[PROJECT CANCELLED] Hoping to root IPPO T10N

[aus9]

just bought this today from GearBest, hopefully they might air mail it to me.

http://www.gearbest.com/tablet-pcs/pp_69515.html

main buying reason are
10.1 inch
Meditatek chipset so should be easier to root
wifi

I plan to give it to my step mom who has stage 1 CRAFT
but relatives nearby will assist her if she needs to use recovery mode.

I wlll install a number of apps mainly for memory training and my parents do not have internet nor I suspect can they afford it. But they can always sponge off my relatives who live in the same town.

Parents are computer illiterate.

thanks for reading

[aus9]

Package arrived.

power button and vol up give me bootloader mode with a menu!

offers recovery, fastboot and normal


stock recovery---offers factory reset


framaroot failed for all 3

I won't explain the reboots and um pleasant words but I managed to get
Kinguser partially installed


################

I shall try fastboot over the weekend and try again later...for rooting

EDIT but have used fastboot to get some values

fastboot getvar all
(bootloader) partition-size:userdata: 1bf000000
(bootloader) partition-type:userdata: ubifs
(bootloader) partition-size:cache: 8000000
(bootloader) partition-type:cache: ubifs
(bootloader) partition-sizeystem: 1f400000
(bootloader) partition-typeystem: ubifs
(bootloader) partition-size:dkb: 400000
(bootloader) partition-type:dkb: raw data
(bootloader) partition-size:kb: 400000
(bootloader) partition-type:kb: raw data
(bootloader) partition-size:tee2: 800000
(bootloader) partition-type:tee2: raw data
(bootloader) partition-size:tee1: 800000
(bootloader) partition-type:tee1: raw data
(bootloader) partition-size:expdb: c00000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:logo: 400000
(bootloader) partition-type:logo: raw data
(bootloader) partition-size:misc: c00000
(bootloader) partition-type:misc: raw data
(bootloader) partition-sizeec_ro: 400000
(bootloader) partition-typeec_ro: raw data
(bootloader) partition-size:recovery: 800000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot: 800000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:uboot: 400000
(bootloader) partition-type:uboot: raw data
(bootloader) partition-sizeeccfg: 400000
(bootloader) partition-typeeccfg: raw data
(bootloader) partition-size:protect_f: c00000
(bootloader) partition-type:protect_f: yaffs2
(bootloader) partition-size:nvram: c00000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-size:pro_info: 400000
(bootloader) partition-type:pro_info: raw data
(bootloader) partition-size:preloader: 1000000
(bootloader) partition-type:preloader: raw data
(bootloader) kernel: lk
(bootloader) product: T10N
(bootloader) version: 0.5
all: Done!!
finished. total time: 0.004s

ubifs......OH JOY

[aus9]

ok using Linux PC and adb I have managed to get off this tablet the recovery and boot images as per

Code:

adb devices
adb shell
# linux udev rule gave me root powers already
root@t10n:/ # ls -al /dev/bootimg
crw-r----- root     system   237,   6 2014-09-12 12:41 bootimg
dd if=/dev/bootimg of=/sdcard/boot.img
snip
ls -al /dev/recovery
crw-r----- root     system   237,   7 2014-09-12 12:41 recovery
dd if=/dev/recovery of=/sdcard/recovery.img
snip
exit  (out of shell for Android)
adb pull /sdcard/recovery.img
7765 KB/s (8388608 bytes in 1.054s)
adb pull /sdcard/boot.img
7977 KB/s (8388608 bytes in 1.026s)

when I get a chance I should now be able to put a custom recovery on
then root it.

also I can mod the boot image to give it insecure mode.

thanks for reading

---

now in post one I show the bad result of the id command for root, but I have already got a test script so here it is

Code:

sh root-checks.sh
Inputs acceptable are y, n.
If you need to enable google app=abdb insecure, do so now pls.

Pls consider disabling sim card etc.
You can do that before providing input to this script

Starting adb daemon  
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
0123456789ABCDEF       device usb:3-2 product:t10n model:t10n device:t10n

If you see an error for adb then your input must be y

If List of devices attached is an empty field, your input must be y

If you see a serial number containing at least one question mark (?)
input must be y

Otherewise input=n and Good Luck!
What is your input?  
n
sh: /system/xbin/grep: not found
Can you see an error that reads ---Permission denied ?
n
Can you see if /system is already read/write = rw?
n
Test we can mount /system read write --rw--

   BE AWARE that on any other exit condition, I may be leaving your
   /system in rw condition. If that does not suit you pls
   write down these commands to do in Android terminal
   assuming you have busybox installed. Or read this script later.

   su
   mount -o remount,ro /system
   mount | busybox grep /system

   That last line will have an output that must show ro if you
   want read only for normal operating conditions.
  
