Slashdot Mirror

← Back to Stories (view on slashdot.org)

How I Freed My Android Tablet: A Journey in Reverse Engineering (www.thanassis.space)

Posted by EditorDavid on from the longing-for-Linux dept.

Slashdot reader ttsiod is an embedded software engineer at the European Space Agency, and shares this story about his quest to "dominate" his new tablet: Just like it's predecessor, I wanted to run a Debian chroot inside it -- that would allow me to apt-get install and run things like Privoxy, SSH SOCKS/VPN tunnels, Flask mini-servers, etc; and in general allow me to stay in control. But there was no open-source way to do this... and I could never trust "one-click roots" that communicate with servers in China... It took me weeks to reverse engineer my tablet -- and finally succeed in becoming root. The journey was quite interesting, and included both hardware and software tinkering. I learned a lot while doing it -- and wanted to share the experience with my fellow Slashdotters...
He writes that "I trust Debian. Far more than I trust the Android ecosystem," and describes everything from how he probed the boot process and created his own boot image to hunting for a way "to tell SELinux to get off my lawn".

39 of 79 comments (clear)

  1. you think it won't get worse? by Anonymous Coward · · Score: 5, Insightful

    At one point in time every kind of personal computer you could buy would be yours.

    Then people started buying locked down devices, which became a bigger and bigger part of the market. Because why not? People buy them, and it's better for the selling company to maintain control of the device so they can exfiltrate your data, lock you into their software store to reap a cut off the top, or disable the device remotely.

    But, generally, you could still get past against-the-owner security in various ways. But companies are learning from the holes, and each generation is more difficult to bypass. Even whitebox PCs are moving in this direction.

    The ownership-era for general purpose computing devices is drawing to a close. Step back to 1970's someone playing with their Apple II or C= Pet and try to explain to them that someday, their computer will take orders from someone else in preference to theirs. They might not even understand how such a thing would be possible, but a million tiny steps have led us to our cages. The next million tiny steps will throw away the key. At each step, people get to argue, "THAT step didn't cause the problem. Why are you complaining so much??"

    Thus ends the potential freedom brought about by the computing revolution.

    1. Re:you think it won't get worse? by spire3661 · · Score: 5, Informative

      You do realize Stallman has been saying this stuff since the 70s right? Its been a known problem for a VERY long time and we fought the good fight for as long as we could, but pocket computers killed it.

      --
      Good-bye
    2. Re:you think it won't get worse? by Anonymous Coward · · Score: 1

      we fought the good fight for as long as we could, but rampant technical illiteracy killed it.

      FTFY.

    3. Re:you think it won't get worse? by Kjella · · Score: 3, Interesting

      You do realize Stallman has been saying this stuff since the 70s right? Its been a known problem for a VERY long time and we fought the good fight for as long as we could, but pocket computers killed it.

      Well I think it swings both ways, it's more and more obvious that you don't really control any closed source operating system, you pretty much must have security patches and everything else comes along for the ride and increasingly it can't be configured or disabled. That's the way of iOS, Android, Win10, they're trying to push that model on Win7/8, I'm not sure about OS X but they're probably not far behind. If you want control, you want Linux (or some other open source OS). That said, most people don't felt they were in control at all. By making Apple/Google/Microsoft the gatekeeper, they trust just one source instead of any random exe from the Internet. Same way most people want the CA system instead of messing with peer-to-peer trust. Because when they don't understand - and they won't understand, no matter how much you try to teach them - they end up trusting something or someone.

      That said, what I'm mostly disappointed with is how the world has ended up revolving around a few, huge centralized services. Newsgroups, IRC, Email, blogs and really any kind of service that runs on a network or you could run from your own server is toiling in obscurity, you need to be on Facebook and Twitter and YouTube playing by their rules and if they want to wield the ban hammer there's very little you can do. Personally I'm far more concerned about how we've lost control of the human interaction rather than control over the local machine. And for the most part we don't own things in the digital world anymore we license or stream them, it's all permissions that can be revoked or services that can be shut down. That said, it works surprisingly well until one day it doesn't.

      --
      Live today, because you never know what tomorrow brings
    4. Re:you think it won't get worse? by nnull · · Score: 3, Insightful

      What I find amazing is to what extent these manufacturers go to stop people from doing anything useful with these locked down devices. Seems to much time and effort is being put into obfuscation (Using even opensource software to do it) than actually making a useful product. My question is, why? Just seems silly and creates a lot more waste. There's so many of these devices out there right now, that doing this is completely pointless and doesn't even guarantee the customer is going to buy your product again.

