yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] Drahflow:
What exactly is the goal? Running LineageOS 13.0 userland (but keeping the stock kernel), or replacing the kernel, too? I'll have a second device soon, then I can test if I can boot a custom kernel, but I thought people have reported problems due to the bootloader checking some signature... which means I'd need to build a working kexec(2)-style module to load a custom kernel without angering the bootloader.
[General Questions and Answers] YuriRM:
Is a custom kernel needed in order to run Android 6.0 (Marshmallow) or Android 7.1.2 (Nougat) on Tegra 4 devices?

You tell me because I am not a developer.

However, I am aware that the first good developer of my EStar Takee 1 (Mediatek MT6592T with original Android 4.2.2 Jelly Bean) had to build a custom kernel of Linux 3.4.67 (Android 4.4 KitKat ROM). Then two other less gifted developers were able to use his kernel in order to port an Android 6.0 ROM and Android 7.1.2 ROM.

As an user I tried to gather useful information for a developer on hardware components of this Toshiba branded tablet. First I requested owners of Tegra 4 devices to run the Device Info HW app by Andrey Efremov (@ANDR7E). Then I searched those devices on his online database.

The original manufacturer (Manuf/OEM/ODM Pegatron) has used three FLASH storage components in our Toshiba branded tablet according to price and availability... for example (016G92 and 032G94 and 032G4C).

I recommend that you install the app too.

Device Info HW

www.deviceinfohw.ru

Asus Transformer Pad TF701 (KOOC model) is a clone running [ROM] [N 7.1.2] [ KatKiss - Nougatella #039 ]

However, the camera is not working. This ROM is very good and fast.

https://xdaforums.com/t/rom-n-7-1-2-katkiss-nougatella-039.3540259/

Gigaset QV1030 aka. Quanta FG6Q is a clone running LineageOS 13.0 (Android 6.0). Fortunately, the camera is working. This ROM is not as fast... I guess.

LineageOS for Gigaset QV1030 by FG6Q-Dev

fg6q-dev.github.io

These two devices share most components with Toshiba Excite Pro (AT10LE-A) tablet.

Unfortunately, I could not find donors for TOUCHSCREEN, CAMERA.

The original QV1030 Kernel was published on the Gigaset Webpage.

Gigaset QV1030 Sourcecode:

https://web.archive.org/web/20150519070416/http://www.gigaset.com/support/open-source.html

https://web.archive.org/web/2017060...igaset.com/opensource/QV830-QV1030/QV1030.tar

Please read my posts #48 , #55 , #60 , #62 , #65 , #66 , #68 , #69

It is up to you to decide if the best choice is Android 6 or Android 7... or something else... like Ubuntu Touch.

Maybe you can do much better than previous developers of those Tegra 4 tablet clones.

We respect your decision.
[General Questions and Answers] YuriRM:
Suggestions

Our wish is that a talented developer brings PROJECT TREBLE and PROJECT MAINLINE or PROJECT HALIUM to our Toshiba tablet.

PROJECT TREBLE Posts on XDA

project treble | XDA

The latest and exclusive project treble coverage from XDA.

www.xda-developers.com

PROJECT MAINLINE Posts on XDA

Project Mainline | XDA

The latest and exclusive Project Mainline coverage from XDA.

www.xda-developers.com

HALIUM Posts on XDA

halium | XDA

The latest and exclusive halium coverage from XDA.

www.xda-developers.com

UBports GSI brings Ubuntu Touch to any Project Treble-supported Android device

UBports GSI brings Ubuntu Touch to any Project Treble-supported Android device

XDA‌ Recognized Developer erfanoabdi has compiled an Ubuntu Touch GSI that can be installed on any Project Treble compliant device.

www.xda-developers.com

Halium is an Open Source Project Working Towards a Common Base for Non-Android Mobile Operating Systems

Halium is an Open Source Project Working Towards a Common Base for Non-Android Mobile Operating Systems

Project Halium is an open source project that aims to build a common working base for all non-Android, GNU/Linux based operating systems.

www.xda-developers.com

Developer Brings Full Project Treble Compatibility to the Xiaomi Redmi Note 4

... originally Android 6.0 (Marshmallow), upgradable to 7.0 (Nougat), MIUI 11

Developer Brings Full Project Treble Compatibility to the Xiaomi Redmi Note 4

A developer on our forum has managed to bring full Project Treble compatibility to the Xiaomi Redmi Note 4, and he's proved it by booting a generic Android 8.1 Oreo. This opens up the door for much easier future custom ROM development, and will be hugely beneficial once Android P comes around.

www.xda-developers.com

Project Treble on the Xiaomi Redmi Note 4

How did he do it? He used the “cust” partition on the device for his make-shift vendor partition. The cust partition normally holds a lot of device-specific stuff from MIUI, so it’s essentially wasted space on an AOSP build. Using the approximately 830MB unused partition, he moved the vendor HALs from system into cust without needing to repartition.

After some hard work getting the vendor interface working, he was able to boot up XDA Senior Member phhusson‘s Android 8.1 Oreo GSI without much effort. (Note: phhusson told me that abhishek987 had to change things around for it to work due to a lack of a “versioned VNDK.”

@Drahflow can you do the same? Is Treble worth the effort? Could our Toshiba Treble ROM be adapted easily to Tegra 4 tablets of other brands? Is it easier and faster to compile Ubuntu Touch in the classic way?
[General Questions and Answers] Drahflow:
Unfortunately not. I tried flashing a new recovery, but the bootloader refuses to start it, so I suppose it checks some signature. This leaves us always with the same kernel and the same rootfs during boot. The problem is not "just" one of getting the right vendor blobs to the right places, but how to orchestrate a switch-over from an already running Android into another one.

I tried (and failed) to do a manual startup of various services in a lineage-OS living in a chroot (from the Gigaset QV1030 link you gave above). The only real progress I made was the discovery that a blatant copy of /system/lib/egl from the stock ROM into the lineage image will fix a SIGSEGV in surfaceflinger which could then be started.

Next, I should try to clone the Android /init functionality to have a parser for /init.rc of the lineage OS which is capable of starting all the services with correct sockets etc., as otherwise I don't see a good way to re-start a working system.

If anyone has heard about androids running from within a chroot, please speak up, it would save a lot of time if someone already has some code for it.
[General Questions and Answers] YuriRM:
It is much faster to obtain privileges at the Tegra 4 processor level and bypass the bootloader.

I suggest that you run BootStomp. Please read my posts #95, #96

https://github.com/ucsb-seclab/BootStomp

and DR.CHECKER : A Soundy Vulnerability Detection Tool for Linux Kernel Drivers.

https://github.com/ucsb-seclab/dr_checker

NOTE - Tegra 4 has the same vulnerabilities of Tegra K1 and Tegra X1... because they share the same platform.

Please read my post #63 (extended compilation of vulnerabilities on Tegra processors that you can use, OTA signature spoofing, Malicious Headphones, Arbitrary Kernel Write Vulnerability, etc.)
[General Questions and Answers] YuriRM:
@Drahflow once the bootloader is defeated... JingOS may be another option. It is based on Ubuntu. Version 1.0 is expected in June 2021 (with support for x86 processors only). Support for ARM processors is not yet available. They will sell a JingPad tablet in August 2021. However, despite having GPS and 6-axis Gyroscope it does not have hardware Compass.

Not a good tablet in my opinion for navigation and night sky watching. It is very expensive too at $549.

JingPad A1 Linux tablet crowdfunding begins June 15th for $549 (or less for beta testers)​

JingPad A1 Linux tablet crowdfunding begins June 15th for $549 (or less for beta testers) - Liliputing

JingPad A1 Linux tablet crowdfunding begins June 15th for $549 (or less for beta testers)

liliputing.com

JingOS​

World’s First Linux-Based Tablet OS​

JingOS is a ‘convergence’ Linux-Based Open-Source mobile OS

for tablets and mobile devices.

It can run Linux and Android apps.

It is adapted to run naturally with touch, pencil, keyboard and trackpad.

