Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,781,254 Members 35,990 Now Online
XDA Developers Android and Mobile Development Forum

THBK1-10 thread: extend, root, hack !

Tip us?
 
Graveen
Old
(Last edited by Graveen; 24th August 2014 at 09:32 PM.)
#1  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
Tablet THBK1-10 thread: extend, root, hack !

Hello,

I'm the proud owner of an hybrid monster, called THBK1-10.

This is basically an affordable tablet, running both Windows 8 and Android 4.2.2.
10.1 display, running x86 Atom 4cores, 2Gb RAM, 32Gb eMMC, USB host enabled. It is shipped with an external keyboard/touchpad (no port, no battery, no extended storage on it). More informations: http://www.thomsoncomputing.eu/dualboot.html

Windows 8 comes in x86 flavor...
The boot process let you choose Windows or Android.

There is no play store. My main goal actually is:
- (ok) rooting Android part
- (ok) installing Play Store
- (ok) increasing space
- (nok) installing a recovery (CWM/TWRP) allowing you to flash non-signed updates
- (nok) running Linux from an external USB drive

Partition layout: http://forum.xda-developers.com/show...52&postcount=8
Rooting / play store guide: http://forum.xda-developers.com/show...29&postcount=9
Known clones: http://forum.xda-developers.com/show...9&postcount=10
Increasing space with external SD: http://forum.xda-developers.com/show...9&postcount=17
Timezone issue Android/Windows: http://forum.xda-developers.com/show...0&postcount=19

Have fun !
The Following 6 Users Say Thank You to Graveen For This Useful Post: [ Click to Expand ]
 
GoodDayToDie
Old
#2  
Recognized Developer
Thanks Meter 2,689
Posts: 5,659
Join Date: Jan 2011
Location: Seattle
I know there are EXT2 drivers for Windows, and EXT3 is just EXT2 + Journaling (the journaling is an important feature, but it's not part of the security model). However, I'm not sure if any of those drivers can modify file permissions. Alternatively, one could of course hex-edit the Android partition and try to tweak the file permissions that way, but that would require much more understanding of the EXT filesystem than I have. The source code is all open, though...
Win8/Windows RT projects:
List of desktop apps for hacked RT devices

WP8 projects:
Native Access WebServer and Libraries
WP8 Interop Unlocks
Storage Cleanup tool

WP7 projects:
XapHandler, Root Webserver, OEM Marketplace XAPs, Bookmarklets collection (Find On Page), Interop-unlock hacks.


Do not private message me with questions that should have been posted on the forum! Not only are you wasting your time - I'm not going to bother writing an answer to such a question for only one person - but I will probably block you from PMing me in the future as well.
The Following 2 Users Say Thank You to GoodDayToDie For This Useful Post: [ Click to Expand ]
 
Graveen
Old
(Last edited by Graveen; 1st July 2014 at 12:46 PM.)
#3  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
Thank you. Here is what i did:

a) trying to handle EXT3 fs from Windows
-> with Ext2Fsd, i have accesses to all the partitions, including /system and /data, but unfortunatly, permissions are not correct
-> i trying with other tool (Explore2Fs) not luck
-> ltools seems to provide a lattr util that could do it, but i'm unable to see the files (certainly because of the GPT partition

b) trying to use VirtualBox with raw disk access for handling, with a linux guest, permissions:
-> up to partition 7, this seems correct
-> from partition 8 (/system), i can mount it in RO but it crashes in RW

c) trying to boot to any linux supporting EFI32 and GPT
-> thanks to paperwastage, i could achieve it (thread here: http://forum.xda-developers.com/show....php?t=2500078 )
-> i have strange troubles: the system only detect mmcblk0 to mmcblk7, and is throwing an error (error -110 + unknow command)
-> both, in clonezilla and ubuntu

d) tryed to use so android local tricks to force change mode, but once, i'm stuck with no eXecute flag. I dig around the local.prop or any stuff that would help me to achieve this goal. The recovery is not available (nor i found it) and the only thing i can do is factory reset.

