Slashdot Mirror
How I Freed My Android Tablet: A Journey in Reverse Engineering (www.thanassis.space)
Slashdot reader ttsiod is an embedded software engineer at the European Space Agency, and shares this story about his quest to "dominate" his new tablet:
Just like it's predecessor, I wanted to run a Debian chroot inside it -- that would allow me to apt-get install and run things like Privoxy, SSH SOCKS/VPN tunnels, Flask mini-servers, etc; and in general allow me to stay in control. But there was no open-source way to do this... and I could never trust "one-click roots" that communicate with servers in China... It took me weeks to reverse engineer my tablet -- and finally succeed in becoming root. The journey was quite interesting, and included both hardware and software tinkering. I learned a lot while doing it -- and wanted to share the experience with my fellow Slashdotters...
He writes that "I trust Debian. Far more than I trust the Android ecosystem," and describes everything from how he probed the boot process and created his own boot image to hunting for a way "to tell SELinux to get off my lawn".
He writes that "I trust Debian. Far more than I trust the Android ecosystem," and describes everything from how he probed the boot process and created his own boot image to hunting for a way "to tell SELinux to get off my lawn".
At one point in time every kind of personal computer you could buy would be yours.
Then people started buying locked down devices, which became a bigger and bigger part of the market. Because why not? People buy them, and it's better for the selling company to maintain control of the device so they can exfiltrate your data, lock you into their software store to reap a cut off the top, or disable the device remotely.
But, generally, you could still get past against-the-owner security in various ways. But companies are learning from the holes, and each generation is more difficult to bypass. Even whitebox PCs are moving in this direction.
The ownership-era for general purpose computing devices is drawing to a close. Step back to 1970's someone playing with their Apple II or C= Pet and try to explain to them that someday, their computer will take orders from someone else in preference to theirs. They might not even understand how such a thing would be possible, but a million tiny steps have led us to our cages. The next million tiny steps will throw away the key. At each step, people get to argue, "THAT step didn't cause the problem. Why are you complaining so much??"
Thus ends the potential freedom brought about by the computing revolution.
Very very impressive. But of course, now we know you can do this, landing some more expensive stuff than a tablet on Mars without breaking it should be on your To Do list...
Bert
(You probably saw that one coming, didn't you?)
Great read.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Gotta give this guy credit for doing some serious detective and reverse-engineering work. Good job.
Just cruising through this digital world at 33 1/3 rpm...
The tenacity is noteworthy. This guy did a very good job at getting to the bottom of things and enabling total control over his tablet.
Well done!
We suffer more in our imagination than in reality. - Seneca
Thank you ttsoid! Suddenly all my old knowledge about serial became relevant again. Seeing you blog about serial ports, stty, was really nostalgic, I didn't realize it would be useful in the android domain. I'd say the tablet has a lot more computing power than those old machines had.
Coincidentally this article came when I am upgrading phone and tablet, which is also an asus, so I am set up to try some of the hacks you have described. I'm keen to see if the serial ports are on the headphone ports of the phone also. Perhaps they're used as a diagnostic port in the factory? I think that behind the battery of the smartphone the pads you can sometimes see are serial ports. I only ever considered them to be used as a way to access the AT command set to use features of the phone like a modem. But a serial console, of course, it's been mocking me the whole time.
I was also considering your predicament from the SELinux perspective and hierarchy of privileges. Busybox includes getty. Back in the day this was used to spawn a login on serial ports for serial terminals. It was common practice to spawn them from init, using inittab. I noticed you could get logins appearing before the rc process was finished. It also controlled where root could log in from and whilst generally restricted to the console, you could allow it on a serial port.
Obviously, this depends on if the SELinux policy allows init to read an /etc/inittab file - but there is only one way to find out. If it does, you maybe able to get the same privileges in the hierarchy as rc by simply bypassing it. This also leads to considering spawning the telnetd (or even sshd) directly from inittab, however I suspect that the SELinux policy might react in a different way to them than getty spawning the shell.
Frankly, I've only just got interested in android and your submission could not have been more timely. You triggered a cascade of memories and a bunch of stuff I want to try on the gear I have for the same motivation, I want all of the functionality of the device I own. I also see it's time to stop ignoring SELinux and get better at manipulating policies.
Thank you once again.
My ism, it's full of beliefs.