Samsung Galaxy Alpha (SM-G850) Gets Android 5.0

An Android 5.0 Lollipop update is finally available to download for the Samsung Galaxy … more

Do You Use 4:3 or 16:9 in the Camera App?

Every person has their own method of taking the best photos on their devices, but which aspect … more

LG G4 XDA Forum Opened

LG’s latest & greatest is just a few hours away from launching, and with so many power users that are … more

Android Wear Close to Running on Samsung Gear 2

Android is an OS that can sometimes be ported to run on devices not designed to … more
Post Reply Subscribe to Thread Email Thread

Tablet THBK1-10 thread: extend, root, hack !

29th June 2014, 06:32 PM |#1  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me

I'm the proud owner of an hybrid monster, called THBK1-10.

This is basically an affordable tablet, running both Windows 8 and Android 4.2.2.
10.1 display, running x86 Atom 4cores, 2Gb RAM, 32Gb eMMC, USB host enabled. It is shipped with an external keyboard/touchpad (no port, no battery, no extended storage on it). More informations:

Windows 8 comes in x86 flavor...
The boot process let you choose Windows or Android.

There is no play store. My main goal actually is:
- (ok) rooting Android part
- (ok) installing Play Store
- (ok) increasing space
- (nok) installing a recovery (CWM/TWRP) allowing you to flash non-signed updates
- (nok) running Linux from an external USB drive

Partition layout:
Rooting / play store guide:
Known clones:
Increasing space with external SD:
Timezone issue Android/Windows:
BIOS default (SlateDroid):

Have fun !
Last edited by Graveen; 17th September 2014 at 09:46 PM.
The Following 7 Users Say Thank You to Graveen For This Useful Post: [ View ]
30th June 2014, 06:52 PM |#2  
Recognized Developer
Flag Seattle
Thanks Meter: 2,826
I know there are EXT2 drivers for Windows, and EXT3 is just EXT2 + Journaling (the journaling is an important feature, but it's not part of the security model). However, I'm not sure if any of those drivers can modify file permissions. Alternatively, one could of course hex-edit the Android partition and try to tweak the file permissions that way, but that would require much more understanding of the EXT filesystem than I have. The source code is all open, though...
The Following 2 Users Say Thank You to GoodDayToDie For This Useful Post: [ View ]
1st July 2014, 12:34 PM |#3  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
Thank you. Here is what i did:

a) trying to handle EXT3 fs from Windows
-> with Ext2Fsd, i have accesses to all the partitions, including /system and /data, but unfortunatly, permissions are not correct
-> i trying with other tool (Explore2Fs) not luck
-> ltools seems to provide a lattr util that could do it, but i'm unable to see the files (certainly because of the GPT partition

b) trying to use VirtualBox with raw disk access for handling, with a linux guest, permissions:
-> up to partition 7, this seems correct
-> from partition 8 (/system), i can mount it in RO but it crashes in RW

c) trying to boot to any linux supporting EFI32 and GPT
-> thanks to paperwastage, i could achieve it (thread here: )
-> i have strange troubles: the system only detect mmcblk0 to mmcblk7, and is throwing an error (error -110 + unknow command)
-> both, in clonezilla and ubuntu

d) tryed to use so android local tricks to force change mode, but once, i'm stuck with no eXecute flag. I dig around the local.prop or any stuff that would help me to achieve this goal. The recovery is not available (nor i found it) and the only thing i can do is factory reset.

It really seems only Windows got the proper drivers for this eMMC. This could explain why i had hard time to dump it (and, actually, i would not try to restore b/c i'm not sure everything is backuped correctly and don't want to brick my tablet), and why i could only write from Windows and why it cuts at partition7 (i have at least 12 partitions. NTFS windows main is the #11 iirc)

What i could try actually:
-> double check with newer ubuntu (when i started "install to disk", it seems it could detect the whole disk, have to look again)
-> double check with local THBK install (copy 3 apks bundled with the tablet, but perhaps a command script is available to be executed ?)
-> double check with virtual box & raw disk acces (i focused on /system, but perhaps /data is ok ?)
-> recompile Ext2Fsd to have different default properties
-> dig the hardware to see if a real recovery boot is not available, or change the recovery to something more usefull than factory reset

Thank you if you have more and more ideas
Last edited by Graveen; 1st July 2014 at 12:46 PM.
The Following 3 Users Say Thank You to Graveen For This Useful Post: [ View ]
1st July 2014, 04:39 PM |#4  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
Quick notes:

- THBK1 does NOT connect to PC/MAC
- THBK1 does NOT have USB Debug activated. The micro-usb is aimed to put a (normal) cable, not an OTG one nor a charging cable. You can reach ADB only over Wireless.

-> Currently trying TowelRoot with different parameters, but for now not successfull. Basically this is a 4.2.2 kernel so i could expect a low resistance at exploits, it worths to be tested
The Following 2 Users Say Thank You to Graveen For This Useful Post: [ View ]
2nd July 2014, 01:08 PM |#5  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
Good news, i was able to boot from an USB stick (with EFI), and while the MMC is not accessible, i found a trick to change permissions.

I have now full R/W support on EXT3 partition.

But sadly SU is not enough to gain root accesses.... damn.

Anyone able to find doc or explain how root access is triggered ?
The Following 2 Users Say Thank You to Graveen For This Useful Post: [ View ]
3rd July 2014, 05:48 PM |#6  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
I found an update, and i'm now able to flash the whole system partition. Sadly, i could not flash another, so i guess this is signed (and sadly it is).

I have also tryed z4root, towelRoot exploits, not working.

Basically i could somehow bypass the sign system in applying myself the content of the (as long as it deals with /data and /system files & perms). I'll try that for at least google apps.

edit: ok i have now play store and the whole google suite is working after a big playstore update (talkback, vocal syntgetisis and so on). Only google+ is FCing but it should only be a matter of installation. I should remove it and reinstall it from the market.

Only thing missing is root

Status on Android forum side:
Last edited by Graveen; 4th July 2014 at 09:54 AM. Reason: precisions
The Following 3 Users Say Thank You to Graveen For This Useful Post: [ View ]
7th July 2014, 04:02 PM |#7  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
As today, the tablet is now rooted. It works flawlessly.

Next step is the handling of recovery to flash non-signed zip files. It would ease the process of installing GAPPS or rooting the tablet.

But i'll take a break before

TODO list, from top to crazy:
- recovery
- test and deploy various system tweaker sur as Xposed framework
- bugfix vibrator (only working when you hit Windows button, not in apps)
- new rom, new kernel
Last edited by Graveen; 7th July 2014 at 04:24 PM.
12th July 2014, 01:05 PM |#8  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
Here is the actual partition layout:

Model: MMC BIWIN (sd/mmc)
Disk /dev/mmcblk0: 30.9GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End     Size    File system  Name                          Flags
 1      1049kB  269MB   268MB   fat16        ANDROID!bootloader    boot, hidden, legacy_boot
 2      269MB   337MB   67.1MB               ANDROID!panic
 3      337MB   873MB   537MB   ext4         ANDROID!factory
 4      873MB   2484MB  1611MB               ANDROID!fake
 5      2484MB  2618MB  134MB   ext4         ANDROID!config
 6      2618MB  4229MB  1611MB  ext4         ANDROID!cache
 7      4229MB  5303MB  1074MB  ext4         ANDROID!logs
 8      5303MB  7450MB  2147MB  ext4         ANDROID!system
 9      7450MB  11.7GB  4295MB  ext4         ANDROID!data
10      11.7GB  11.7GB  1049kB               ANDROID!misc
11      11.7GB  11.8GB  33.6MB               ANDROID!boot
12      11.8GB  11.9GB  134MB                ANDROID!recovery
13      11.9GB  11.9GB  33.6MB               ANDROID!droidboot
14      11.9GB  12.3GB  315MB   ntfs         Basic data partition          diag
15      12.3GB  12.5GB  273MB   fat32        EFI system partition          boot
16      12.5GB  12.7GB  134MB                Microsoft reserved partition  msftres
17      12.7GB  30.9GB  18.3GB  ntfs         Basic data partition          msftdata
I'm not able to read the partition w/o filesystem (2, 4, 10, 11, 12, 13).
I tryed with yaffs2, but i'm not able to see them (and since it is not MTD...)
I'm working on dd image of the 32Gb MMC.

In example, hexdump of partition 12 shows it is a kernel. Certainly the recovery kernel directly flash, i should dig this.
Last edited by Graveen; 1st September 2014 at 11:57 PM.
The Following User Says Thank You to Graveen For This Useful Post: [ View ]
20th July 2014, 06:07 PM |#9  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
Tablet Guide: installing Google Apps and Rooting the tablet

/!\ Please click thanks or offer me a coffee with donate if it was usefull for you /!\

This is rather technical, but i can help if you are stuck. Thank you for your comments.

Here is how you could install Google App suite to the THBK1-10 and certainly many ones based on Inside H2O bios, board name: CARD_B (see above for detailled specs)

Basically, to install some stuff, the concept is to get rid of all the caveats (special MMC drivers, EFI 32 bits with GPT, etc...) through actual Windows 8.1 installation. Everything takes place through classic Windows desktop. For convenience, personnally worked with TeamViewer, doing this with the dock/touchpad is pain in the ass. You can void your warranty and break the android part of your tablet, so operate carefully, i'm not responsible of what you do !

This leads to 3 phases:
a) accessing EXT4 Android partitions
b) transfer files from Windows to Android
c) change permissions

a) Accessing EXT4. I used coLinux to access and handle Android EXT4 partitions:
- download and install coLinux At the 'Choose components' screen, uncheck 'Root filesystem image Download', and accept everything (including TAP drivers)
- download and unzip Debian Squeeze image in coLinux folder (c:\program files\colinux). Warning, this leads to a 2Gb file, ensure you have proper space. You could unzip it in your external SDcard, but you would have to change the path to rootfs and swap in above squeeze.conf
- test it: click on the squeeze.bat file into c:\program files\colinux (if you have an error co-slirp, simply close colinux and restart it). Once you have the 'debian login:' prompt simply type root then enter. You are now under coLinux.

First, install your local keyboard (if needed)
apt-get update
apt-get install console-setup locales console-data
In case you miss the point for the keyboard:
(choose select keyboard from full list / pc azerty or whatever...)
dpkg-reconfigure console-data
- you should now update your /etc/apt/sources.list file:
nano /etc/apt/sources.list
- fill with the following lines (remove all before)
deb squeeze main contrib non-free
deb squeeze/updates main contrib non-free
- update your apt repository:
apt-get update
- you would like to sync the clock from Linux with Windows: edit /etc/default/rcS and change UTC=yes to UTC=no
nano /etc/default/rcS
You can exit coLinux, we have things to tweak now.You can then download the attached Squeeze.conf, and put it into your colinux folder, replacing the old. Remember, if you have changed the path for rootfs and swap, you must change them to reflect your current installation.

cobd0="c:\program files\coLinux\rootfs_2gb.img"
cobd1="c:\program files\coLinux\\swap_128mb.img"
root=/dev/cobd0 ro

b) transfer files from Windows to coLinux
We would create a share folder at the root of C:\.
You must have C:\share folder.

- Create a directory in /mnt
mkdir /mnt/win
- then mount the folder into your coLinux
mount -t cofs cofs0 /mnt/win

- You must now download the google apps files. The operation is done under Windows:
download Android 4.2.2 ones: and extract all the file into C:\share
This folder must contains the whole gapps (you 'll see folders named: system, META-INF, optional...).
You must directly DELETE 3 files and 1 folder:
file system\app\GooglePlus.apk
file system\app\LatinImeDictionary.apk
file system\lib\
fodler system\tts

If everything is ok, browsing /mnt/win/ from coLinux (not windows)
ls /mnt/win
should show the share directory content (META-INF,system,optional,...).


- You must now copy su binary to your tablet: download attached files, unzip, copy it to your windows desktop shared folder
Nota: this file is extracted from Koush' superuser APK. This is the x86 su binary. Feel free to replace with newest version if available or if you fear something


c) access to Android partition
- create a system folder in /mnt
mkdir /mnt/system
- mount android to system
mount /dev/cobd8 /mnt/system
- check you are ok with
ls /mnt/system
You must see app, bin, usr, etc .... folders.

*** at this point, /mnt/system contains ALL your android system. NO MISTAKE ! ***


- part 1: removing files. Browse to /mnt/system/app and CAREFULLY delete the 8 files (some could be missing, don't bother):
cd /mnt/system/app
rm Provider.apk
rm Provider.odex
rm QuickSearchBox.apk
rm QuickSearchBox.odex
rm SetupWizard.apk
rm SetupWizard.odex
- part2: copy. Copy the files from Windows to Android - it could take up to 2 minutes -
cp -rp /mnt/win/system/* /mnt/system
- then fix the permissions:
chmod -R 755 /mnt/system/addon.d
chmod 755 /mnt/system/app/*
At this point, this is over. You can exit from colinux, reboot to Android, and come back to windows uninstalling coLinux, if anything is ok
The whole GAPPS are installed. Enjoy !


- copy attached x86 su binary to android
cp -p /mnt/win/su /mnt/system/bin
- then fix the permissions:
chmod 755 /mnt/system/bin/su
chmod u+s /mnt/system/bin/su
ln -s /mnt/system/bin/su /mnt/system/xbin/su
At this point, this is over. Reboot, you can now download and install superuser
Your tablet is now rooted. Enjoy !
Attached Files
File Type: 7z su.7z - [Click for QR Code] (252.3 KB, 420 views)
Last edited by Graveen; 17th September 2014 at 09:48 PM. Reason: precisions + attached SU
The Following 6 Users Say Thank You to Graveen For This Useful Post: [ View ]
5th August 2014, 04:29 PM |#10  
Graveen's Avatar
OP Senior Member
Thanks Meter: 46
Donate to Me
Know clones (feel free to help):

- Danew i1012 dual boot (strictly identical to Thbk1)

- VOYO A1 (Windows 8 only).
- Cube U100GT (Windows 8 only)

Certainly clones:

- Ramos i10 pro (dual boot)
- Pipo W1 / Work W1 (Windows 8 only)
- ColorFly i106 (Windows 8 only)
- Toshiba WT8-AT01G (Windows 8 only)
Post Reply Subscribe to Thread

thbk1 thomson android windows hack
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Top Threads in Windows 8 Development and Hacking by ThreadRank