[Android Q&A, Help & Troubleshooting] Mr Data:
Rooting (possibly) all Sealand car devices

TL;DR

I summarize my long post here:

I have an Android car DVD system with software very similar to yours, made by Sealand.

I almost rooted it exploiting a system update that the maker gave me and modifying it.

But I am stuck with checksum errors.

Since it has a Telechips TCC8801 processor, I think it should be rootable in way very similar to the CX-10 mini PC, but I need to know how to handle the differences.

Maybe we can root all Sealand devices in the same way!

By the way: I opened it, so I can tell you what is every chip it has inside!

Complete post:

Hello.

I bought this car DVD system, that has a software very similar to the ones of yours: w w w . aliexpress.com/snapshot/110523994.html

(by the way I found Sealand devices at much lower prices here: w w w. dinodirect.com/2din-car-dvd-player-with-gps-android-2-3-5-wifi-and-3g-internet-access-6-2-inch-digital-color-tft-lcd-and-3d-dynamic-revloving-interface.html?DDID=3520-616&cur=EUR

I discovered from the warranty seal that it is made by Sealand, but I am not sure about the model.

The point is that, like you, I am trying to add to it what it is missing: GoogleServiceFramework.apl, Google Play, Voice Search (to have voice commands) and possibly a better phone dialer.

To do this I need to root this device, but I cannot find anywhere information about how to do this.

This device has two USB host ports, but it seems not to have a device port, so I cannot connect it to a PC and use fastboot or ADB.

But I have a good news: the maker give me a system update that I am pretty sure we could hack to root the device.

It is simply made of 4 files:

- install.ini

- lk.rom

- boot.img

- system.img

To install update it is enough to copy these files on the root directory of the "GPS" micro-SD card and turn on the device with it inside.

These are install.ini contents:

boot.img and system.img turned to be two yaffs2 images, that I unpacked with unyaffs2, with option --yaffs-ecclayout

unyaffs2 --yaffs-ecclayout system.img system

To root it I patched the contents of system.img, manually copying su and superuser.apk from Superuser.zip and changing su attributes.

I repacked it with

mkyaffs2 --yaffs-ecclayout system system.img

But when I try to install my modified update I have an error message "system ram checksum error!!!"

I made some experiments and found that boot.img and system.img are 4 bytes longer than they should (unyaffs2 complains of this).

I inspected last 4 bytes. Thery are:

I suspect these bytes contains a form of checksum of the files, even it is very strange, because they used only 16 bits out of 32 and 16 bits checksums are ovbiously weaker than 32 bit ones. Not knowing how it is calculated, I cannot prepare a modified system.img correctly.

I this another try: I copied boot.img to system.img, in order to have a file with its correct checksum.

It seemed to work: this time I got another error message: "system NAND checksum error!!!".

For this reason I think that in lk.rom there is another checksum for both img files and that it is checked during update.

So what I need is:

- How to connect the device as USB host (maybe there is a jumper that turns the front USB port from host to device or maybe there are the pins of such port on the motherboard and I have just to solder an USB cable).

or

- How to create the correct checksum at the end of the img files and in lk.rom

I found that this device has a Telechips TCC8801 processor, the same of the CX-01 mini PC:

w w w .pandawillforum.com/showthread.php?12711-How-to-Create-a-Custom-Android-Firmware-for-CX-01-mini-PC

I wish I could use te same way to hack my device, but installation process is different, since I do not have a unique .rom file, but the 4 files I listed before.

Can anyone help me to root this?

Thank you very much.