ATOTO A6 PF Full Root (based on FYT/Joying root process) (2024)

Raiden11X

This thread is for how to root the ATOTO A6 PF based on the root processes all over XDA on rooting Joying/FYT-based head units.

Originally I posted it here, but I decided it was worth making a new thread for. If anything needs to be clarified/changed, please let me know. As far as I know, the root process is much different from the older A6s and S8s as these units don't have the ability to ADB directly, even with USB Debugging enabled. This process takes advantage of the way these units install firmware, and uses Magisk's ability to patch images in order to generate the rooted boot image. This does not require a custom recovery at all, and is actually very straightforward.

I. PATCH YOUR BOOT IMAGE​

1. Download the latest firmware from here. Make sure you select the correct model (in my case, A6PF -> A6G2A7PF).
2. Unzip the file. The default filename for my A6PF is Update-File-For-A6-PF-7-Inch-System-2022-06-11.zip for the latest at the time of posting
3. There is a file inside labeled 6316_1.zip. Unzip this file.
4. Find the boot image (aptly labelled boot.img) and send it to your mobile phone. You can upload it to your Google Drive on your PC and download it from there onto your phone, or you can use ADB. Doesn't matter.
5. On your mobile phone, download and install Magisk. MAKE SURE YOU ONLY IT FROM THEIR GITHUB PAGE. This is how you know it's authentic and you're not downloading malware.
6. Open up Magisk and click "Install". Select the option "Select and Patch a File". Find the boot image you downloaded on your phone and select it. Then hit "Let's Go". It will process and save your patched boot image to your phone and label it something like magisk_patched-#####_XXXXX.img where the "#"s are random numbers and the "X"s are random letters. Cool.
7. Find a way to send this back to your computer. Either Google Drive, ADB, etc.
8. Replace the old Boot image with the one you just patched. MAKE SURE YOU NAME IT boot.img JUST LIKE THE OLD ONE.
9. Zip it back up.

NOTE: If you zipped 6316_1.zip into a folder 6316_1, make sure you zip up the contents of the folder and not the folder itself. I made the mistake of zipping the folder, so my new 6316_1.zip contained a single folder 6316_1 which contained all of the new stuff. Learn from my mistake lol.

It should look like:

6316_1.zip/├── META-INF/├── boot.img└── [...]

And NOT like:

6316_1.zip/└── 6316_1/ ├── META-INF/ ├── boot.img └── [...]

II. SIGN YOUR ZIP​

1. Download SignApkv2.jar. You can get it from here. This link was pulled directly from this post.
2. DOWNLOAD JAVA 8. IT WILL NOT WORK WITH JAVA 11. You can get it from Oracle or you can use OpenJDK.
3. Copy/Paste your 6318_1.zip into the folder you downloaded SignApkv2.jar.
4. Run the command:
   

   Code:

   java -jar SignApkv2.jar -w -v testkey.x509.pem testkey.pk8 6218_1.zip 6318_1_signed.zip

   (pulled from this post but changed the names of the files. You can also do what they did and edit the bat file and run it).
   1. Make sure you reference the correct java here when you run this. If you have two different Java JREs/JDKs installed, try this instead (in PowerShell):
      

      Code:

      & "C:\Path\To\Java8\java.exe" -jar SignApkv2.jar -w -v testkey.x509.pem testkey.pk8 6318_1.zip 6318_1_signed.zip

5. Referencing my note above, check your zip file. Make sure when you unzip it, you see META-INF and boot.img immediately.
6. Replace the old 6318_1.zip with your new 6318_1_signed.zip in your update folder. Make sure you rename it to match.