It really seems only Windows got the proper drivers for this eMMC. This could explain why i had hard time to dump it (and, actually, i would not try to restore b/c i'm not sure everything is backuped correctly and don't want to brick my tablet), and why i could only write from Windows and why it cuts at partition7 (i have at least 12 partitions. NTFS windows main is the #11 iirc)

What i could try actually:
-> double check with newer ubuntu (when i started "install to disk", it seems it could detect the whole disk, have to look again)
-> double check with local THBK install (copy 3 apks bundled with the tablet, but perhaps a command script is available to be executed ?)
-> double check with virtual box & raw disk acces (i focused on /system, but perhaps /data is ok ?)
-> recompile Ext2Fsd to have different default properties
-> dig the hardware to see if a real recovery boot is not available, or change the recovery to something more usefull than factory reset


Thank you if you have more and more ideas
The Following 2 Users Say Thank You to Graveen For This Useful Post: [ Click to Expand ]
 
Graveen
Old
#4  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
Quick notes:

- THBK1 does NOT connect to PC/MAC
- THBK1 does NOT have USB Debug activated. The micro-usb is aimed to put a (normal) cable, not an OTG one nor a charging cable. You can reach ADB only over Wireless.

-> Currently trying TowelRoot with different parameters, but for now not successfull. Basically this is a 4.2.2 kernel so i could expect a low resistance at exploits, it worths to be tested
The Following 2 Users Say Thank You to Graveen For This Useful Post: [ Click to Expand ]
 
Graveen
Old
#5  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
Good news, i was able to boot from an USB stick (with EFI), and while the MMC is not accessible, i found a trick to change permissions.

I have now full R/W support on EXT3 partition.

But sadly SU is not enough to gain root accesses.... damn.

Anyone able to find doc or explain how root access is triggered ?
The Following 2 Users Say Thank You to Graveen For This Useful Post: [ Click to Expand ]
 
Graveen
Old
(Last edited by Graveen; 4th July 2014 at 09:54 AM.) Reason: precisions
#6  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
I found an update, and i'm now able to flash the whole system partition. Sadly, i could not flash another update.zip, so i guess this is signed (and sadly it is).

I have also tryed z4root, towelRoot exploits, not working.

Basically i could somehow bypass the sign system in applying myself the content of the update.zip (as long as it deals with /data and /system files & perms). I'll try that for at least google apps.

edit: ok i have now play store and the whole google suite is working after a big playstore update (talkback, vocal syntgetisis and so on). Only google+ is FCing but it should only be a matter of installation. I should remove it and reinstall it from the market.

Only thing missing is root

Status on Android forum side: http://forum.xda-developers.com/andr...1/post53896017
The Following 3 Users Say Thank You to Graveen For This Useful Post: [ Click to Expand ]
 
Graveen
Old
(Last edited by Graveen; 7th July 2014 at 04:24 PM.)
#7  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
As today, the tablet is now rooted. It works flawlessly.

Next step is the handling of recovery to flash non-signed zip files. It would ease the process of installing GAPPS or rooting the tablet.

But i'll take a break before

TODO list, from top to crazy:
- recovery
- test and deploy various system tweaker sur as Xposed framework
- bugfix vibrator (only working when you hit Windows button, not in apps)
- new rom, new kernel
 
Graveen
Old
#8  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
Here is the actual partition layout:

Code:
Model: MMC BIWIN (sd/mmc)
Disk /dev/mmcblk0: 30.9GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End     Size    File system  Name                          Flags
 1      1049kB  269MB   268MB   fat16        ANDROID!bootloader    boot, hidden, legacy_boot
 2      269MB   337MB   67.1MB               ANDROID!panic
 3      337MB   873MB   537MB   ext4         ANDROID!factory
 4      873MB   2484MB  1611MB               ANDROID!fake
 5      2484MB  2618MB  134MB   ext4         ANDROID!config
 6      2618MB  4229MB  1611MB  ext4         ANDROID!cache
 7      4229MB  5303MB  1074MB  ext4         ANDROID!logs
 8      5303MB  7450MB  2147MB  ext4         ANDROID!system
 9      7450MB  11.7GB  4295MB  ext4         ANDROID!data
10      11.7GB  11.7GB  1049kB               ANDROID!misc
11      11.7GB  11.8GB  33.6MB               ANDROID!boot
12      11.8GB  11.9GB  134MB                ANDROID!recovery
13      11.9GB  11.9GB  33.6MB               ANDROID!droidboot
14      11.9GB  12.3GB  315MB   ntfs         Basic data partition          diag
15      12.3GB  12.5GB  273MB   fat32        EFI system partition          boot
16      12.5GB  12.7GB  134MB                Microsoft reserved partition  msftres
17      12.7GB  30.9GB  18.3GB  ntfs         Basic data partition          msftdata
I'm not able to read the partition w/o filesystem (2, 4, 10, 11, 12, 13).
I tryed with yaffs2, but i'm not able to see them (and since it is not MTD...)
I'm working on dd image of the 32Gb MMC.

