# Hisense SmartTV 4K FFM (device songshan, product songshan_emH_FFM, board m7632, MediaTek), # Android 11 / SDK 30, firmware RTT2.220118.001 / 01.00.05.04. The Android model string is # "SmartTV 4K FFM". # Also sold as the Hisense 50A6H4 (US), Hisense 65U6G and Hisense 65A6H: the third, fourth and fifth units # below. # # Apply: TV_HOST= tools/disable.sh examples/hisense-smarttv-4k-ffm-android11/debloat.txt # Undo: TV_HOST= tools/restore.sh examples/hisense-smarttv-4k-ffm-android11/debloat.txt com.google.android.apps.tv.launcherx # Everything is DISABLED with pm disable-user, never uninstalled. # # Android 11 sibling of examples/hisense-smarttv-4k-ffm/ (Android TV 10, device huangshan): same model # string, different board and firmware and a different package set (no evservice, no hotel mode, no # tvrecommendations here). Applied in two batches with a reboot after; no crashes, normal boot. # # WARNING, shared with the huangshan FFM list: never disable com.hisense.tv.smartsense, # com.vt.tv.smartsense.ui or com.vt.tv.aiot. A version of the huangshan list that did sent the set to # Android Recovery on the next boot ("Can't load Android system"). They are kept out below. # # Keep: com.mediatek.* (including com.mediatek.wwtv.tvcenter, the Live TV and HDMI app), # com.hisense.tv.hitvinput and com.mediatek.tv.service (they serve TvInputService and ask for # TV_INPUT_HARDWARE, so the HDMI/AV/tuner inputs depend on them), com.hisense.tv.smartservice, # com.hisense.tv.customerlauncher, com.vt.tv.input, com.hisense.tv.protector. # Stock launcher: com.google.android.apps.tv.launcherx (the Google TV home). It is disabled by the # launcher install, not by this list; pass it to tools/restore.sh as the stock launcher. # Already disabled at the factory on this set: YouTube Music, Google TV Movies, Feedback, Play Games, # HiBrowser, TalkBack, TTS, mediashell, basic dreams, calendar/contacts providers, Kika keyboard. # Left ON by choice here (deliberately not in this list): all streaming apps, voice assistant # (katniss / tv.assistant / hisense.alexa), casting and mirroring, and the firmware updaters # (hisense.tv.ota, hisense.remoteupgrade, vt.tv.usbota). # # Second unit (US, same device songshan and build RTT2.220118.001, one session plus standby and reboot # tests): com.hisense.storemode is not installed, com.hisense.evservice is (see the commented entry at the # end), and nothing on it came disabled from the factory. The owner also disabled katniss, # tv.assistant and hisense.alexa (no voice use); nothing else broke in that session. Notes from it: # - Standby (com.hisense.STR_SUSPEND) kills every third-party app except the one on screen # ("PowerVtImp: kill 3rd app" in logcat), the launcher included, which takes its key helpers off. Install # with restore_key_services on and -RestoreKeyServices / RESTORE_KEY_SERVICES=1 (docs/TROUBLESHOOTING.md, # "Accessibility helper enabled but the remote button does nothing"). # - Its remote differs from the SmartRC below: Disney+ is keycode 607 (scancode 418) and Peacock 608 # (scancode 421); YouTube 293, Prime Video 295 and the gear 83 (scancode 598) match. The firmware logs # every press as "WindowManager: interceptKeyTq keycode=... scancode=...". # - HomeKeyService did not bind in the first session (it stayed under "Binding services" in dumpsys # accessibility, with nothing in logcat), so settings_key_keycodes did nothing; in a later session it bound # normally, cause unknown. Mapping the gear through InputKeyService works either way: # app_keys 83:com.android.tv.settings. # - With InputKeyService bound, holding volume moves it one step # (docs/devices/tcl-55p71b-g09-key-repeat.md). # # Third unit: the Hisense 50A6H4 (US retail model; same device songshan and build RTT2.220118.001, # incremental 00.00.00.53, security patch 2025-06-01, Android model string "SmartTV 4K"). One session on # 2026-10-24 with three reboots: this list plus the commented entries at the end marked "third unit", # applied in batches, then the launcher. Nothing came disabled from the factory; storemode is not # installed, evservice is. Notes from it: # - setupwraith passed disable.sh's Wi-Fi guard without FORCE_SETUPWRAITH: every saved network belonged to # android.uid.system. # - With launcherx disabled and no key helper enabled, every button on its remote kept working when # pressed for real: Input, the gear, YouTube, Netflix, Prime Video and the other app buttons. # - The owner also disabled katniss, hisense.alexa and mediashell (no voice or Chromecast use), Play Games, # Google TV Movies, both VIDAA apps (net.vidaatv.*), HiBrowser, and some apps installed through the Play # Store (Tubi, Pluto TV, Haystack News, YouTube TV, MX Player, the TCL browser); nothing broke. # - com.hisense.tv.dlna, Hisense's DLNA renderer, listens on ports 38400 and 39500. Disabled, it closed # them only after a reboot; until then the port stayed open, even after am force-stop. AirPlay (7000) # and the Google TV remote service (6466/6467) are separate and kept working. # - With setupwraith and launcherx disabled, Settings > Privacy > Usage & diagnostics opens nothing (focus # goes to frameworkpackagestubs' SettingsPrivacyStub). The page is setupwraith's, not the Google TV # home's: on a Chromecast with Google TV 4K (Google TV 14) only setupwraith answers it # (README, "Are there switches in the TV's own Settings worth flipping too?"); not checked on this set. Set it before # this list disables setupwraith. # - Private DNS (dns.adguard-dns.com) works; YouTube and the streaming apps still play. # # Fourth unit: the Hisense 65U6G (retail model; same device songshan and build RTT2.220118.001, # Android model string "SmartTV 4K FFM", Android 11 / SDK 30). One session on 2026-10-27 with reboots: # - setupwraith passed the Wi-Fi guard without FORCE_SETUPWRAITH (active network owned by com.android.tv.settings). # - Applied debloat (setupwraith, mediashell, YouTube Music, Google TV Movies) and clean launcher swap. # - Remote keycodes match the SmartRC layout: YouTube 293, Prime Video 295, Disney+ 607 (scancode 484), # Tubi 606, and gear 83. # - Private DNS (dns.adguard-dns.com) verified persistent across reboots; streaming apps play normally. # # Fifth unit: the Hisense 65A6H (same device songshan, build RTT2.220118.001, incremental 00.00.00.53, # security patch 2025-06-01, Android model string "SmartTV 4K"). One session on 2026-10-28 with two reboots: # this list plus the three commented entries marked "third unit" at the end, applied in batches, then the # launcher. Nothing came disabled from the factory; storemode is not installed, evservice is. Notes from it: # - tools/disable.sh held back gtvpai and disclaimercustomization at first: this firmware's dumpsys prints no # permission block for either, so the input-driver check cannot read them. With HDMI confirmed working # after a reboot, TVINPUT_ALLOW=1 disabled them, as the script's message says. # - setupwraith passed the Wi-Fi guard without FORCE_SETUPWRAITH: every saved network belonged to # android.uid.system. Usage & diagnostics was switched off in Settings before it was disabled. # - Unlike the third unit, with launcherx disabled and no key helper enabled only Netflix, Input and Home # worked when pressed for real; the gear, YouTube, Prime Video and Disney+ buttons did nothing. The owner # kept them unmapped rather than enable InputKeyService and lose the volume ramp (held Volume Up repeats # about every 115 ms with no helper bound). Their codes were not captured on this unit. # - The owner also disabled katniss, hisense.alexa, dreamx, AirPlay (com.mediatek.AirplayAPK and # com.mediatek.partner.airplay; AirplayAPK serves a TvInputService, so it too needs TVINPUT_ALLOW=1), # com.vt.miracast and com.hisense.tv.dlna, plus unused streaming apps and preloads; mediashell (Chromecast) # and the firmware updaters stayed on. Nothing broke, and every package stayed disabled across both reboots. # # Sixth and seventh units: two sets in one home (same device songshan, build RTT2.220118.001, incremental # 00.00.00.53, security patch 