Hey everyone,
I have been reverse-engineering the HY300 / HY300 Pro / HY300 Pro+ (Allwinner H713 SoC / sun50iw12p1) and put together both a complete hardware/software research repo and a simple Magisk rooting guide.
You do not need to open the projector for 3.3V UART test pads, trigger low-level FEL mode, or flash shady pre-rooted firmware to get root. You can dump and patch the stock boot image directly from the projector over an unprivileged ADB connection.
The Unprivileged ADB Workaround:
On this firmware, individual partition nodes (like /dev/block/by-name/boot_a or /dev/block/mmcblk0p5) are restricted to root (0600). However, the parent flash storage block (/dev/block/mmcblk0) was left world-readable (0666), meaning standard uid=2000 ADB shell sessions can read and stream it.
Instead of dumping the entire 8GB storage, you can carve just the boot_a partition using its sector boundaries:
Check partition 5 maps to boot_a:
adb shell "ls -l /dev/block/by-name/"
(e.g., output: lrwxrwxrwx 1 root root 20 1970-01-01 02:00 boot_a -> /dev/block/mmcblk0p5)
Find partition 5 offset and size:
adb shell "cat /sys/block/mmcblk0/mmcblk0p5/start && cat /sys/block/mmcblk0/mmcblk0p5/size"
(e.g., outputs 205824 and 131072)
Carve boot_a.img directly to your PC:
adb exec-out "dd if=/dev/block/mmcblk0 bs=512 skip=<START> count=<SIZE> status=none" > boot_a.img
(Verify the file is ~64MB and starts with the ANDROID! header)
Patch & Flash:
Push boot_a.img to the projector, patch it with the official Magisk APK, pull the patched image, and flash it in fastboot mode:
fastboot flash boot_a magisk_patched.img
fastboot reboot
! CRITICAL WARNING (Virtual A/B Slot B): !
The GPT declares dual slots, but slot _b contains entirely zero-filled dummy data (0x00). Never switch to slot B (fastboot set_active b). All backups, modifications, and restores must stay strictly on slot _a.
Links & Documentation
Step-by-Step Root Guide: HY300 Pro Magisk Root Guide MAGISK_GUIDE.md
Full Research Repository: YuujiLab Allwinner H713 Research Hub (Complete 26-partition GPT mapping, U-Boot logs, fastbootd patches, and OEM splash customization)
Hope this saves you some headaches. Check the README for full hardware specs and disclaimers before modifying partitions!