Allwinner H313 (MXQ Pro 5G 8K) cannot access/create root (heavily locked up)

[Octavio Cuatrochio]

Hi all, i've been going this forum long enough to try and root a tv box that i buyed recently, but this one is HEAVILY locked up, like nothing i have seen before.
My objective here is to access 'su' so i can have access to rooting/overclocking this thing for emulators, and after that adding a heatsink, active cooling, etc.

I tried ADB over all USBs (4 in total) but nothing. then i tried to see if root was available through some leftover app or vulnerability, but nothing.
Then i tried following the specs from this thread (pretty similar in design to my PCB) but my UART displays nothing. (I leave the images from my setup below), i tried switching the wires, i tested the voltages and they return 3.3v, so they are ok.
I tried the toothpick method to access recovery, but it has 2 buttons. 1 does nothing (AFAIK) and the other one goes directly to updating, so no menu.

Any help is appreciated, as i'm out of any ideas.

I leave my pictures below, and my specs:

CPU: Alwinner H313
RAM: 1GB
ROM: 8GB
PCB: Z01S-v13.3, 2025.05.20
OS: Android 7-8 ish

 

[sonofbelial]

Hey. I have no idea whether this will work for the H313 but I got my H713 Projector rooted using the following method. I'm assuming you at least have the stock firmware, but if not, it seems you can grab it here:
 

https://androidpctv.com/firmware-android-tv-box-h96-max-h313

I dislike Windows so I was irritated that PhoenixSuit only seemed to run well on that platform, and ImgRePacker wasn't great either but then I found this project on GitHub: https://github.com/uictorius/imagewty-tool

 

I'm unsure how you'd do this on Windows and I assume you know of a way to flash your box with a custom img file, but this was my work flow:
1. Back up your original img somewhere safe. Don't play around with this file.
2. Grab the latest available version of Magisk from https://github.com/topjohnwu/Magisk/releases. You want the APK file.

3. Go to this Project on GitHub. CircleTeam provide a browser based method of doing this here: https://circlecashteam.github.io/MagiskPatcher/

4. Using imagewty-tool you first want to grab your boot partition. Run this against your copy of your firmware img. Let's say it's called update.img:
 

imagewty-tool extract update.img

5. This will extract a bunch of FEX files to a directory called update.img.dump. You want to find the file called "boot.fex"

6. Now copy that file and rename it to "boot.img". Go to the MagiskPatcher site.
7. Upload the "boot.img" file at "Upload boot image" and the Magisk APK at "Upload Magisk APK".
8. Select armeabi-v7a radio button, then check every box below except "Recovery Mode" and click "Patch".

9. After a minute or two, the program will download a new patched boot.img to your Downloads folder.
10. Let's say it's called "new-boot.img", you'll want to rename it as "boot.fex" and overwrite the original boot.fex file in the update.img.dump directory.
11. Run imagewty-tool again, but this time:
 

imagewty-tool repack update.img.dump new-image.img

The beauty of this is that repacking recalculates all V-file checksums automatically.
12. Flash new-image.img to your box whatever way you're used to doing it with PhoenixSuit or whatever. However, you're not done.
13. Hopefully the box boots up. Get to adb, grab the Magisk APK again and run:
 

adb install Magisk*.apk

Once installed, open the Magisk app up and it will say it needs to complete installation, so go ahead and allow that install. Select the Recommended radio button to install and then reboot.

14. Assuming all went well it should boot back up for you. Run this to check root:
 

adb shell
su
whoami

If all went well it should say "root" in your terminal rather than "shell". A dialogue will pop up on the Android screen asking to allow root privileges so go ahead and allow those.