In example, hexdump of partition 12 shows it is a kernel. Certainly the recovery kernel directly flash, i should dig this.
still wondering what to put into my signature...
The Following User Says Thank You to Graveen For This Useful Post: [ Click to Expand ]
 
Graveen
Old
(Last edited by Graveen; 27th July 2014 at 06:13 PM.) Reason: precisions + attached SU
#9  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
Tablet Guide: installing Google Apps and Rooting the tablet

/!\ Please click thanks or offer me a coffee with donate if it was usefull for you /!\

This is rather technical, but i can help if you are stuck. Thank you for your comments.

Here is how you could install Google App suite to the THBK1-10.
In short, this is a white branded tablet, based on Intel Bay Trail Z3470D, with 2Gb RAM, and it comes in 32 or 64 Gb flavor, although you can have, AFAIK in single boot only, the 16Gb version. So, this tablet is also know as:

- Danew i1012 dual boot (strictly identical to Thbk1)
- VOYO A1 (Windows 8 only).
- Cube U100GT (Windows 8 only)

(tbc)
- Ramos i10 pro (dual boot)

and certainly many ones based on Inside H2O bios, board name: CARD_B (see above for detailled specs)

Basically, to install some stuff, the concept is to get rid of all the caveats (special MMC drivers, EFI 32 bits with GPT, etc...) through actual Windows 8.1 installation. Everything takes place through classic Windows desktop. For convenience, personnally worked with TeamViewer, doing this with the dock/touchpad is pain in the ass. You can void your warranty and break the android part of your tablet, so operate carefully, i'm not responsible of what you do !

This leads to 3 phases:
a) accessing EXT4 Android partitions
b) transfer files from Windows to Android
c) change permissions

a) Accessing EXT4. I used coLinux to access and handle Android EXT4 partitions:
- download and install coLinux http://sourceforge.net/projects/coli...d?source=files. At the 'Choose components' screen, uncheck 'Root filesystem image Download', and accept everything (including TAP drivers)
- download and unzip Debian Squeeze image in coLinux folder (c:\program files\colinux). Warning, this leads to a 2Gb file, ensure you have proper space. You could unzip it in your external SDcard, but you would have to change the path to rootfs and swap in above squeeze.conf
http://sourceforge.net/projects/coli...ze.7z/download
- test it: click on the squeeze.bat file into c:\program files\colinux (if you have an error co-slirp, simply close colinux and restart it). Once you have the 'debian login:' prompt simply type root then enter. You are now under coLinux.
- you should now update your /etc/apt/sources.list file:
Code:
nano /etc/apt/sources.list
- fill with the following lines (remove all before)
Code:
deb http://ftp.fr.debian.org/debian/ squeeze main contrib non-free
deb http://security.debian.org/ squeeze/updates main contrib non-free
- update your apt repository:
Code:
apt-get update
- you would want to change the keyboard layout if necessary: http://colinux.wikia.com/wiki/CoLinuxKBD.
- you would like to sync the clock from Linux with Windows: edit /etc/default/rcS and change UTC=yes to UTC=no
Code:
nano /etc/default/rcS
You can exit coLinux, we have things to tweak now.You can then download the attached Squeeze.conf, and put it into your colinux folder, replacing the old. Remember, if you have changed the path for rootfs and swap, you must change them to reflect your current installation.

