FORUMS
Remove All Ads from XDA

Jpay JP5 tablet w/ android operating sys need unlocked

1 posts
Thanks Meter: 6
 
By Mjunior1661, Junior Member on 12th March 2017, 10:39 AM
Post Reply Email Thread
15th June 2019, 11:16 PM |#21  
Junior Member
Flag Coeur d'Alene
Thanks Meter: 0
 
More
Quote:
Originally Posted by technotwiz

I don't have the experience to get through the security measures on this device. I only have experience installing twrp, lineageOs, maybe a Stang build. So pretty basic. BUT, I am highly motivated to unlock this device. I have a few of them, one 10 inch and two of the mini versions. I would be willing to part with one if you think it would really make this possible. How can the "source code" be obtained? Any way I can help?

Further, I am puzzles how the build.prop was obtained. I can access the storage of the device, but only basic media files. No system stuff. How can a root browser be installed without privileges? I guess if my player wasn't totally locked down....

Not related to this thread, but common to institutional players... I have an image of the kiosk used with an Access Corrections MAXXpro player (which is encrypted). Its around 7GB, but complete. May be fun for somebody who loves to reverse engineer stuff. If interested please PM me.

I would be interested in getting that image, im currently trying to reverse engineer the update and communication process. I found a completely unencrypted update file on mine and am busy trying to sort it out :P but anything that had any chance of possibly making this thing any bit better than a paper weight would be fantastic!
17th June 2019, 07:49 AM |#22  
Junior Member
Thanks Meter: 3
 
More
Quote:
Originally Posted by iTidez

I would be interested in getting that image, im currently trying to reverse engineer the update and communication process. I found a completely unencrypted update file on mine and am busy trying to sort it out :P but anything that had any chance of possibly making this thing any bit better than a paper weight would be fantastic!

I am working on the upload now. I will PM you with the link when completed. I hope you can unlock these things, that would really be nice.
The Following User Says Thank You to technotwiz For This Useful Post: [ View ] Gift technotwiz Ad-Free
20th June 2019, 02:34 AM |#23  
Junior Member
Somewhere FL
Thanks Meter: 7
 
More
@technotwiz

Would You be Willing to Share the Firmware image with me in a PM

I have Recently obtained one of these devices and need to Crack it.

I know the Device has a RK3188 Chipset and a AP6212 WiFi Chip.

I also Have the SDK Needed to Create a ROM/Firmware For the RK3188 Chipset. Along with the RKchip Flashing Tools.

I might not have all the Required Drivers to ensure everything works properly.

That firmware would be a good start.
20th June 2019, 02:53 AM |#24  
Junior Member
Thanks Meter: 3
 
More
Quote:
Originally Posted by STICK141

@technotwiz

Would You be Willing to Share the Firmware image with me in a PM

I have Recently obtained one of these devices and need to Crack it.

I know the Device has a RK3188 Chipset and a AP6212 WiFi Chip.

I also Have the SDK Needed to Create a ROM/Firmware For the RK3188 Chipset. Along with the RKchip Flashing Tools.

I might not have all the Required Drivers to ensure everything works properly.

That firmware would be a good start.

Just to make sure, you are aware the kiosk image is for the Access Corrections MAXXpro players. If you still need it, PM me.
20th June 2019, 03:19 AM |#25  
Quote:
Originally Posted by Shifty657

Yes its the 7in can anyone tell me how to sudo/su root with a shell command emulator? Android is version 4.2.2 scared to use king root on this. Need to root though

You just start off by typing su , but i always did that after rooting. Magisk is the way to go!

Did you get anywhere with king root?
20th June 2019, 07:37 AM |#26  
Junior Member
Somewhere FL
Thanks Meter: 7
 
More
Quote:
Originally Posted by Shifty657

Yes its the 7in can anyone tell me how to sudo/su root with a shell command emulator? Android is version 4.2.2 scared to use king root on this. Need to root though

Try This
Code:
su -
If you Can Gain Root access on the Device.

try running
Code:
cat /proc/mtd
You will Probably Get similar output like this.
Code:
mtd0: 00800000 00200000 "bootloader"
mtd1: 00400000 00200000 "ubootenv"
mtd2: 00800000 00200000 "logo"
mtd3: 00800000 00200000 "aml_logo"
mtd4: 00800000 00200000 "recovery"
mtd5: 00800000 00200000 "boot"
mtd6: 40600000 00200000 "system"
mtd7: 20000000 00200000 "cache"
mtd8: 10000000 00200000 "backup"
mtd9: 18c600000 00200000 "userdata"
if so it should be possible to Dump all the Partitions on the Device.

