Settings > Network & Internet > select the connected Wi-Fi network

Needed a person
  • Allow USB debugging?Tick "Always allow from this computer" and press OK on the remote. Until then adb devices lists the stick as unauthorized.
Notes from the owner 9
  • Ships tv.alphonso.alphonso_eula (Alphonso automatic content recognition) as a system package. pm disable-user --user 0 works on it.
  • 1 GB RAM. With stock Google TV home about 180 MB was available; the stock launcher alone used about 108 MB PSS. After the debloat below, dumbtv home and SmartTube in place of the YouTube app, about 370-380 MB was available after boot (MemAvailable).
  • Disabled with pm disable-user --user 0 without side effects seen in this session: com.miui.tv.analytics, tv.alphonso.alphonso_eula, com.google.android.tvrecommendations, com.google.android.feedback, com.google.android.tv.bugreportsender, com.android.printspooler, com.mitv.milinkservice, com.mitv.tvhome.michannel, com.xiaomi.mitv.updateservice, com.mitv.download.service, com.xiaomi.android.tvsetup.partnercustomizer, com.google.android.katniss (removes voice search), com.google.android.youtube.tv (replaced by SmartTube). All stayed disabled across reboots.
  • The adb TCP session goes offline after the stick idles. adb disconnect and adb connect again reconnects without a new authorization prompt.
  • Android 9 Private DNS works from adb even though the Android TV settings UI does not show it: settings put global private_dns_mode hostname and settings put global private_dns_specifier <DoT host>. dumpsys connectivity then reported UsePrivateDns true and the network validated. No VPN app or extra RAM needed.
  • Observed on one MiTV-AESP0 stick and build; other Mi TV Stick variants (e.g. 4K) run a different OS version.
  • dumbtv's all.sh, debloat.sh and verify.sh were not run. The DNS filter from dnsfilter.sh was not installed; Private DNS was used instead.
  • data/androidtv/packages.txt remains unpopulated. Package profiles need a separate contribution.
  • Video playback after the Private DNS change was not confirmed in this session.

Build MiTV-AESP0, Android 9 (SDK 28), build PI.2055 release-keys, security patch 2022-08-05 · Original report