Squeeze.conf:
Code:
kernel=vmlinux
cobd0="c:\program files\coLinux\rootfs_2gb.img"
cobd1="c:\program files\coLinux\\swap_128mb.img"
cobd8=\Device\HarddiskVolume8
root=/dev/cobd0 ro
initrd=initrd.gz
mem=256
eth0=slirp

b) transfer files from Windows to coLinux
You can use numerous method. I'll explain the easiest, but choose w/e you want (think nfs or ftp). The goal is to have the whole google apps folder on coLinux filesystem.
- share from Windows C:\Users\<YourUser>
- download and install , under colinux, smbfs

Code:
apt-get update
apt-get install smbfs
- Create a directory in /mnt
Code:
mkdir /mnt/win
- then mount your windows desktop intot this brand new folder:
Code:
smbmount //10.0.2.2/Users/<YourUser>/Desktop /mnt/win -o username=<User>,password=<myTrickyPassword>
FOLLOW THE ABOVE ONLY FOR GAPPS:

- You must now download the google apps files. The operation is done under Windows:
download Android 4.2.2 ones: http://goo.im/gapps/gapps-jb-20130812-signed.zip and unzip.
Extract them and copy them into a folder called google, that you will put on your desktop. This folder, now called google, must contains the whole gapps (you 'll see folders named: system, META-INF, optional...).
You must directly DELETE 3 files and 1 folder:
file system\app\GooglePlus.apk
file system\app\LatinImeDictionary.apk
file system\lib\libjni_latinime.so
fodler system\tts

If everything is ok, browsing /mnt/win/google from coLinux (not windows)
Code:
ls /mnt/win/google
should show the google directory content (META-INF,system,optional,...).

FOLLOW THIS ONLY IF ROOT:

- You must now copy su binary to your tablet: download attached files, unzip, copy it to your windows desktop shared folder
Nota: this file is extracted from Koush' superuser APK. This is the x86 su binary. Feel free to replace with newest version if available or if you fear something

FOLLOW THIS IF ROOT & GAPPS

c) access to Android partition
- create a system folder in /mnt
Code:
mkdir /mnt/system
- mount android to system
Code:
mount /dev/cobd8 /mnt/system
- check you are ok with
Code:
ls /mnt/system
You must see app, bin, usr, etc .... folders.

*** at this point, /mnt/system contains ALL your android system. NO MISTAKE ! ***

FOLLOW THIS ONLY IF GAPPS

- part 1: removing files. Browse to /mnt/system/app and CAREFULLY delete the 8 files (some could be missing, don't bother):
Code:
cd /mnt/system/app
rm Provider.apk
rm Provider.odex
rm QuickSearchBox.apk
rm QuickSearchBox.odex
rm SetupWizard.apk
rm SetupWizard.odex
- part2: copy. Copy the files from Windows to Android - it could take up to 2 minutes -
Code:
cp -rp /mnt/win/google/system/* /mnt/system
- then fix the permissions:
Code:
chmod -R 755 /mnt/system/addon.d
chmod 755 /mnt/system/app/*
sync
At this point, this is over. You can exit from colinux, reboot to Android, and come back to windows uninstalling coLinux, if anything is ok
The whole GAPPS are installed. Enjoy !

FOLLOW THIS ONLY IF ROOT

- copy attached x86 su binary to android
Code:
cp -p /mnt/win/su /mnt/system/bin
- then fix the permissions:
Code:
chmod 755 /mnt/system/bin/su
chmod u+s /mnt/system/bin/su
ln -s /mnt/system/bin/su /mnt/system/xbin/su
sync
At this point, this is over. Reboot, you can now download and install superuser https://f-droid.org/repository/brows...utta.superuser
Your tablet is now rooted. Enjoy !
Attached Files
File Type: 7z su.7z - [Click for QR Code] (252.3 KB, 27 views)
still wondering what to put into my signature...
The Following 5 Users Say Thank You to Graveen For This Useful Post: [ Click to Expand ]
 
Graveen
Old
#10  
Graveen's Avatar
Senior Member - OP
Thanks Meter 33
Posts: 105
Join Date: Nov 2010

 
DONATE TO ME
Know clones (feel free to help):

- Danew i1012 dual boot (strictly identical to Thbk1)

- VOYO A1 (Windows 8 only).
- Cube U100GT (Windows 8 only)

Certainly clones:

- Ramos i10 pro (dual boot)
- Pipo W1 / Work W1 (Windows 8 only)
- ColorFly i106 (Windows 8 only)
- Toshiba WT8-AT01G (Windows 8 only)
still wondering what to put into my signature...

Tags
thbk1 thomson android windows hack
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes