[Android Q&A, Help & Troubleshooting] shadow#:
Hi everyone!

It's been a while since I last fiddled with Android, more than a decade!

But I think I found a nice little project that I'll try to document here.

So far bricked it, tore it apart, found UART and managed to unbrick it.

I could really need some help to try and edit the boot image!

So I recently got my hands on a Polycom Conference phone...

It's a nice handsfree device that I now use as a USB speakerphone and SIP client on my desk at home.

And it's running Android, so it cannot be left untouched!!!

My goal is to root it, maybe be able to install some additional apps on it and ideally retain these things with a current software update - more on that later.

My starting point:

The device has its own launcher and is unfortunately completely locked down.

No ADB, no custom apps, no browser, no nothing.

All I can do is start an internal recovery on boot that will look for a firmware on a USB drive.

It works for one SIP account and can be used as a USB speakerphone.

Pretty boring for what it is, I think.

Some details:

Android 4.4.2, Kernel version 3.0.31

Hardware: bcm911130_pl_rocky_proto2, PolyDSP Merlyn ARMA9, BootBlock 3.0.5.0006 (65290-001), BCM28155 A3 VideoCore

CPU: armeabi-v7a, capri_pl_rocky_proto2

Getting root:

There is a known vulnerability for the device in an older firmware version:

It's described here unkl4b.github.io/Authenticated-RCE-in-Polycom-Trio-8800-pt-1/

While it's not exactly easy to downgrade to this version and should not even be possible according to support documents,

it is in fact possible by starting from the latest 5.9.6.3432 version Polycom still offers and then downgrading via USB in two increments via

5.8.0 AA (downloads.polycom.com/voice/rp_trio/Polycom_UC_Software_5_8_0_15024_AA_Trio8800_release.zip) to the vulnerable version

5.7.1.4145 (downloads.polycom.com/voice/rp_trio/Polycom_UC_Software_5_7_1_4145_AC_Trio8800_release.zip)

Now I can enable Telnet on the device by uploading the following configuration file:

<telnet diags.telnetd.enabled="1"></telnet>

And then start the process as described, by logging in on port 1023 with Polycom / 456 (or the current Admin password) and starting adbd:

ping 8.8.8.8 ; setprop service.adb.tcp.port 5555
ping 8.8.8.8 ; stop adbd
ping 8.8.8.8 ; start adbd

After that, I can connect via adb over TCP and open a shell as root. Yay!

Where that leaves me:

I can enable the Android Launcher and use it until the Poly Launcher pops up again every 30 seconds or so via pm enable com.android.launcher

Enabling USB debugging does not work. It disables the TCP connection but no USB connection is possible.

I tried to install APKs over the shell but the Polycom Settings app has a watchdog that deletes everything again immediately.

The setting userAllowed seems to be defined in /data/data/com.polycom.polysettings/shared_prefs/com.polycom.polysettings.PreferencesFile.xml but any changes to this file are just overwritten immediately.

I removed that settings app by remounting /system with mount -o rw,remount /system and renaming /system/app/PolySettings.apk and /system/app/PolySettings.odex.

After killing the process, that unfortunately leads to a popup every second, telling me that the settings app could not be opened.

With a lot of fast tapping it would be possible to start a 3rd party app on the device. Kingoroot did not work, though.

So the remote shell is all I have for now.

I managed to dd everything under /dev/block/ as well as /system, /user and /cache as an image.

Here's where I would really appreciate some help!

Do I even have a chance to make some persistent changes to this phone without tearing it apart?

Any development tools I saw are for much newer Android versions, so if I even have a chance at changing anything, someone pointing me in the right direction (kitchens, tutorials) would be great.

My main machine is a Mac but I have a Windows machine at my disposal.

What should my next steps be?

How can I have a look into what's on the device from the images I pulled?

How would I best approach all the device restrictions?

How can I then make permanent changes, if at all?

Would I have a chance to (partially) upgrade to a newer firmware while keeping it rooted and modded?

I'll keep poking it, the process has been fun so far.

Maybe this will lead to something in the end, maybe not.

Any help is highly appreciated!

s#