Frameo / Flyruit M10R5: restoring ADB access

There’s one thing I hate more than the flu: Devices I buy but can’t use the way I want to. Here’s how I enforced my will onto the device.

The Frameo electronic picture frame is pretty much an android tablet with .. well, a frame. And it works, but not the way I wanted it to. But it’s Andoid (7) so, it should allow me to install my apps. Right? Well ..

While ADB recognized a connected device, it always returned with “not authorized”. This severely dented my ego, because technology, especially when I have paid for it, is supposed to submit to my wished. Why is that piece of plastic defying me? Well, I summoned my powers as an IT engineer, sunxi-tools and AI, and accepted the challenge.

The normal USB identifier established the Allwinner vendor family as expected. I built the tools and wrote sunxi-fel onto an SD card.

sudo dd if=sunxi-tools/bin/fel-sdboot.sunxi of=/dev/sdg bs=1024 seek=8 conv=notrunc,fsync

After that, the device was rebooted, the screen stayed black. I verified that it had it’s tail between it’s legs:

sudo ./sunxi-tools/sunxi-fel version

and a quick lsusb -d gave the results I was looking for:

Bus 001 Device 041: ID 1f3a:efe8 Allwinner Technology sunxi SoC OTG connector in FEL/flashing mode

Nice. It was now presenting it’s soft underbelly. Sunxi-tools also reported the processor type as an Allwinner A33. chatGPT suggested to unleash photo-frame-dashboard from github and that was good advice. After building, I exposed the device’s memory:

./sunxi-tools/sunxi-fel -v -p uboot diagnostics/a33-uboot-out/u-boot-sunxi-with-spl.bin write 0x43100000 diagnostics/a33-uboot-out/ums-readonly.scr

and there it was, all of it’s memory, waiting for me (and my AI companion) to start poking. So, I pulled all of the device’s memory onto my hard disk.

dd if=/dev/sdj of=/home/misch/frame-backup/flyruit-m10r5-original.img bs=4M iflag=fullblock status=progress conv=fsync

That was painfully slow, giving me an opportunity to watch some “Fluffy” on the tube. After all was copied and verified, I asked chatGPT to check whether or not the UI had been disabled (as some folks suggested).

grep -E '^ro.(build|product|hardware|secure|debuggable)'
/mnt/flyruit-system/build.prop

find /mnt/flyruit-system/app /mnt/flyruit-system/priv-app
-iname 'systemui'

The results clearly showed that the UI was available.

ro.build.id=MOB30R
ro.build.display.id=M10R5_20260617
ro.build.version.incremental=20260617
ro.build.version.sdk=23
ro.build.version.preview_sdk=0
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=6.0.1
ro.build.version.security_patch=2018-08-05
ro.build.version.base_os=
ro.build.date=Wed Jun 17 10:14:51 CST 2026
ro.build.date.utc=1781662491
ro.build.type=user
ro.build.user=mid233

So – that wasn’t the problem. After a few more tests, it became clear that even though I already managed to allow adb access, there were no authorized keys and the device wouldn’t add them (it never showed the UI to accept the ADB connection).

A quick python script would allow me to patch my adb key onto the device.

The patch went well, and I was ready to reboot. I removed the microSD and power cycled, then connected the frame back to USB.

#adb devices
List of devices attached
9e70acd7b6a700000000 device

#adb shell id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb), 1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt), 3003(inet),3006(net_bw_stats) context=u:r:shell:s0

Cool. We were in business. The defiance was broken and I am now able to use adb as extected on a well behaved Android system.

There are more steps involved, so I asked chatGPT to write a more technical report here.

Enjoy. And never let a device you own defy you. You have been warned.

Michaela Merz is an entrepreneur and first generation hacker. Her career started even before the Internet was available. She invented and developed a number of technologies now considered to be standard in modern web-environments. She is a software engineer, a Medical Rescue volunteer, an Advanced Emergency Medical Technician, a FAA Part 61 (PPL , IFR) , Part 107 certified UAS pilot and a licensed ham . More about Michaela ..