Taking over Android photo frames
Turn a cheap Android photo frame into a family dashboard: unlock it, root it, replace the vendor app, and run your own web page full screen.
TLDR: buy a $50 frame, point an agent at this repo and let 'er rip!
▶️ Watch the video: https://youtu.be/ZLycoUMltNI
Working frames
Frames confirmed to work (Amazon affiliate links). See the device index for every
frame, which board it has, and where to start.
Community builds
More than 70 people have shared their hacked frames in Community builds: LCARS
interfaces, retro weather channels, chess puzzles, Linux on a frame, family dashboards and more.
Notes and scripts from getting full control of locked-down Android photo frames: getting ADB,
backing up the firmware, getting root, removing the vendor app, and running our own launcher,
browser and kiosk app. These are records of the units their owners tested, not universal flashing
guides.
Which frame do you have?
Frames sold under the same name, even the same Amazon listing, can have different boards. Check
Settings → About before you follow any guide:
- PF1007L / AiMOR (firmware string contains
A33 and PF1007L): Allwinner A33. Many viewers of
the video got this one. Use a USB-A to USB-C data cable; USB-C to USB-C gives no power or data.
Start with pf1007l-start-here.md. It tests
ADB over USB, then the network, and only then a boot patch. Its vendor app accepts root shell
commands from the vendor's server, so read that page before the frame goes online.
- BIUFRAME / Synergy 10X1 (Rockchip RK3126, ADB prompt on screen): the frame in the video. Follow
biuframe-setup-guide.md.
scripts/biuframe-setup.sh check
changes nothing and confirms the hardware matches; backup and apply do the rest.
- Skylight Calendar 150-CAL (Rockchip RK3566): start with next-session.md,
then app-analysis.md for the hidden menu. The manufacturer code is
intentionally not published; the doc shows where the app checks it. Check Settings → About
first: firmware
D156.V0.10 ships with ADB and su on (skylight-d156.md).
If load-usb-reader.py says the DDR helper doesn't match, stop and identify the firmware and
backup first. A different build or a wrong/corrupt backup can cause a mismatch; see
skylight-150cal-ddr-v126.md.
- LOOFII C-3 21.5" calendar (Allwinner A133, Android 10): root ADB over USB out of the box. See
allwinner-a133-loofii-c3.md; don't run the Rockchip or A33 scripts on it.
- Dromart MI86 (Frameo, firmware
wifi photo frame_20250822, platform rk312x): the unit
tested never enumerated over USB. Root and network ADB came from an SD card. Start with
dromart-mi86.md, and match the fingerprint before using the card.
- Frameo, Dragon Touch, Joyhong, Uhale, VESWWE, Pastigio and others: see the
device index.
- Something else: work through the phase map, create
docs/<device>.md, and
send in what you find.
The dashboard
dashboard/ is the family dashboard we run on the BIUFRAME (it uses mock data): a Vite
web app deployed to Cloudflare Workers. dashboard/kiosk/ is a small full-screen WebView Android app,
built without Gradle, that shows it. Hold two fingers still for 1.5 s to open a menu for the
launcher, Android settings, and reloading. On frames without system navigation, optional floating
Back and Dashboard buttons help; see the kiosk guide.
For agents: start here
You are probably helping someone with a similar device plugged into a Mac over USB. Read this
section, then follow the links for the phase you are in. Do not run anything from a device
section unless the identity checks match exactly.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
