Get started
Hardware and requirements
On this page
This page is for anyone deciding whether to start. It says which frame this project supports, what the frame is, and everything you need to gather before you begin. When you finish reading, you know whether your frame qualifies and what to have on hand.
Supported frame
The project supports one frame model: the PF1007L.
| Property | Value |
|---|---|
| Model | PF1007L |
| Screen | 10.1 inch, 1280 x 800 landscape. The panel itself is 800 x 1280 and used rotated. |
| Processor | Allwinner A33 |
| Operating system | Android 6.0.1 |
| Storage | eMMC. The tested unit is 15,758,000,128 bytes. |
| Power | USB-C. The same cable carries data to your PC. |
| Case | You never open it. You never solder. |
Firmware that was tested
The unlock was verified on one firmware build only:
AEEZO/astar_m86_8723cs:6.0.1/MOB30R/20260113:eng/test-keys
That is a January 2026 build. Other builds may store files in different places.
The unlock procedure builds its patch from a backup of your own frame, so it adapts to small differences. Nothing is verified on other builds. The tools stop with an error when they do not recognize what they find. If one stops, stop too and work out why before you go on. Do not guess.
After the unlock, you can read your own build with adb shell getprop ro.build.fingerprint. This is a standard Android property. It was not checked as part of writing this page.
Brand names
The PF1007L is sold under more than one name. Names seen so far include Humblestead and AiMOR. The stock home app on the frame is the AiMOR launcher (com.efercro.os.aimor), which the kiosk setup later disables.
If you are unsure your frame is a PF1007L, the unlock guards against a mismatch. The scripts that write to the frame accept only a USB disk of the expected size, and the patch step refuses to write unless the sector on the frame is exactly the one it expects.
Where to buy
The frames this project was built and tested on came from this Amazon listing, bought in October 2026:
Digital Picture Frame 10.1 inch, 32GB, 1280 x 800 IPS touchscreen, Wi-Fi, AiMOR app
This is a plain link: the project earns nothing from it. Listings change, and a seller can ship a different board or firmware under the same page, so check the frame when it arrives, before you start:
- The label on the back says PF1007L, and the FCC ID is 2AW9M-PF1007.
- The stock app is AiMOR.
- The screen is 1280 x 800 and the frame runs Android 6.
If any of these differ, stop: the unlock may not fit your frame. See Firmware that was tested and Other frames.
What changes on the frame
Understand these before you begin:
- You give up vendor support. The vendor's over-the-air updater is disabled and the vendor app is replaced. There is no going back to a warranty claim.
- The frame becomes a kiosk. It runs one app, full screen, with no status bar, no navigation bar and no on-screen exit.
- Root ADB has no password. After the unlock, anyone who can reach port 5555 on the frame controls it. The boot script can limit that to addresses you list. See Provisioning, step 9.
- The frame talks to your server only. It does not contact the manufacturer once the vendor updater is disabled.
What you need
For the unlock
| You need | Used for |
|---|---|
| A PF1007L and its USB-C cable | The frame itself. |
| A Windows 10 or 11 PC with WSL2 (Ubuntu 22.04 or later) | The unlock scripts call powershell.exe and PowerShell disk commands, so they do not run on a plain Linux machine without changes. |
| usbipd-win 4 or later | Passing the frame's USB connection into WSL. |
| A microSD card, any size | Booting the frame into its USB recovery mode (FEL). Its contents survive. The guide changes only bytes 8 KiB to 16 KiB. |
| About 16 GB of free disk space | The verified backup of the frame's storage. |
| About 90 minutes of waiting | The backup alone takes that long. |
| A PowerShell and a WSL shell, both open | You switch between them. |
These Linux packages are installed during the unlock: sunxi-tools, adb, e2fsprogs, fdisk, and an ARM cross-compiler with other U-Boot build tools (listed in the guide).
For the server
| You need | Used for |
|---|---|
| A Linux host with Apache 2.4 | The server runs on any Linux host. |
| A host name with a valid HTTPS certificate | The kiosk refuses plain HTTP, and the admin refuses to run without an https:// address. |
PHP 8.5 with pdo_sqlite, curl, mbstring, gd, dom, xmlreader, xmlwriter, zlib |
The server code. See Install the frame server for optional extensions. |
| Composer | One library, sabre/vobject, which reads calendars. |
| A cron user and the web server's user | Running the fetcher and the web app. |
sudo rights |
Creating folders and running commands as the web user. |
Optional: bubblewrap, libheif-examples, libheif-plugin-libde265, prlimit, nice |
The local photo library. See Photos. |
For the kiosk
| You need | Used for |
|---|---|
| Docker and Lando | Building the kiosk app with the included Lando setup (or install the JDK and Android build tools yourself). |
adb, openssl, unzip, php |
Provisioning and release signing. |
| A WebView APK, a Let's Encrypt root certificate, and optionally a launcher | Files you download yourself. See Provisioning, step 2. |
Other things worth having
- A DHCP reservation for the frame in your router. The boot script gives the frame a fixed Wi-Fi MAC address so a reservation holds.
- A Nextcloud or Home Assistant, if you want to use those widgets. Neither is required.
- Somewhere private to keep two keys. The kiosk signing keystore and the release key must be backed up and kept off the server. See Update the kiosk.
Know before you start
- Weather is US-only. It comes from the US National Weather Service.
- You need a terminal. You run shell and PowerShell commands, build an Android app, run a PHP site on Apache with a real HTTPS certificate, and add a cron job.
- The backup is private. It holds the vendor's device certificate. Keep
backups/out of Git and never share it. - Never redistribute vendor firmware or dumps. This repository ships none.
Other frames
This project is built for the PF1007L. The U-Boot patch is specific to this board, the kiosk is written for Android 6 on this screen, and the unlock was checked on one firmware build. None of it has been tested on other frames, and you should not expect it to work on them.
If you have a different frame, wesbos/photo-frame-dashboard covers other models. It inspired this project. No code or text is copied from it.
Next: Unlock your PF1007L.