    5. Re: you think it won't get worse? by Anonymous Coward · · Score: 2, Insightful

      Don't confuse illiteracy with complacency. Thereeven are plenty of capable people out there.
      NOBODY CARES.
      Why should they?

    6. Re:you think it won't get worse? by guacamole · · Score: 3, Insightful

      Because 99% of consumers do not even know the difference between locked and unlocked device, and most won't even care, sadly.

    7. Re:you think it won't get worse? by thygate · · Score: 1

      +1000

    8. Re:you think it won't get worse? by kurkosdr · · Score: 1

      To be 100% accurate, Nexus devices are yours. You can load a ROM that is pre-rooted and then do everything you want. Bootloader locks are a side-effect of the way Americans buy their smartphones, which is basically that they do not own them for the first one or two years but instead borrow them from the carrier 'till they pay them off during the course of the contract. So, the device is not yours to tinker with. Even before Android, there were all kinds of locks in the software for the carrier's behest.

    9. Re:you think it won't get worse? by rtb61 · · Score: 1

      Cough, cough, they only win, when we stop fighting. Really how much effort does it take to fight. Attack it on forums, every now and again, complain to the government every now and again, join in with consumer rights organisations, join in with personal rights organisation, refuse to buy products that do not serve you, well, do that always, seriously should you allow control over your own life to be treated as an inconvenience.

      New actions, fuck up all their surveys, corporations treat me well and I will treat them well, attempt to make use of me and I will not serve you in any way and that includes lying on all surveys, purposefully create misinformation to poison their data bases (http://www.cs.nyu.edu/trackmenot/), it takes little effort. Don't be a fanatic though, just join in, have fun and basically strive to fuck up their schemes and scams. It's not winning or losing that counts, it's how much you make them lose trying to do things to you that you do not appreciate and if they lose more than they gain, then they will stop, one way or another.

      --
      Chaos - everything, everywhere, everywhen
    10. Re:you think it won't get worse? by tentenone · · Score: 1

      To be 100% accurate, Nexus devices are yours.

      It's a shame they've taken that away with their new Pixel line.

    11. Re:you think it won't get worse? by Trogre · · Score: 1

      Interesting. Do you judge every philosophy by the personal habits of its founder?

      --
      "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
    12. Re:you think it won't get worse? by ShakaUVM · · Score: 3, Insightful

      >Well I think it swings both ways, it's more and more obvious that you don't really control any closed source operating system, you pretty much must have security patches and everything else comes along for the ride and increasingly it can't be configured or disabled. That's the way of iOS, Android, Win10, they're trying to push that model on Win7/8, I'm not sure about OS X but they're probably not far behind. If you want control, you want Linux (or some other open source OS). That said, most people don't felt they were in control at all. By making Apple/Google/Microsoft the gatekeeper, they trust just one source instead of any random exe from the Internet. Same way most people want the CA system instead of messing with peer-to-peer trust. Because when they don't understand - and they won't understand, no matter how much you try to teach them - they end up trusting something or someone.

      True. But there's no connection between getting signed patches from Apple/Microsoft/Google and it being FOSS. You can have both. The only reason to lock down a platform so that users can't mess with it *if they want to* is control and money. Taking control away from users and putting it in the hands of A/M/G instead. On cell phones this was justified by the subsidies that cell phone carriers would pay - a carrier wouldn't want someone to buy a subsidized cell phone from them and then switch carriers (notwithstanding that this could just be enforced by ETFs and the like), so cell phones were locked down to remove root access to them. And because cell phones were, tablets have followed along, since tablets are just cell phones with larger screens.

      Google does the minimum to be compliant to the GPL, and Apple and Microsoft barely even pretend. Windows 10 is a disaster for many reasons, but the biggest one to me is that it has finally removed the notion that the owner of a computer is, you know, the owner. Who can modify it to fit his needs as he wishes. Now you're just a user, and even with administrative privileges there are things you will not be allowed to do inside the OS. It's the biggest piece of shit move from the FOSS perspective that the world has ever seen.

      The saddest thing that can ever be said is that Stallman was right again.

    13. Re: you think it won't get worse? by nnull · · Score: 1

      Nope, but someone is.

    14. Re:you think it won't get worse? by MrKaos · · Score: 1

      My question is, why?

      Sales. Anything that allows users to re-purpose devices is a sale lost. PC's were re-purposed often, so they learned how to fix that mistake.

      Even better for them is they avoided costs by using the open source operating system designed to make it open, to close it instead.

      --
      My ism, it's full of beliefs.
  2. Well done by kanweg · · Score: 2

    Very very impressive. But of course, now we know you can do this, landing some more expensive stuff than a tablet on Mars without breaking it should be on your To Do list...

    Bert
    (You probably saw that one coming, didn't you?)

  3. Excellent by Virtucon · · Score: 2

    Great read.

    --
    Harrison's Postulate - "For every action there is an equal and opposite criticism"
  4. OMG by Anonymous Coward · · Score: 1

    Good job achieving what millions did already. Just buy a noname tablet from China, they don't care if you root it, and there are probably dozens of ROMs to choose from.

  5. Re:boot security by 93+Escort+Wagon · · Score: 1

    ... Which is exactly why the author shared this very interesting article - to demonstrate the great lengths he had to go just to root his tablet.

    Incidentally, I had no idea Nexus tablets offered a serial console via the headphone jack! Useless for almost everyone; but very cool in an old-school sort of way... and crucial in this case! I wonder how long it'll be before that is removed as well.

    --
    #DeleteChrome
  6. Impressive by JustAnotherOldGuy · · Score: 4, Insightful

    Gotta give this guy credit for doing some serious detective and reverse-engineering work. Good job.

    --
    Just cruising through this digital world at 33 1/3 rpm...
  7. Re:boot security by nnull · · Score: 1

    Which is why I'm still hopeful for that Ubuntu phone. Seems they haven't given up on it yet, hopefully the new release will be a lot better than before and not using an older phone model. Supposed to be out this year. I hope they resolve the manufacturing issues keeping people from purchasing it (It seems they've underestimated how many people would buy it).

  8. Wow... by XSportSeeker · · Score: 1

    This is pretty awesome, and something I wish I could do.... just far too complex and involved for me.

    I just kinda gave up, have plans to use an offline Android tablet, but for online stuff falling back to laptops with something like Qubes, Tails and whatnot.

    I know there are some alternatives out there, but they are usually either very expensive or hard to get, and you end up in the same situation where you have to trust the guys who did it (stuff like Aquaris M10 Ubuntu tablet, Copperhead OS, BlackPhone 2).

    In any case, kudos to ttsiodras(?).

    1. Re:Wow... by ttsiod · · Score: 1
      > In any case, kudos to ttsiodras(?)

      Thanks - that is indeed my handle nowadays. Though when I opened my Slashdot account back in my Uni days I went with 'ttsiod' - our mainframe (I believe it was called "Cyber"?) could only accommodate a maximum of 6 or 7 letter login names :-)

    2. Re:Wow... by MrKaos · · Score: 2

      Thank you ttsoid! Suddenly all my old knowledge about serial became relevant again. Seeing you blog about serial ports, stty, was really nostalgic, I didn't realize it would be useful in the android domain. I'd say the tablet has a lot more computing power than those old machines had.

      Coincidentally this article came when I am upgrading phone and tablet, which is also an asus, so I am set up to try some of the hacks you have described. I'm keen to see if the serial ports are on the headphone ports of the phone also. Perhaps they're used as a diagnostic port in the factory? I think that behind the battery of the smartphone the pads you can sometimes see are serial ports. I only ever considered them to be used as a way to access the AT command set to use features of the phone like a modem. But a serial console, of course, it's been mocking me the whole time.

      I was also considering your predicament from the SELinux perspective and hierarchy of privileges. Busybox includes getty. Back in the day this was used to spawn a login on serial ports for serial terminals. It was common practice to spawn them from init, using inittab. I noticed you could get logins appearing before the rc process was finished. It also controlled where root could log in from and whilst generally restricted to the console, you could allow it on a serial port.

      Obviously, this depends on if the SELinux policy allows init to read an /etc/inittab file - but there is only one way to find out. If it does, you maybe able to get the same privileges in the hierarchy as rc by simply bypassing it. This also leads to considering spawning the telnetd (or even sshd) directly from inittab, however I suspect that the SELinux policy might react in a different way to them than getty spawning the shell.

      Frankly, I've only just got interested in android and your submission could not have been more timely. You triggered a cascade of memories and a bunch of stuff I want to try on the gear I have for the same motivation, I want all of the functionality of the device I own. I also see it's time to stop ignoring SELinux and get better at manipulating policies.

      Thank you once again.

      --
      My ism, it's full of beliefs.
  9. Found the LUDDITE! by Anonymous Coward · · Score: 1

    Only LUDDITES would ever think of installing LUDDITE Debian on an app apping device!

    Apps!

  10. Wow. A true hacker. Great job! by Qbertino · · Score: 3, Insightful

    The tenacity is noteworthy. This guy did a very good job at getting to the bottom of things and enabling total control over his tablet.
    Well done!