sh: busybox: can't execute: Permission denied

Yes I have checked busybox is installed

its the issue with not having true root that is the issue

thanks for reading

[aus9]

attempted to repack boot image with a new adbd executable and the following modified default.prop

#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=0
ro.adb.secure=0
persist.service.adb.enable=1
ro.debuggable=1
persist.sys.usb.config=adb,mass_storage
# above attempts insecure mode
ro.allow.mock.location=0
persist.mtk.aee.aed=on
persist.service.acm.enable=0
ro.mount.fs=UBIFS
ro.persist.partition.support=no

now try to flash.....hangs and does not complete.....grrrrr

Code:

adb devices
adb reboot bootloader (puts me in fastbooot)
fastboot devices
fastboot flash boot boot2.img
# hangs it is supposed to say succeeded

power button no workee....long press fails
hit control + c to stop fastboot fails

remove data cable and put it back in with various power button succeeds and check default.prop on normal bootup....no blinking change.....grrrrr

###################

now we concentrate on adb only

Code:

adb devices
adb remount
##########(result)remount succeeded.......WOO HOO
adb shell ls -al /system/xbin
-rwxr-xr-x root     shell       17912 2014-07-05 15:44 BGW
-rw------- root     root      1062992 2014-09-11 20:50 busybox
-rwxr-xr-x root     root       113036 2014-09-11 22:36 daemonsu
-rwxr-xr-x root     shell       59752 2014-07-05 15:43 dexdump
-rwxr-xr-x root     shell       34572 2014-07-05 15:44 libmnlp_mt6571
-rwxr-xr-x root     shell       30196 2014-07-05 15:44 mnld
-rwxr-xr-x root     shell        9440 2014-07-05 15:44 showmap
lrwxrwxrwx root     root              2014-09-12 18:52 su -> /system/bin/vold
-rwxr-xr-x root     root       624204 2014-07-05 15:44 tcpdump

THERE MY FRIENDS IS THE ERROR!
su is a sym link to vold and that is not right
No sir
grrrrrr

now to see if I can brick it by pushing thru adb the apk and su executable
I am not sure so posting this first so you can have a laugh at my expense

we need a laugh

---

Code:

adb devices
adb remount
remount succeeded
adb shell rm /system/xbin/su
adb shell rm /system/xbin/busybox
adb push su /system/xbin/su
8773 KB/s (113036 bytes in 0.012s)
adb push Superuser.apk /system/app/Superuser.apk
9301 KB/s (2278361 bytes in 0.239s)
adb push busybox /system/xbin/busybox
9543 KB/s (1165484 bytes in 0.119s)

adb shell chmod 644 /system/app/Superuser.apk
adb shell chmod 755 /system/xbin/busybox

adb shell chown root.shell /system/xbin/busybox
adb shell chown root.shell /system/xbin/daemonsu
adb shell chown root.shell /system/xbin/su

adb shell chmod 6755 /system/xbin/su
adb shell ls -al /system/xbin

-rwxr-xr-x root shell 17912 2014-07-05 15:44 BGW
-rwxr-xr-x root shell 1165484 2014-06-13 09:08 busybox
-rwxr-xr-x root shell 113036 2014-09-11 22:36 daemonsu
-rwxr-xr-x root shell 59752 2014-07-05 15:43 dexdump
-rwxr-xr-x root shell 34572 2014-07-05 15:44 libmnlp_mt6571
-rwxr-xr-x root shell 30196 2014-07-05 15:44 mnld
-rwxr-xr-x root shell 9440 2014-07-05 15:44 showmap
-rwsr-sr-x root shell 113036 2008-02-29 04:33 su
-rwxr-xr-x root root 624204 2014-07-05 15:44 tcpdump

Code:

adb shell /system/xbin/su --install
adb reboot

still no joy

[aus9]

well I don't believe it but not sure the logical reason.
the illogical of it....is a reboot to fastboot should destroy rw for system etc

first I was playing around in adb

Code:

adb devices
List of devices attached
0123456789ABCDEF    device
adb remount
remount succeeded
adb shell mount -o remount,ro /system
adb shell mount | busybox grep /system
/dev/ubi0_0 /system ubifs rw,seclabel,relatime 0 0
adb push boot2 /sdcard/boot2
8953 KB/s (4511744 bytes in 0.492s)
adb shell dd if=/sdcard/boot2 of=/dev/bootimg
---error invalid arguement

adb shell
dd if=/sdcard/boot2 of=/dev/bootimg
failed

then I rebooted into fastboot

Code:

fastboot devices -> device seen
fastboot flash boot boot2
sending 'boot' (4406 KB)...
OKAY [  0.113s]
writing 'boot'...
OKAY [  0.616s]
finished. total time: 0.729s

reboot phone
cat /default.prop is exactly what I posted in post 4 for modified boot image

##################

try and get root
still failing

and busybox is also failing

its like pulling teeth from a Windows user
lots of pain
but little to gain

---

most busyboxes are not telling me much

busyboxX.....is first one to say not rooted.

ahh yessssss I know that

grrrrr but at least it is a start

ok may have to jump back to flash a recovery?

---

fastboot is now behaving itself

Code:

fastboot devices -> device detected
fastboot flash recovery ctr2
sending 'recovery' (5156 KB)...
OKAY [  0.132s]
writing 'recovery'...
OKAY [  0.714s]
finished. total time: 0.847s

Altho I can not get touch to work

and yes there are plenty of errors

these relate to either fstab or various init*rc files
may take me a few days to solve
but considering I have been bashing my head against a brick wall
----a change is good!!!!!

[aus9]

well we have come long way



DOES NOT WORK
touch screen so CTR swipe to go back or up a menu also fails

here is current fstab.....yes I know it looks weird

# mount point fstype device [device2]
/boot mtd boot
/misc mtd misc
/system ubifs system
/cache ubifs cache
/data ubifs userdata
/sdcard vfat /dev/block/mmcblk0p1 /dev/block/mmcblk0
/emmc vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1

########/recovery mtd recovery

more testing ....but lack of touch is not good
TESTED but root fails
install from sdcard....finds sdcard and zip file for chainfire
full reboot shows still not rooted

---

altho backup showed NO errors what so ever
restore of it...has wrong /dev/structures
will report later but now trying to use different recovery.fstab as follows

DOTS added by me to make it easier to read

# mount point fstype device [device2]
/system..... ubifs................../dev/ubi0_0
/data......... ubifs................./dev/ubi1_0
/emmc....... vfat .............. /dev/ubi1_1
/cache........ ubifs............../dev/ubi2_0
/boot......... mtd..............boot
/misc......... mtd..............misc
/sdcard...... vfat ............../dev/block/mmcblk0p1 /dev/block/mmcblk0
/recovery... mtd..............recovery

and yes there really is no slash for boot,misc and recovey

restore has error for mtd16...dumchar says thats android = system.......grrrrrr

---

I will try this later

recovey fstab

# mount point fstype device [device2]
/system ubifs /dev/ubi0_0
/data ubifs /dev/ubi1_0
/emmc vfat /dev/ubi1_1
/cache ubifs /dev/ubi2_0
/boot mtd /dev/mtd/mtd6
/recovery mtd /dev/mtd/mtd7
/misc mtd /dev/mtd/mtd9
/sdcard vfat /dev/block/mmcblk0p1 /dev/block/mmcblk0

---

errors for last fstab so ignore

new fstab is
# mount point fstype device [device2]
/system ubifs system
/data ubifs userdata
/emmc vfat emmc
/cache ubifs cache
/boot mtd boot
/recovery mtd recovery
/misc mtd misc
/sdcard vfat /dev/block/mmcblk0p1 /dev/block/mmcblk0


backup completes with no errors to sdcard
restore completes with no errors from sdcard

internal card is emulated and I can not use .....at this stage
Advice was from CTR upstream maintainer

reboot of tablet....so far....so good

image for your enjoyment

[aus9]

ok test shows above restore was misleading as other parts of recovery are a fail

2) I have also attempted to do mod a v1.5 CTR UBIFS port with no luck

3) I kept original recovery and was able to flash it using fastboot

Interesting to me....which I have only just discovered is in bootloader mode
it says vol up to select and vol down to OK

in stock recovery I have been pressing with little luck the power button as there was no screen instructions to the contrary

HA HA....you idiot......OK is volume up

go figure

4) I had a recovery boot loop but now I have just used stock factory reset to get back into normal.....before button to normal also lead to boot looop

WOO HOO.

I might give up this blinking UBIFS and just accept defeat of sorts.

thanks for reading

[Sniper47]

Looks like you've upgraded your camera. Excellent move.

[aus9]

yes its a real camera and the specs never confused me about whether the camera was or was not UBIFS....giggles

offtopic I know its a fujifilm model Finepix T500....aussie price $120

16 megapixels............ 12x optical zoom
24mm wide angle lens.......... 2.7" Screen
Optical image stabilization..... HD Movie 720p

[aus9]

tablet is effectively cactus

normal boot up is stuck on boot logo....not boot loop

I suspect the device is not charging enough as I did numerous reboots from 100% charged

left it on wall charger over night and its still cactus.
---the charging symbol appears on screen....good sign
----the symbol lacks a % sign......very bad sign
-----------as I know it used to have such

I can get to bootloader menu and have used stock recovery to wipe cache and data but still no joy.

I can not trust this device to my relative at this point.