Community guide: Pexar PX-110 / Frameo to Immich Kiosk

[theluke]

Summary

I converted a Pexar Frame PX-110 running Frameo into a LAN-only Immich photo
frame using Immich Kiosk and Fully
Kiosk Browser. This is a community deployment report, not an Immich bug or an
officially supported configuration.

The useful Pexar-specific findings were:

• the factory WebView 83 rendered the current Kiosk UI successfully, despite the
  commonly documented WebView 101 minimum;
• the OEM Package Manager rejects every new package name, including Fully;
• the Frameo app owns the Wi-Fi profile, so disabling the whole app also deletes that
  network unless it is recreated first;
• with Frameo disabled, this firmware has no HOME activity and leaves the Pexar boot
  animation over the running browser forever;
• a tiny zero-permission HOME redirector solved startup without modifying the system
  partition or enabling Fully's paid kiosk mode.

After repeated cold boots, the final path is:

Android HOME -> permission-free redirector -> Fully Kiosk -> Immich Kiosk -> Immich

Tested hardware and software

Item	Value
Frame	Pexar Frame / Lexar PX-110
Device	dpf1106_mk_32
Firmware	PF1106_V2.05_20250102
Android	11 / SDK 30
ABI	armeabi-v7a
System WebView	83.0.4103.120
Root	AOSP su; use su 0 <command>, not su -c
Browser	Fully Kiosk Browser 1.57.1
Immich	3.1.0

1. Back up before changing anything

The USB-C connection carries both power and data. Keep it connected, preferably through
a powered hub, until several reboots have passed.

On this firmware the original Frameo media was under:

/storage/emulated/0/frameo_files/media

The commonly referenced path under
/storage/emulated/0/Android/data/net.frameo.frame/files was empty. I backed up both
the shared tree and private app state before continuing:

adb exec-out su 0 tar -C / -cf - \
  data/user/0/net.frameo.frame \
  storage/emulated/0/frameo_files > pexar-frameo-backup.tar
sha256sum pexar-frameo-backup.tar

I also extracted and hashed every file in frameo_files/media, then compared that
manifest with hashes calculated directly on the frame. Nothing was deleted from the
frame.

2. Enable ADB and confirm the device

Enable Frameo's beta program under Settings -> About, connect USB, accept the ADB
authorization prompt, and inspect the device:

adb devices -l
adb shell getprop ro.product.model
adb shell getprop ro.build.display.id
adb shell dumpsys webviewupdate
adb shell su 0 id

Wireless ADB worked for a session after adb tcpip 5555, but USB remained the recovery
path.

3. Work around the Pexar package allowlist

Normal installation failed with:

INSTALL_FAILED_INVALID_APK: Package de.ozerov.fully is not allow to install.

The Pexar-modified PackageManagerService checks whether the incoming package name is
already a system app. Root does not bypass that check.

The frame had an expendable factory diagnostic APK at
/system/app/HCNDeviceTest/HCNDeviceTest.apk. I first copied and hashed it off-device.
Then I used a temporary bind mount to let Package Manager see Fully as a system app,
before installing the same signed APK normally:

adb push Fully-Kiosk-Browser-v1.57.1.apk /data/local/tmp/Fully.apk
adb shell su 0 mount -o bind \
  /data/local/tmp/Fully.apk \
  /system/app/HCNDeviceTest/HCNDeviceTest.apk
adb shell su 0 setprop ctl.restart zygote

# Wait for Android services, then confirm this resolves to the temporary system path.
adb shell pm path de.ozerov.fully

adb install -r Fully-Kiosk-Browser-v1.57.1.apk
adb reboot

The reboot removed the bind mount and restored the factory APK bytes. Fully remained as
a normal /data/app package. This is still a risky OEM workaround: verify paths on your
own model, back up the displaced APK, and do not assume another Frameo device has the
same layout.

4. Make Wi-Fi independent of Frameo

On this unit, dumpsys wifi showed the saved network was created by
net.frameo.frame. Running pm disable-user caused Android to remove that network and
disconnect immediately.

The least surprising fix is to join Wi-Fi from Android system settings before disabling
Frameo, as the Immich Kiosk Frameo guide recommends. This firmware also supports:

adb shell cmd wifi help
adb shell cmd wifi connect-network YOUR_SSID wpa2 YOUR_PASSPHRASE

I backed up the protected WifiConfigStore.xml, recreated the same network through
cmd wifi, and verified it was owned by UID 0 and survived with Frameo disabled. Take
care not to expose the passphrase in shell history or logs.

5. Configure Fully and solve unattended boot

Fully was configured with the Kiosk URL, no address/status/navigation bars, screen kept
on, and no paid kiosk mode.

Disabling Frameo exposed another Pexar quirk: the only HOME activity disappeared, so
bootanim remained running even though sys.boot_completed=1, Wi-Fi was connected, and
Fully was rendering underneath. Fully's built-in replacement HOME activity enabled its
paid kiosk workflow and showed license/permission dialogs.

I installed this minimal HOME app through the same temporary allowlist method. It has
no permissions and only forwards HOME to Fully.

Manifest essentials:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="local.photoframe.launcher">
  <uses-sdk android:minSdkVersion="23" android:targetSdkVersion="28" />
  <application android:allowBackup="false"
      android:theme="@android:style/Theme.Material.NoActionBar.Fullscreen">
    <activity android:name=".MainActivity" android:exported="true"
        android:excludeFromRecents="true" android:stateNotNeeded="true">
      <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.HOME" />
        <category android:name="android.intent.category.DEFAULT" />
      </intent-filter>
    </activity>
  </application>
</manifest>

Activity:

package local.photoframe.launcher;

import android.app.Activity;
import android.content.Intent;
import android.graphics.Color;
import android.graphics.drawable.ColorDrawable;
import android.os.Bundle;

public final class MainActivity extends Activity {
  @Override protected void onCreate(Bundle state) {
    super.onCreate(state);
    getWindow().setBackgroundDrawable(new ColorDrawable(Color.BLACK));
    launchFully();
  }

  @Override protected void onNewIntent(Intent intent) {
    super.onNewIntent(intent);
    launchFully();
  }

  private void launchFully() {
    Intent intent = getPackageManager().getLaunchIntentForPackage("de.ozerov.fully");
    if (intent != null) {
      intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP | Intent.FLAG_ACTIVITY_SINGLE_TOP);
      startActivity(intent);
    }
  }
}

After installing and selecting it:

adb shell cmd package set-home-activity --user 0 \
  local.photoframe.launcher/.MainActivity
adb shell pm disable-user --user 0 net.frameo.frame

Android now has a real HOME activity, stops the Pexar animation normally, and the helper
opens Fully. The factory-disabled Android System UI remained disabled.

Result and rollback

The setup passed repeated cold boots with Frameo disabled: boot animation exits, Wi-Fi
reconnects, Fully opens fullscreen, and Kiosk begins rotating assets. No system WebView
replacement was needed.

To restore Frameo over USB ADB:

adb shell pm enable --user 0 net.frameo.frame
adb shell pm enable --user 0 \
  net.frameo.frame/.ui.activities.AWaitForDeferredInitCompleted
adb shell cmd package set-home-activity --user 0 \
  net.frameo.frame/.ui.activities.AWaitForDeferredInitCompleted
adb shell am start -n \
  net.frameo.frame/.ui.activities.AWaitForDeferredInitCompleted

The existing Immich Kiosk Frameo guide
was the starting point. The Pexar allowlist, Frameo-owned Wi-Fi, and missing-HOME boot
animation behavior were the additional model-specific pieces needed here.