JingOS | Future Mobile OS based on Linux - JingLing - JingOS

JingOS is a ‘convergent’ Linux-Based Open-Source OS for future tablets&laptops.It is a product of JingLing Tech. JingPad A1 is the World’s FIRST Consumer-level ARM-based Linux Tablet.

en.jingos.com
[General Questions and Answers] YuriRM:
@Drahflow how is it going? Much harder than expected?
[General Questions and Answers] bojan.1995:
@Drahflow bump.
[General Questions and Answers] Drahflow:
Life got in the way, essentially. Getting anything else running is not critical for my usage of the Tablet and there were other priorities. If anyone has time to experiment, I can supply the dirtyCow and .ko required to disable sealime.
[General Questions and Answers] bojan.1995:
Posting files would be nice
[General Questions and Answers] Drahflow:
README inside. If anything is unclear or doesn't work, please ask.
[General Questions and Answers] PM128:
Thank you for posting this method. I copied the files into that /data/local/tmp but 'chmod' command in the Step 2 fails with "Bad mode". I have the predecessor Toshiba Tegra 3 tablet AT300SE (tostab12AL) and I'm trying to root it in order to get some higher Android on it. What can I do to make it work?

Second question: after I will succeed to finally root it IS there any Custom ROM for this hardware at all? Maybe there isn't?
[General Questions and Answers] Drahflow:
Try "chmod 777 *.sh dirtycow" instead.

I have not worked on unlocking the bootloader, my method only replaces / augments the Linux userland of the tablet. Actually getting a newer *Android* running on it will be a lot of research + work.

No idea, really. I don't have one, but that doesn't mean much.
[General Questions and Answers] PM128:
That chmod 777 worked :) Thanks for the tip. However the temporary root test then failed :( See output below. I noticed your shell has the # sign, mine is still only $. Does it indicate your tablet was successfully rooted before the issued commands?

shell@android:/data/local/tmp $ ls -la

-rw-rw-rw- shell shell 55381 2021-12-04 22:39 dirtycow

-rw-rw-rw- shell shell 296 2021-12-04 22:28 root.sh

-rw-rw-rw- shell shell 309 2021-12-04 22:25 start-su.sh

-rw-rw-rw- shell shell 49253 2021-12-04 22:40 su

-rw-rw-rw- shell shell 132 2021-12-04 22:28 temp-root.sh

shell@android:/data/local/tmp $ chmod 777 *.sh dirtycow

shell@android:/data/local/tmp $ ls -la

-rwxrwxrwx shell shell 55381 2021-12-04 22:39 dirtycow

-rwxrwxrwx shell shell 296 2021-12-04 22:28 root.sh

-rwxrwxrwx shell shell 309 2021-12-04 22:25 start-su.sh

-rw-rw-rw- shell shell 49253 2021-12-04 22:40 su

-rwxrwxrwx shell shell 132 2021-12-04 22:28 temp-root.sh

shell@android:/data/local/tmp $ ./temp-root.sh

dcow start-su.sh /system/bin/debuggerd

warning: new file size (309) and destination file size (21736) differ

[*] size 21736

[*] mmap 0x40239000

[*] currently 0x40239000=464c457f

[*] using ptrace method

[*] madvise = 0x40239000 21736

[*] ptrace 0 13

[*] exploited 2417 0x40239000=732f2123

dcow start-su.sh /system/bin/netd

warning: new file size (309) and destination file size (75292) differ

[*] size 75292

[*] mmap 0x4021d000

[*] currently 0x4021d000=464c457f

[*] using ptrace method

[*] madvise = 0x4021d000 75292

[*] ptrace 0 9

[*] exploited 2426 0x4021d000=732f2123

[*] madvise = 0 16777216

[*] exploited 0 0x40239000=732f2123

[*] madvise = 0 16777216

[*] exploited 0 0x4021d000=732f2123

shell@android:/data/local/tmp $ ./su

/system/bin/sh: ./su: can't execute: Permission denied
[General Questions and Answers] PM128:
Well I got a little bit further though. Noticed that 'su' still had no executable permission so I gave it mit chmod. Got the temporary root:

shell@android:/data/local/tmp $ ls -la

-rwxrwxrwx shell shell 55381 2021-12-04 22:39 dirtycow

-rwxrwxrwx shell shell 296 2021-12-04 22:28 root.sh

-rwxrwxrwx shell shell 309 2021-12-04 22:25 start-su.sh

-rwxrwxrwx shell shell 49253 2021-12-04 22:40 su

srwxrwxrwx root root 2022-01-06 12:40 su.sock

-rwxrwxrwx shell shell 132 2021-12-04 22:28 temp-root.sh

shell@android:/data/local/tmp $ ./su

/system/bin/sh: No controlling tty: open /dev/tty: No such device or address

/system/bin/sh: warning: won't have full job control

root@android:/ # id

uid=0(root) gid=0(root)

However the rest of the procedure lead me to confusion. Opened the push.sh file since it could not be executed neither under shell nor su. Through the Adb pull command I managed to get the gps_drv.ko out of the device to the PC. 'cp' command was not recognized by the shell of the device and neither by windows PC of course. So I 'copy'ied the file to the glomus.ko on the PC and that's it, got stuck. Now I think you have linux PC so I need to research if there is some way to "dd" partially copy the files as per your prescription on a windows PC. Any help with it would be appreciated.

shell@android:/data/local/tmp $ cp

/system/bin/sh: cp: not found

127|shell@android:/data/local/tmp $ ./su

/system/bin/sh: No controlling tty: open /dev/tty: No such device or address

/system/bin/sh: warning: won't have full job control

root@android:/ # cp

/system/bin/sh: cp: not found

127|root@android:/ #
[General Questions and Answers] Drahflow:
Do you need more than the temporary root? The rest of the steps are "just" for removing the sealime.ko "protection" blocking you from simply remounting /system and doing whatever you like. It is not certain that your model actually requires these steps.

From the temporary root shell, can you already successfully do

root@tostab12BA:/ # mount -o remount,rw /system

If yes, you can ignore all that glomus.ko business. If not, please check your kernel version with

shell@tostab12BA:/ $ cat /proc/version

Because the instructions (even if successful) will create a fake-GPS driver which does some kernel patching to fixed offsets, and if you are on a different kernel version than I was when I wrote them, it will not work (and potentially crash the device; very likely not brick just crash).

My device reports

Linux version 3.4.57-gc710e6f (android-toshiba@tesibuild7) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Mon Dec 2 17:16:19 IST 2013
[General Questions and Answers] PM128:
The mounting of /system still fails:

shell@android:/data/local/tmp $ ./su

/system/bin/sh: No controlling tty: open /dev/tty: No such device or address

/system/bin/sh: warning: won't have full job control

root@android:/ # mount -o remount,rw /system

mount: Operation not permitted

My kernel:

root@android:/ # cat /proc/version

Linux version 3.1.10-g9ebfa32 (android-toshiba@tesibuild7) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Thu Aug 22 11:22:37 IST 2013

root@android:/ #

I was in the middle of the struggle with some dd for Windows, first didn't have the conv= parameter so then I found GnuWin32 utility, installed, copied the glomus.bin glomus.ko and gps_drv.ko tothat folder because of paths, & the first dd command was (I guess) successful. The second command which uses if=/dev/zero still failed since windows don't have such thing.
[General Questions and Answers] Drahflow:
Any file with a bunch of zero-bytes will do instead of /dev/zero; but I'd be surprised if the resulting glomus.ko would help you - the kernel offsets should be wrong. But following the original unlock development from http://drahflow.name/debian-toshiba-excite-pro.html the next step is to figure those out:

root@tostab12BA:/ # echo 0 > /proc/sys/kernel/kptr_restrict

root@tostab12BA:/ # cat /proc/kallsyms

...

bf0061c0 t cleanup_module [sealime]

...

c0bc6d28 t register_sealime [sealime]

...

(output from my device obviously) What does yours show?
[General Questions and Answers] PM128:
issued the 2 commands (first gave no output):

... hundreds of lines (truncated by term buffer)

bf0285ec t cfg80211_wext_siwtxpower [cfg80211]

bf0000b4 t proc_read [sealime]

bf0000c4 t proc_write [sealime]

bf0032e0 t proc_secsetting_write [sealime]

bf000aac t sealime_ptrace_access_check [sealime]

bf000a90 t sealime_ptrace_traceme [sealime]

bf000ab8 t sealime_bprm_secureexec [sealime]

bf002320 t sealime_sb_mount [sealime]

bf000000 t sealime_sb_umount [sealime]

bf001a58 t sealime_sb_pivotroot [sealime]

bf001928 t sealime_path_unlink [sealime]

bf001814 t sealime_path_mkdir [sealime]

bf00174c t sealime_path_rmdir [sealime]

bf0014f0 t sealime_path_mknod [sealime]

bf001440 t sealime_path_truncate [sealime]

bf001310 t sealime_path_symlink [sealime]

bf001104 t sealime_path_link [sealime]

bf001074 t sealime_path_rename [sealime]

bf000fb8 t sealime_path_chroot [sealime]

bf000790 t sealime_init_module [sealime]

bf002260 t sealime_wifi_associate [sealime]

bf000010 t sealime_file_permission [sealime]

bf001ba8 t sealime_dentry_open [sealime]

bf000608 t sealime_task_create [sealime]

bf000560 t sealime_socket_connect [sealime]

bf000444 t sealime_socket_accept [sealime]

bf0000d4 t sealime_procfs_open [sealime]

bf000140 t sealime_procfs_release [sealime]

bf000160 t sealime_procfs_priv_open [sealime]

bf000170 t sealime_procfs_priv_release [sealime]

bf004814 t extra_ptrace_access_check [sealime]

bf004824 t extra_ptrace_traceme [sealime]

bf004884 t extra_bprm_secureexec [sealime]

bf004834 t extra_sb_mount [sealime]

bf004844 t extra_sb_umount [sealime]

bf004854 t extra_sb_pivotroot [sealime]

bf0048a4 t extra_path_unlink [sealime]

bf004904 t extra_path_mkdir [sealime]

bf004894 t extra_path_mknod [sealime]

bf004944 t extra_path_truncate [sealime]

bf0048b4 t extra_path_rename [sealime]

bf004864 t extra_path_chroot [sealime]

bf0048d4 t extra_init_module [sealime]

bf004954 t extra_wifi_associate [sealime]

bf004874 t extra_file_permission [sealime]

bf004914 t extra_file_ioctl [sealime]

bf0048f4 t extra_dentry_open [sealime]

bf0048c4 t extra_task_create [sealime]

bf0048e4 t extra_task_prctl [sealime]

bf004924 t extra_socket_connect [sealime]

bf004934 t extra_socket_accept [sealime]

bf004704 t parse_cmdline [sealime]

bf003b9c t set_protect_file [sealime]

bf003b4c t set_protect_nand [sealime]

bf000180 t cleanup_module [sealime]

bf0001dc t safe_kfree [sealime]

bf002a48 t sealime_procfs_ioctl [sealime]

bf002d04 t set_loglevel_from_file [sealime]

bf003210 t my_printk_when_verbose [sealime]

bf003794 t init_module [sealime]

bf00018c t basename [sealime]

bf003be0 t concat_path [sealime]

bf000180 t sealime_cleanup [sealime]

bf00462c t read_odm_prod_mode [sealime]

bf00325c t my_printk_when_error [sealime]

bf002d9c t sealime_file_ioctl [sealime]

bf003294 t my_printk [sealime]

bf000820 t determ_ptrace [sealime]

bf000cb4 t set_zygote_state_allthread [sealime]

bf003c48 t init_variables [sealime]

bf00403c t sealime_task_prctl [sealime]

bf001afc t is_android_system_program [sealime]

root@android:/ #
[General Questions and Answers] Drahflow:
bf000180 t cleanup_module [sealime]

That's different from my kernel layout, so we'd need a build a different glomus.ko patch. :(

If you are willing to spend a few more hours on this; I'd need the output of

root@tostab12BA:/ # cat /proc/kallsyms | grep register_sealime

root@tostab12BA:/ # cat /proc/kallsyms | grep print_hex_dump

and a copy of your /system/lib/modules/gps_drv.ko

Then I can patch that into a glomus.ko with instructions to dump (via print_hex_dump) the instructions of register_sealime (which you'll need to pull via adb logcat) and then with that info I can prepare a second version of glomus.ko to disable sealime on your device. It'll take a bit of back-and-forth I think, but OTOH you don't need to do any patching on windows.
[General Questions and Answers] PM128:
Was not so easy since that shell doesn't have grep. I had to max the term buffer to 9999 then copy the output (was still truncated) and search in it:

c0857494 r __kstrtab_register_sealime

c08595b2 r __kstrtab_print_hex_dump_bytes

c08595c7 r __kstrtab_print_hex_dump
[General Questions and Answers] Drahflow:
Unfortunately, those you found are the addresses in the string table which contains the symbol names, i.e. not useful for this.

Does

cat /proc/kallsyms > /data/local/tmp/kallsyms.txt

give you the full list?
[General Questions and Answers] PM128:
Here you go.

Hmm I don't know why are the addresses all 0s now. I had the tabby off for a while and now it doesn't boot (stuck in the sparkling stars). I don't get even the temp root # after ./su.
[General Questions and Answers] PM128:
Since I luckily still have access to the shell while the tabby is stuck on the booting I managed to let the dirtycow chow the system again and got the temp root again. With it I was able to get the complete dump of the kallsyms (had to chown it back to shell since adb pull couldn't get it otherwise). Would it be useful for you now?

c02145c4 t register_sealime

c0252878 T print_hex_dump

c02529a0 T print_hex_dump_bytes

Complete dump is attached.
[General Questions and Answers] Drahflow:
Thanks, this is useful. I should find some time over the weekend to build a dumping glomus.ko for your device.
[General Questions and Answers] Drahflow:
Please find attached a sightly "improved" version of your gps_drv.ko, which you can use like so:

1. Get temp root

2. Replace (in memory only) the original gps_drv.ko with the new one via dirtycow:

root@tostab:/data/local/tmp # ./dirtycow dump_memory.ko /system/lib/modules/gps_drv.ko

3. Load the new gps_drv.ko

root@tostab:/data/local/tmp # insmod /system/lib/modules/gps_drv.ko

It should say:

insmod: init_module '/system/lib/modules/gps_drv.ko' failed (Identifier removed)

4. Dump the kernel error log and search for the code-dump via glomus (should be near the end)

root@tostab:/data/local/tmp # dmesg

It should look like a bunch of lines like this one:

<3>[ 2669.888648] glomusc02096d0: 00 41 3f e2 00 40 bd e8 20 3a 3a e1 dd aa 27 e3 .@-..@..(=...0L.

Please copy them into a .txt and upload. Those are the (hex representation of) the init_sealime instructions. I should be able to use those as a template where to reset whatever init_sealime did (most likely by just clearing two pointers at the right address).
[General Questions and Answers] PM128:
First of all thanks so much for your time and dedication to help me.

I pushed the dump_memory.ko into that /data/local/tmp folder (as shell of course, was wondering if I should have chown it to root before letting the dirtycow chew it). Got the temp root and issued the command ad 2.) ... didn't get the desired # prompt back even waited for like 20 minutes (got stuck on something):

root@android:/ # ./dirtycow dump_memory.ko /system/lib/modules/gps_drv.ko

/system/bin/sh: ./dirtycow: not found

127|root@android:/ # cd /data/local/tmp

o /system/lib/modules/gps_drv.ko <

dcow dump_memory.ko /system/lib/modules/gps_drv.ko

[*] size 152743

[*] mmap 0x40192000

[*] currently 0x40192000=464c457f

[*] using ptrace method

[*] madvise = 0x40192000 152743

[*] ptrace 0 5

[*] exploited 14500 0x40192000=464c457f

root@android:/data/local/tmp # [*] madvise = 0 16777216

[*] exploited 0 0x40192000=464c457f

<--- here it stopped and no further progress

root@android:/data/local/tmp # <--- after pressing Enter

So instead of proceeding to the step 3.) here is the dmesg output so far no glomus there. Please note that the tablet is stuck in the boot process somewhere.
[General Questions and Answers] Drahflow:
I'm not exactly sure what's going on in your terminal (I think it didn't like to display one of the longer commands and the display / copy-paste got jumbled somewhat after that). But otherwise everything seems fine. Maybe it'll be better if you use a wider terminal, but no idea.

Anyway... Please redo step 2 (as soon as enter gets you a new prompt it's done; no need to wait 20 minutes) and then proceed to step 3 and 4. That the tablet is stuck somewhere in UI startup shouldn't matter.