Then With a Little Creativity It should be possible to Reconstruct the Dumped partitions into a new Firmware Image with the imgRePackerRK tool.
https://forum.xda-developers.com/sho....php?t=2257331

Ive done this with Cheap Chinese RK3188 Boxes in the past.



Also If this One Liner works it might be possible to Exploit Permissions on the Device. (Run it in Terminal Emulator)
(Its known to work Regardless of Busybox being installed or not on Many Android TV boxes with the same chipset.)

Code:
kill $(ps | busybox grep jackpal.androidterm | busybox awk "{ print $2 }")

Based on the Build.prop That was Posted Earlier and From what ive seen on the one I have.

We know that there is a RK3188 chipset

And I Have Spotted an AP6212 Wifi Chip Though the Clear Case. I Do know that a lot of RK3188 and RK3288 based Sticks,Boxes, And Development Board had this module.

I do know that Abdul_PT From FreakTab Did port twrp to RK31xx Devices
https://forum.freaktab.com/forum/mai...for-rockchip-s

I Did Some Googling and Came up With this.
http://specdevice.com/showspec.php?i...e-dac10033c587

Code:
 Devices with same CPU and display:
rockchip rkpx3 [4.4.4; eng.w.20160423.093627; SDK19]
AURA Aura_TELPAD_MA7_tablet [4.4.4; eng.20150527.104438; SDK19]
Digiin RCT6103W46 [4.2.2; 20140508.145842.V004; SDK17] Rca Pro10
LENOVO LIFETAB_E723X [4.4.4; 3f3bd45.141007.092144; SDK19]
AURA Aura_TELPAD_MA7_tablet [4.4.4; eng.20160301.170649; SDK19]
I Managed to Get it to Reboot into 3e Recovery but Didnt Check to See if i could use fastboot commands.

Did notice that the only Option shown in 3e Recovery was the Reboot System now Option.
I wouldnt Be Surprised if all they Did was just Comment Out the Other Menu Options and Change Strings in 3e.

Again I didnt Check For Fastboot commands.
But I Did Post a twrp img for rk31XX devices in the attachments of this post.
Someone Could Try to Directly Boot the Image in 3e and see if twrp will run.

And I Doubt they are using Flashable Zips to Upgrade Firmware or to "Unlock It".
As they probably Flash these Things in Bulk.

I wouldnt Be worried about Digital Signature Verification Either seeing how most 4x Roms on RK31XX devices check this as part of the Recovery-Script.

The Hardware is Pretty Low end and So don't Expect too much security.
They Probably Just Reflash it with a stock firmware thats not locked down and then just copy the inmates Data from their own servers back into the device.


(Will have the Device again Tomorrow.)

From Experience I know that Jpay is a Terrible Company when it comes to Customer Service and Support,
They also Rip off and Take Advantage of Inmates and their families.
Along With the fact they are Over Charging for this Garbage.

This Tablet isnt even worth $40

I wouldn't Be Surprised to Find out the BootLoader isnt actually Locked and that this is Just Rebadged and/or Customized Hardware from a Chinese Tablet/TVBox manufacturer.

also This line in build.prop suggests they used the RKchip SDK to build the Firmware. (Its leaked online Somewhere too btw)
ro.rksdk.version=RK31_ANDROID4.2.2-SDK-v1.04.00

If you Google that String you Will Find a lot of over RK31xx devices using the same SDK Version... Again Dont worry too much about security.

It should be noted that Some RK3188 Devices use U-Boot
https://wiki.radxa.com/Rock/U-Boot

Regardless There is a Small collection of them for RKChip Devices here
https://forum.xda-developers.com/and...ction-t3739510


You can Also Make SD Card Bootable Images for RK3188 Devices.


