**Wemax Go Advance = Fengmi/Formovie "Queen" on Amlogic TL1—anyone else looking at this device?**
Did a read-only ADB recon on mine (network ADB, no modifications). Sharing in case it helps anyone else and to ask if there's any existing work on this platform I've missed.
**Identification:**
- Codename: `queen`, board: `tl1`
- SoC: Amlogic TL1, 4× Cortex-A55 (running AArch32-only, no 64-bit ABIs)
- 2 GB RAM, 10 GB /data
- Android 9 (SDK 28), security patch 2019-11-05
- Build: `Fengmi/queen/queen:9/PQ3B.190705.003/2.0.0.1422:user/release-keys` (Feb 2022)
- Brand: Fengmi (Formovie internationally), rebadged as Wemax Go Advance for export
**Boot/security state:**
- AVB 2.0, vbmeta `locked`, verifiedbootstate `green`
- dm-verity `enforcing` on both /system and /vendor
- SELinux enforcing, user build, invalidate-on-error=yes
- Dedicated /mnt/vendor/tee partition (TrustZone active)
- Single-slot layout (no A/B), single-slot OTA via /cache
- /proc/partitions is denied to shell user (SELinux tightened beyond stock)
**Vendor stack:** ~25 Fengmi/Formovie system apps handling imaging, autofocus, keystone, launcher, settings, plus one custom native binder service (`media.fmplayer`). Also ships with `com.xiaomi.mi_connect_service` as a priv-app even on the export build.
**Questions for the community:**
Has anyone successfully rooted or unlocked any Fengmi/Formovie "queen" or any Amlogic TL1 projector? The main XDA Xiaomi/Fengmi/Wemax thread covers rainman/batman/jerry/eva but I haven't found queen mentioned.
Is there a known USB-burn / Amlogic emergency-flash procedure for TL1 that survives a locked vbmeta? (I'm assuming no, but asking.)
Any leaked or shared `queen` firmware dumps floating around? Even partial — boot.img, vbmeta.img, or a full update.zip — would be useful for reference.
Has anyone characterized the `media.fmplayer` binder service or the Fengmi imaging stack? Curious whether the optics control surface is reachable from userland without root.
Not planning anything destructive — fully aware that locked AVB + no A/B + no published recovery = single-shot device. Just trying to map what's been done and whether queen is a dead-end or just unexplored.
Will share my full recon dump (getprop, package list, mounts, service list, bugreport) if anyone wants it for reference.