[Android Q&A, Help & Troubleshooting] falk0069:
I've been working on opening up this locked down Android 8.1 (API 27) MediaTek tablet. I've successfully rooted and can write to any partition I want to. I've tried writing similar devices' images to it but have been unsuccessfully at making them work, so I think I'm stuck with what I got. By default after a factory reset you need to connect to a kiosk to set it up--I can't do that. So, I just bypass the setup by removing the Provision.apk and then marking the user setup complete with this command:

settings --user 0 put secure user_setup_complete 1

At this point I can do pretty much anything *except* access the network/Internet :(. Wifi options are not present in settings. I can access them after sideloading the hidden-settings-for-android apk, but toggling the wifi button always results is an error and it does nothing. So, instead I've resorted to directly editing the wpa_supplicant and starting things up with wpa_cli. I can now access the Internet and web browsers and apps mostly work. I still get an occasional app that can't detect / access the Internet and doesn't work. Let me know if you have any additional suggestions. The following things I have learned along the way:

wlan0 interface missing

When running ifconfig wlan0 was missing. For me sideload the hidden-settings-for-android apk got me going. Which behinds to scenes just kicked this off am start -a android.intent.action.MAIN -n com.android.settings/.wifi.WifiDialogActivity. This pops up a dialog on the device where I can enter wifi details. Which as far as I tell just updated this file for me with wifi details /data/misc/wifi/WifiConfigStore.xml. This was enough to get the wlan0 interface to appear, but it wasn't connecting. Also, if you want to just try toggling the wifi on button you can run this: am start -a android.intent.action.MAIN -n com.android.settings/.wifi.WifiSettings but this just always errored on me.

wpa_supplicant

To join a wifi connection the wpa_supplicant process is required. I suppose an open or wep only connection may not need it, but in most cases it will be needed. By running ps -ef | grep wpa I could see it was up an running utilizing this config file: /data/misc/wifi/wpa_supplicant.conf. I tacked on a network section at the bottom so there was a default network to connect to. Here is a sample of what I have:

Spoiler content hidden.

If wpa_supplicant is not running something minimally like this needs to be kicked off /vendor/bin/hw/wpa_supplicant -iwlan0 -Dnl80211 -c/data/misc/wifi/wpa_supplicant.conf, but if there is no wlan0 interface that exists, it won't start. You may want to also check out the rc file that is supposed to start it. In my case it was this file /vendor/etc/init/hw/init.connectivity.rc

iw

This iw tool is quite powerful and I only mention it because it was very instrumental in verify that the wifi hardware was working. Unfortunately, it doesn't seem to be a default app anymore. You can compile your own, though, or here is a link to some statically linked binaries: https://github.com/Zackptg5/Cross-Compiled-Binaries-Android/tree/master/iw. With this tool, I could scan all nearby access points and get stats. It has hundreds of options, but just this will report all the nearby access points ./iw-arm dev wlan0 scan

wpa_cli

wpa_cli is the tool you need to use to interface with wpa_supplicant. Unfortunately, I continued to run into this error "Warning: Failed to attach to wpa_supplicant. - Could not connect to wpa_supplicant: wlan0 - re-trying". I eventually realized it was selinux that was blocking me. Basically these tool tool communicate via sockets at /data/misc/wifi/sockets and selinux was blocking here. I don't know how to best set the contexts to avoid this, so I opted to just disable selinux. See the next section for details. In any case, I just had to run wpa_cli reassociate since the wpa_supplicant.conf had the details in network section. And wpa_cli status showed that I was connected. Much like iw, wpa_cli also has a ton of options. And you can configure all aspects of your connection.

selinux

I'm sure you've heard of selinux. it is good from a security perspective, but understanding all the various contexts and what is needed to make things work is quite difficult. By running cat /proc/kmsg I could see this:

<5>[ 6564.263724] .(0)[4225:wpa_supplicant]audit: type=1400 audit(1264911595.793:203): avc: denied { sendto } for pid=4225 comm="wpa_supplicant" path="/data/misc/wifi/sockets/wpa_ctrl_4241-2" scontext=u:r:hal_wifi_supplicant_default:s0 tcontext=u:r:magisk:s0 tclass=unix_dgram_socket permissive=0

This is what was blocking wpa_cli for me. By just running setenforce 0 you can disable until the next reboot. Making it permanent is a bit more difficult. You can try messing with some of kernel boot parameter in the boot.img or just opt to toggle it each time after a restart. I opted for the latter since I want to eventually find the proper context fix. And actually I'm just using this magisk module to do this for me https://github.com/evdenis/selinux_permissive/releases/tag/v2.0

dhcp

Even though I was connected to my wifi access point, the dhcp step did not happen. This is another stumper. The only dhcp client I could find was in busybox. By running this I could see it successful getting an IP, but it wasn't getting set: busybox udhcpc -v -f -i wlan0. I gave up trying to figure that out and just manually set an IP doing something like this:

ifconfig wlan0 192.168.x.y netmask 255.255.255.0
ip route add default via 192.168.x.1 dev wlan0
#where 'x' and 'y' are set appropriately

dns

So now with an IP address I can ping any IP address but I cannot resolve any FQDN (e.g. google.com). By running this I could set some DNS servers:

ndc resolver setnetdns wlan0 8.8.8.8 8.8.4.4

Only root has access

As it turns out Android has all sorts of protection mechanisms to block Internet. There is CONFIG_ANDROID_PARANOID_NETWORK, SELinux, iptables, etc. This link helped me a lot:

https://serverfault.com/questions/1...chable-when-the-link-is-up-the-route-is-there

If you just run ip rule you can see there are several routing tables. To avoid all the fwmark rules in the iptables, I'm just running this to move the main table up to the top ip rule add pref 998 lookup main

Auto start at boot

I'm sure there are many ways to automate running these commands at start but since I installed the magisk module mentioned above, I just edited the post-fs-data.sh file in zip and added in

chmod 755 /data/system/tmp/start.sh
/data/system/tmp/start.sh &

Then in the /data/system/tmp/start.sh file I added something like this:

ifconfig wlan0 >/dev/null 2>&1
while [ "$?" != "0" ]; do
sleep 1
ifconfig wlan0 >/dev/null 2>&1
done
sleep 2 #for good measures
ip rule add pref 998 lookup main
wpa_cli reassociate
ifconfig wlan0 192.168.1.123 netmask 255.255.255.0
ip route add default via 192.168.1.1 dev wlan0
ndc resolver setnetdns wlan0 8.8.8.8 8.8.4.4

root ca certificates

Nowadays, pretty much every site is https. And because of this you have to make sure you have all latest trusted root certificates. They do expire and without firmware updates, you'll eventually no longer trust any site. Prior to Android 14 this was the only place they lived: /system/etc/security/cacerts/. You can grab some pretty standard ones from here git clone https://android.googlesource.com/platform/system/ca-certificates. And drop them in the cacerts directory. You may need to mount -o remount,rw /system if you are doing it while OS is booted up.

Final thoughts

Like I was saying most apps work, but there are still some glitches. For example Chrome can browse just fine, but it has a banner at the top saying No Internet connection. If anyone has any additional thoughts or ideas to make things better please let me know. I've tried using logcat and strace to see if I can figure out what these apps are doing to make them think there is no internet, but it can't find anything else.

Hopefully this research will at least help someone else.