Quote:
Originally Posted by Shifty657

I have an unlocked jpay jp5s tablet I'll post what I can for you guys . I need help enabling the bluetooth adapter as this firmware version it wasn't active, need to see if I can root it with king root, and want to find out if there is actually a cellular chip in it(cell service options are in settings), also the storage is weird in this thing. Apps install to a 1gb internal memory and then there's the 32gb unmountable a sdcard, which is built in. Can't install many apps because of this . Also I have no access to a pc

Im not Sure if the "SD card" is Built in because i haven't disassembled mine yet.
but you can boot directly from SD on RK31XX devices.

http://opensource.rock-chips.com/wik...m_Media_device
also take a look at
https://www.cnx-software.com/2014/11...k3188-devices/


The Device is Probably Flashable with the RKBatchTool.
https://androidmtk.com/use-rockchip-batch-tool
Attached Files
File Type: img TWRP_1024x600_rk31xx_KK.img - [Click for QR Code] (2.90 MB, 34 views)
File Type: img TWRP_1024x600_rk31xx.img - [Click for QR Code] (2.90 MB, 28 views)
The Following User Says Thank You to STICK141 For This Useful Post: [ View ] Gift STICK141 Ad-Free
25th June 2019, 05:52 AM |#27  
Junior Member
Thanks Meter: 1
 
More
Bluetooth
I have rooted it using root master and have installed busy box. But the Bluetooth isn't enabled on this version and I know it has it. Its android 4..2.2 can anyone direct me to a package or downloadable file to enable the Bluetooth settings or to upgrade to 4.3 from the device itself, or alternatively instruct me how to get Bluetooth working. Currently trying to unzip bluez.tar.gz but looking for a simpler fix please help any info is appreciated
25th June 2019, 09:57 AM |#28  
Quote:
Originally Posted by Shifty657

I have rooted it using root master and have installed busy box. But the Bluetooth isn't enabled on this version and I know it has it. Its android 4..2.2 can anyone direct me to a package or downloadable file to enable the Bluetooth settings or to upgrade to 4.3 from the device itself, or alternatively instruct me how to get Bluetooth working. Currently trying to unzip bluez.tar.gz but looking for a simpler fix please help any info is appreciated

When i saw/learned that these shipped with BT capability and then "lost" that ability, i came up with two possibilities, either they gave us a modified settings.apk with the BT switch and menu option removed, or they kernel twekaed it and removed BT from there.

Trry any app from play store that lefs gou toggle the usual, wifi BT, airplane mode, data, etc. See what that does. If it toggles BT, its the settings.apk, if it doesn't, its fhe kernel
26th June 2019, 08:44 AM |#29  
Junior Member
Thanks Meter: 1
 
More
Quote:
Originally Posted by palmbeach05

When i saw/learned that these shipped with BT capability and then "lost" that ability, i came up with two possibilities, either they gave us a modified settings.apk with the BT switch and menu option removed, or they kernel twekaed it and removed BT from there.

Trry any app from play store that lefs gou toggle the usual, wifi BT, airplane mode, data, etc. See what that does. If it toggles BT, its the settings.apk, if it doesn't, its fhe kernel

I get error messages with the apps, in settings it shuts down when I go to BT tethering I can add BT settings shortcut but it just goes to an empty settings page. Looking at the settings apk the BT menus and all is built in. So what do I do next?
26th June 2019, 10:51 AM |#30  
Quote:
Originally Posted by Shifty657

I get error messages with the apps, in settings it shuts down when I go to BT tethering I can add BT settings shortcut but it just goes to an empty settings page. Looking at the settings apk the BT menus and all is built in. So what do I do next?

You decompiled the settings apk and everything that was supposed to be there was there?
27th June 2019, 03:46 PM |#31  
Junior Member
Somewhere FL
Thanks Meter: 7
 
More
We need to Find a Driver That Can be Used Under Windows 10 64 Bit to Communicate With the Device.

I have Also Attached a Shot of the Back of the Device.

Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes