open-glass — Reviving a Google Glass Explorer Edition in 2026

A complete, working revival kit for Google Glass Explorer (XE): reflash the final XE24 firmware, get a rooted adb shell, and mirror the dead prism display to your desktop — with zero on-device taps.

This repo is the field notes, tooling, and prebuilt images from a successful revival of a 2013 Google Glass Explorer Edition whose prism display is dead. Everything here was done blind (no visible UI) and is reproducible on any Linux machine with a USB-A port.

---

What this kit gets you

Capability	How
Unlocked bootloader	fastboot oem unlock (×2) — blind button combo documented
Final XE24 firmware	factory images from Google's still-live CDN (URLs + SHA-1s included)
Root adb shell, no taps	custom boot image: ro.secure=0 + forced-adb USB handlers + patched adbd
Live screen mirror	tools/glass-viewer.py → PNG frames → imv window on your desktop
Headless Wi-Fi	one am start intent with a wifi_setup_string extra (SSID/encryption/key)
Drive the UI blind	adb shell input ..., screencap OCR-ing included in the docs

The display being dead does not stop you: screencap proves the GPU renders fine, and the live viewer turns your desktop into the prism.

The three discoveries that made it work

1. The bootloader enumerates as Texas Instruments 0451:d00f ("OMAP4430"), not Google's 18d1:*. A decade of "fastboot USB is broken on Glass" reports were people watching for the wrong VID. The window lasts ~3 seconds — pre-launch fastboot in waiting mode to catch it. After oem unlock, the device reboots into a persistent fastboot gadget (18d1:9002).

2. Glass's framework forces sys.usb.config=ptp at runtime, overriding any persist.sys.usb.config you set. Stock ptp handler binds no adb function → adb invisible. Fix: patch the mtp and ptp handlers in init.omap4430.usb.rc to bind ptp,adb + start adbd.

3. XE24's adbd is a production build — it unconditionally drops to uid 2000 (mov.w r0,#0x7d0; blx setgid; ...; bl setuid at vaddr 0x9288 in adb_main). adb root prints "restarting adbd as root" then silently drops again. Fix: NOP those 24 bytes in the ramdisk's sbin/adbd.

All three fixes are baked into firmware/glass-revive-kit/xe24-boot-rooted-final.img.

Quick start

Prereqs: adb+fastboot (platform-tools 30+), Linux with native USB-A, imv for the viewer, python3 for tools. No device screen required at any point.

# 1. udev rule (one-time; root)
sudo tee /etc/udev/rules.d/51-glass.rules <<'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d00f", MODE="0666"
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d010", MODE="0666"
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="9001", MODE="0666"
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="9002", MODE="0666"
EOF
sudo udevadm control --reload && sudo udevadm trigger

# 2. Get the factory zip (system.img lives inside) and extract system.img
#    URL + SHA-1 in firmware/glass-revive-kit/README.txt

# 3. Pre-arm the flash, THEN do the blind combo (see HANDOFF.md §2)
fastboot flash boot firmware/glass-revive-kit/xe24-boot-rooted-final.img
#   ... button combo ... it latches the ~3s window automatically

# 4. Once unlocked (fastboot oem unlock twice), flash the rest
fastboot flash system system.img
fastboot flash recovery firmware/glass-revive-kit/recovery.img
fastboot erase cache && fastboot erase userdata
fastboot reboot

# 5. Root shell — no taps, no authorization prompt
adb shell id          # → uid=0(root)

# 6. Live prism mirror (install imv first)
tools/glass-viewer.py          # writes /tmp/.../prism.png, shows it in imv

Full details, the blind button combo, failure modes, and rebuild instructions: HANDOFF.md — start there. The step-by-step procedure with udev and VID notes: firmware/glass-revive-kit/README.txt. The full story with evidence: SESSION-LOG-2026-10-04.md.

Headless Wi-Fi (no UI, no keyboard)

Every "obvious" path fails on XE24 (root file writes → SELinux wifi_data_file; binder service call wifi → state machine stuck in ScanModeState; the Settings UI → Glass's own startScanActive reflection bug). The one that works is the MyGlass-companion setup path, found by disassembling GlassSettings.apk:

adb shell am start -n com.google.glass.settings.ui/.WifiSelectorActivity \
   --es wifi_setup_string "$(printf 'MySSID\nWPA\nMyPassword')"

MyGlass is dead; its setup intent lives on. Set your timezone too: adb shell setprop persist.sys.timezone <zone> (persistent processes cache it at boot — reboot once after setting).

Repo layout

HANDOFF.md                          knowledge base: procedure, quirks, rebuild notes
SESSION-LOG-2026-10-04.md           chronological story + evidence
firmware/glass-revive-kit/
  xe24-boot-rooted-final.img        THE boot image to flash (all three fixes)
  xe24-boot-rooted-custom.img      earlier build, kept for history
  adbd-xe24-nop-drop.bin           the patched adbd binary alone
  recovery.img                     factory XE24 recovery
  README.txt                       step-by-step flash procedure + download URLs
firmware/bootimg.py                 boot.img unpack (repack is broken — use the
                                    pure-python builder described in HANDOFF §8)
tools/glass-viewer.py               live screen mirror (imv-based)

Warnings

• This erases the device. oem unlock + flashing wipes userdata. You will not be the first person to lose vacation photos to a Glass; you will be the first to lose them twice.
• Old battery: treat it gently. If it has swollen, stop and recycle the unit.
• You own this hardware; modding it is your business. This repo is for preservation, not piracy — all firmware comes from Google's own CDN.
• The MyGlass companion servers are dead; the device works standalone.

Status of this specific unit (the one the kit was built on)

Flashed, unlocked, rooted, on Wi-Fi, internet + NTP verified, UI rendering confirmed via screencap. The prism is the only dead part (boom flex cable — the classic XE failure); the live viewer substitutes for it until it's physically repaired.

License

MIT — see LICENSE. No warranty; Glass is 13-year-old hardware, flash at your own risk.