    --
    We suffer more in our imagination than in reality. - Seneca
  11. Why Debian chroot by guacamole · · Score: 1

    I have an Android tablet for which root and TWRP are available as is without any trouble (thanks Samsung). The thing I am wondering about is why I'd need to install Debian chroot on it? Aren't Linux apps mostly optimized for computers with keyboards and all. What is its killer app?

    1. Re:Why Debian chroot by unixisc · · Score: 1

      I have an Android tablet for which root and TWRP are available as is without any trouble (thanks Samsung). The thing I am wondering about is why I'd need to install Debian chroot on it? Aren't Linux apps mostly optimized for computers with keyboards and all. What is its killer app?

      You mean there are no libre-linux ways to chroot that tablet?

    2. Re:Why Debian chroot by guacamole · · Score: 1

      And an Android tablet is hardly bought to be a headless server..

    3. Re:Why Debian chroot by guacamole · · Score: 1

      And? You see I am trying to understand what's the point of running those unix services on a tablet or smartphone.

    4. Re:Why Debian chroot by dbIII · · Score: 1

      The thing I am wondering about is why I'd need to install Debian chroot on it?

      For when you want something that doesn't work with the version of Android that came with the device. The Debian portion can be updated but for a lot of Android devices you are stuck with the version that came with it.
      The killer app will be something coming out in a year or two that you can't run without getting a new tablet or running different software on the one you've got. It could even be something like a new ereader file format that you could open in a normal PC web browser but your Android browser stuck at purchase date cannot.

    5. Re:Why Debian chroot by dbIII · · Score: 1

      One amusing application of a tablet as a server is an offline wikipedia implementation.
      It's done by dumping the wikipedia files to your tablet and then when you do not have a network connection it runs a lean web server application so that you can browse wikipedia on your tablet via the tablets web browser.

    6. Re:Why Debian chroot by Jesus_666 · · Score: 1

      The ereader format wouldn't be much of a problem. Android allows you to install alternative browsers and those usually support fairly old OS versions. For example, Firefox for Android supports everything down to 4.0, which is five years old now and probably will remain the baseline for what everyone must support for a few more years as some cheap low-end devices are still released with it AFAIK.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
    7. Re:Why Debian chroot by dbIII · · Score: 1

      I've got an Android 4 device and a lot of applications will not install.

    8. Re:Why Debian chroot by guacamole · · Score: 1

      That's an argument with many flaws.

      First of all, the Debian Linux applications for the most part are not meant to be convenient replacements for true touch-oriented Android apps. So this is basically about replacing a native touch-GUI optimized by outdated Android app with a relatively clunky Linux equivalent.

      Second, a whole lot of Android devices can get updates by the means of third party ROMs. First of all, the big ROM projects like Cyanogenmod or OmniROM, etc, can cover quite a bit of hardware. Another source of more recent ROMs is the XDA developers forums. Basically, when it comes to popular devices there is quite a bit of ROMs out there. For example, Nexus 5 updates ended at 6.x, but there are 7.x community ROMs. I have LG G2 smartphone whose last official ROM was Lollipop 5.0.x, but there are community supported 6.x ROMs for it, and even 7.x ROMs by now. Any of those alternative Android ROM routes is a better way to get access to more recent applications on outdated Android hardware, then running a Linux distribution.

    9. Re:Why Debian chroot by guacamole · · Score: 1

      Sadly, it's going to take a bit more to amuse me. In this age of ubiquitous wifi and smartphone tethering, I am not sure why I'd need to amuse myself with an off-line copy of a web site. Ok, maybe it could work out for a long flight or something.

  12. Always connected Internet made securing your machi by Anonymous Coward · · Score: 1

    Always-connected Internet made securing your machine impossible. This was the innovation that took away permanent control over your machine. After all, you "need" to install security patches so *other* programs or people on the Internet can't take over your machine, right? This means you can never "fix" your machine to a set configuration. You trust someone else to update your machine, and these updates keep control over you.

  13. Re:boot security by guacamole · · Score: 1

    Interestingly, based on the tutorial, it appears that this device is bootloader unlockable, which means that in theory, if someone built a TWRP recovery for this device, then rooting it would be a matter of flashing SuperSU from TWRP. The problem with this specific device appears not that it is locked down (it's not) but the lack of developer support for TWRP. Hence the need to root device via a "hard way".

  14. Re:boot security by MrKaos · · Score: 1

    I wonder how long it'll be before that is removed as well.

    Well Apple...

    --
    My ism, it's full of beliefs.