[Android Q&A, Help & Troubleshooting] tjnii:
Good day:

Short question: I wish to root a Android 13 device. I have ADB shell access, but as the `shell` user not as `root` (*). This is a no-name device with no documentation anywhere I can locate, so no firmware download options. After spending yesterday morning reading about the rooting process I have the following core points of understanding:

- Android OS images aren't like generic Linux installers, they're tailored to the device. There is no "all-in-one" Android image, each device has unique firmware.

- Root is not available via any easily accessed manner, as that would make it easy to access data on what is basically a portable and easily lost device. Android doesn't have the equivalent of interactively booting into single-user mode via kernel arguments and changing the root password / adding yourself to the sudoers group like regular Linux.

- Rooting tools like Magisk work by taking the boot.img file for the device and modifying it so the root user can be accessed, and then performing a firmware update with that modified image. As the required starting boot image file is device specific there is no one-size-fits-all rooting method.

I also believe the following points are true but I'm more likely to be mistaken on one of these:

- The current boot.img isn't available via the bootloader / fastboot. I'll elaborate on why I think this in the longer "What I'm doing" section below.

- If you cannot download a boot.img from a source online and cannot intercept a firmware update to grab a boot.img it's not possible to root the device short of physically opening the unit and imaging / programming the storage IC with hardware tools.

So, my Newbie question to the forum is: Is that all correct? This is based on a half-day of forum reading and poking at the device and I think I've hit the limit of effort I want to put in. Before I throw up my hands and move on I just want to make sure I didn't misread / misunderstand something major.

So, that was the core of my question, here's the full context for those who want to know the "why" behind those points:

I purchased one of those <$100 Android 13 tablets off Amazon and spent all of yesterday morning poking at it. This device uses a Rockchip RK3562 SoC, and is a no-name device in the most pure definition of the term, even the vendors that hosted the manufacturer's domains are no longer on the internet. Searching for the device I cannot find any information about it outside of the sales listings on marketplace sites, so going and downloading a firmware bundle is not looking like a option.

I want to root the device to de-Google it as I only want it as a crude drawing platform to draw architecture and flow diagrams. I have extensive Linux experience and some embedded device experience, but I've never rooted Android or used ADB before. So this is also a bit of a learning play-round experience on a otherwise disposable device as well. I was able to shell into the device with ADB and poke around, doing this I was able to learn the following about the device:

- It uses the RK3562 SoC

- It's running ro.product.build.version.release=13 ro.product.build.version.sdk=33

- It uses the a/b image update model

- FOTA server is fota5p.adups.com in China. It does differential updates.

- The FOTA files are not downloaded to a location the `shell` user has access to.

- The `shell` user does not have disk device read access, so cannot image the partitions directly.

I wasn't able to figure out who is building the firmware images for this device. The manufacturer in the firmware is "incar" but their websites are gone, and the parking pages for the domains either don't load, the hosting company doesn't have a website themselves, or the hosting provider themselves are also gone. adups.com doesn't load and that company doesn't have a website I can locate. So, given this, I believe I'm at the following impasse:

- I cannot download an image from the open internet, I can't find any.

- The FOTA URLs logged are differential, and figuring out the arguments and signing to even determine if a boot.img is accessible via that API isn't worth the effort. The actual API request is a signed POST with device specific fields, so it's not as easy as dropping a HTTP GET URL into cURL.

- (Might be mistaken) The FOTA app doesn't use user-installed SSL certs, so running a MITM proxy to intercept fota5p.adups.com is likely to fail. (This is purely based on forum research, I haven't tried it as looks too likely to be a dead-end. Didn't feel like messing with my network config to route traffic through a intercepting proxy to find out.)

- The a/b boot devices are not readable by the shell user, so imaging the boot device directly with `dd` is not an option.

- (Might be mistaken) Imaging the boot device from the bootloader isn't an option.

- There are no open binary blobs for the RK3562 I've been able to find, and the RK3399 datasheets I did find are in Chinese, which I cannot read. The likelyhood of me being able to compile an greenfield Android build for this device within a readonable timeframe is very low, especially since I've never compiled/configured Android before and haven't done proper embedded devopment in 10+ years.

I have not messed with the bootloader or installed fastboot. I'm under the impression that getting a boot.img isn't possible via the bootloader as that would be a pretty big security oversight, and if it was possible that seems like it would be a common and convenient option. Given that I haven't found any guides on how to do that, and if it was possible I imagine it would be common, so I assume it's not possible. With that I believe I'm at a dead end I don't want to mess with the bootloader as right now as I haven't actually made any major changes to the device; I can still factory reset it and return it in the same condition I received it in. I'm likely going to do this as I'm thinking it would be better to just get a unit that's known rootable. When I started this I didn't realize just how device specific this process and these images are, so I've learned that at least. I don't think it's worth spending any more time fiddling with this unless I've made a significant mistake in my understanding or overlooked something major (hence this post to confirm). This Rockchip SoC is dog-slow anyway, only 48 BogoMIPS. (That's what, a Pentium 100 equivalent or thereabouts?)

Thanks for taking the time to read all that. Hopefully I'm not too far off base or didn't miss anything glaring in my research yesterday.

(*) Because it's unrooted, obviously. I only call this out because I've seen other forum posts about getting the boot.img to root the device where there are responses saying "if you have root you can image the boot partition." Well, yea, but I don't have root, which is why I'm asking about how to get the image...