2025-06-01, Android model string "SmartTV 4K"; retail model not checked). One # session on 2026-10-29 with two reboots each: this list plus the three commented entries marked "third unit" # and com.hisense.evservice, applied in batches with a screenshot between them, then the launcher. Nothing came # disabled from the factory; storemode is not installed, evservice is. Notes from them: # - As on the fifth unit, tools/disable.sh held back gtvpai and disclaimercustomization (no permission block in # dumpsys); with every input still registered after a reboot (AV, three HDMI, the tuner, AirPlay), TVINPUT_ALLOW=1 # disabled them. # - On both, setupwraith owned one saved Wi-Fi network that the TV was not using, and the active one belonged to # android.uid.system, so disable.sh's guard held it back; FORCE_SETUPWRAITH=1 disabled it, that one saved network # was deleted and the TV stayed on Wi-Fi and ADB. Usage & diagnostics was switched off in Settings first. # - As on the third unit, with launcherx disabled and no key helper enabled, Home, Back, Input and the gear worked # when pressed for real, and a held Volume Up still ramped. # - Power-on goes FallbackHome, then the new launcher; the firmware does not put Live TV in front by itself. # - The owner also disabled katniss, hisense.alexa, mediashell, com.vt.miracast, com.hisense.tv.dlna, # com.vt.tv.homekitproxy, dreamx, HiBrowser, Play Games, Google TV Movies, YouTube Music, both VIDAA apps # (net.vidaatv.*) and every unused streaming app (the seventh unit also had YouTube TV and Haystack News); # AirPlay and the firmware updaters stayed on. Every package stayed disabled across both reboots. # - After "Revoke USB debugging authorizations", a detached `settings put global adb_enabled 0; reboot` started # from the same ADB shell never ran (port 5555 stayed open); switching USB debugging off with the remote closed it. # Retail / store demo com.hisense.storemode fusion.android.tv.demo # First-time experience (setup already complete) com.hisense.fte # Google partner auto-install stub (silent partner app installs) android.autoinstalls.config.google.gtvpai # On-screen disclaimer app (removed from the app grid) com.mstar.android.tv.disclaimercustomization # Google TV setup wizard. Its RecoveryActivity claims HOME and beats the new launcher once # com.google.android.apps.tv.launcherx is disabled, so it has to go for a launcher swap. # It also owns a saved Wi-Fi network, so check first: `dumpsys wifi | grep -o 'cname=[^ ]*'`. If the # network the TV is actually connected to belongs to setupwraith, forget and re-join it in Settings # before running this, or the disable deletes that network and takes the TV off Wi-Fi and ADB. On this # set only an unused saved network belonged to it (the active one was owned by android.uid.system), so # it was safe. Needs FORCE_SETUPWRAITH=1 to pass disable.sh's Wi-Fi guard. com.google.android.tungsten.setupwraith # Not a disable, but worth recording for this remote (Hisense SmartRC, Vendor_000d_Product_3838), for # the launcher's config.xml app_keys: YouTube is keycode 293 (KEYCODE_MIRSET2), Prime Video is keycode # 295 (KEYCODE_MIRSET4), Disney+ is scancode 484 and SonyLIV is scancode 606. The gear is keycode 83 # (KEYCODE_NOTIFICATION, so settings_key_keycodes) and Input is KEYCODE_TV_INPUT (178), which # InputKeyService handles natively. Netflix is handled by the firmware. # Second and third units only: disabled for one session and its reboots (normal boot; Home and the key helper # back on the second unit), not yet lived with for days. Hisense ACR ("Enhanced Viewing" content # recognition), as on the huangshan FFM list. # com.hisense.evservice # Third unit only, the same one session: the feed of the "Hisense" (VIDAA) tab on the Google TV home, as on # the hengshan list; partner referral tracking, as on the lushan and hengshan lists; the crash and feedback # uploader, which came disabled from the factory on the first unit. # com.vidaa.oemtabcontentprovider # com.google.android.partnersetup # com.google.android.feedback