III. INSTALL TO HEAD UNIT​

1. Find a flash drive. Most other units use SD Cards but the A6PF gets its updates from a flash drive.
2. Format your flash drive to FAT32. This will remove everything on your flash drive, so make sure you save anything on there that's important somewhere else
3. Copy paste everything in that update folder into the flash drive. The root of the flash drive should look like:
   

   Code:

   YOUR_FLASHDRIVE├── lsec_updatesh/├── 6316_1.zip├── AllAppUpdate.bin├── logo.bmp└── lsec631update

4. Turn on your head unit and insert the flash drive into the "PHONE LINK" USB cable.
5. After a couple seconds a "FIRMWARE DETECTED. INSTALL?" prompt will pop up. Hit "Yes" and then wait.
6. You'll see text on the screen as it installs. You'll occasionally get some errors, but if it succeeds overall, you'll see at the bottom it will tell you to "Remove Device" with a little countdown. Remove your USB and then wait for it to reboot.
7. If you see the main screen, you're almost done! Download and install Magisk on your A6PF, either through chrome or through ADB.
8. Open up Magisk on your A6PF and hit "Install", then you'll see a new setting "Direct Install". Click that and when it's done it'll ask you to reboot. Go ahead and reboot.
9. If the A6PF comes back up, you're good to go!

You should be able to grant root access to anything now through Magisk. I haven't tried Zygisk or anything like that. Just a handful of Magisk Modules like Vyper4Android.

IV. TROUBLESHOOTING​

Here are some things I ran into that could help you fix any issues you need:

(NOTE: When I say "Cycle power", I mean to turn it off and on again. I tested my car unit in my house following this YouTube video to make it easier and not wear down the battery in my car. Cycling power just involves unplugging it from the wall and plugging it back in. If you use a switch or a surge protector, flipping that will work too. If you're in your car, turn it off and back on.)

• Grab your USB Stick that you made to root the device and put it in the "External Storage" USB port
• Cycle power
• You should see the device begin to install the firmware on your USB Stick!
  • If it doesn't work the first time, cycle power and try it again

This happened to me when I tried to flash a custom TWRP recovery. It... did not work lol so I had to flash the stock recovery.

• Grab a USB Keyboard and plug it into the "External Storage" device
• Turn on device (if not already)
• When "ATOTO" is on screen (or whatever pic you decided to use when it boots up), hold ALT + PRINT-SCREEN. While holding those keys, press "C".
  • You can learn more about how "Magic SysRq" Commands work here.
• This should trigger a crash and you will boot back to "fastboot". You can connect your PC via the "Phone Link" cable and use fastboot to flash your image. Since I was replacing my broken TWRP recovery with stock, I flashed my stock recovery via:
  

  Code:

  C:\path\to\img\on\pc> fastboot flash recovery recovery.img

• Once it's done, unplug your USB Keyboard from the "External Storage" USB port and plug in the USB Stick that you used to root the device
  • Note: If you want it stock, you can use the stock firmware files. Just get it from here again and zip it into your USB Stick.
• Cycle power
• You should see the device begin to install the firmware on your USB Stick!
  • If it doesn't work the first time, cycle power and try it again

V. FURTHER THOUGHTS​

• Looked into using this in the lsec.sh file to make backups, but I wasn't able to get it to execute anything beyond what is originally in the file. It might have to do with how the AllAppUpdate.bin is structured with this ATOTO firmware download as opposed to how the Joying/FYT devices have theirs packed. In addition to that, to unzip the bin, it requires a password and I'm not sure what that password would be. Unpacking the file with ApkPack (linked in the OP of that thread) doesn't yield anything but a warning with strange symbols. I guess I don't really need it, but it would be nice to be able to use.
  Actually discovered how to do this thanks to @surfer63's post . Lots and lots of really good information there!
• Wanted to try flashing a custom TWRP recovery for the device, following a combination of this XDA guide and this GitHub guide, but neither yielded any real results (other than the bootloop issue mentioned above lol).

VI. REFERENCES​

Atoto A6 ( Full Root ) by @LiquidXed - Initial root process
Modding your Joying/FYT SC9853i unit without root by @surfer63 - About the inner workings of the firmware zip and what each file/script does
Rooted Atoto S8 (Ultra, probably others) using Magisck+Joying signature by @JMeister234 - Learned the process of modding the image with Magisk and signing the ZIP
[Help Thread][Atoto A6 Pro] Ask Any Question, Noob Friendly by @sd_shadow - Read a lot on the differences between the different A6 units and found some of the other root guides used to piece all of this together

T

tenbitcomb