├── .github └── workflows │ └── generate-wiki.yaml ├── README.md ├── docs ├── BT-20181201113141.pdf ├── CPU-Rockchip-RK3128_C191248.pdf └── RAM-DS_K4B2G1646F_BY_M_Rev1_0-1.pdf ├── dump └── R1.00-BTS84-20200718.100054.md ├── pics ├── AndroidVersion20201015.jpg ├── Backside-LQ.jpg ├── Backside-UART.jpg ├── OpenBottom.jpg ├── OpenTop.jpg └── Topside-LQ.jpg └── wiki ├── Hardware-Overview.md ├── Home.md ├── Install-Launcher-and-Store.md ├── Open-the-tigerbox.md ├── UART-ADB-Root.md └── _Footer.md /.github/workflows/generate-wiki.yaml: -------------------------------------------------------------------------------- 1 | name: Generate wiki from code 2 | 3 | on: 4 | workflow_dispatch: 5 | push: 6 | branches: 7 | - master 8 | pull_request: 9 | branches: [ "master", "develop" ] 10 | 11 | jobs: 12 | build: 13 | runs-on: ubuntu-latest 14 | 15 | steps: 16 | - uses: actions/checkout@v1 17 | # Additional steps to generate documentation in "Documentation" directory 18 | - name: Upload Documentation to Wiki 19 | uses: SwiftDocOrg/github-wiki-publish-action@v1 20 | with: 21 | path: "wiki" 22 | env: 23 | GH_PERSONAL_ACCESS_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }} 24 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # tigerbox 2 | Holds all gathered information 3 | 4 | Feel free to push updates to our wiki. Just clone this repo, edit the wiki files in the "wiki" directory and open a pull request. -------------------------------------------------------------------------------- /docs/BT-20181201113141.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/docs/BT-20181201113141.pdf -------------------------------------------------------------------------------- /docs/CPU-Rockchip-RK3128_C191248.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/docs/CPU-Rockchip-RK3128_C191248.pdf -------------------------------------------------------------------------------- /docs/RAM-DS_K4B2G1646F_BY_M_Rev1_0-1.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/docs/RAM-DS_K4B2G1646F_BY_M_Rev1_0-1.pdf -------------------------------------------------------------------------------- /dump/R1.00-BTS84-20200718.100054.md: -------------------------------------------------------------------------------- 1 | # Tigerbox Touch firmware R1.00-BTS84-20200718.100054 2 | 3 | ### description 4 | 5 | eMMC partitions dump 6 | mmcblk0rpmb not included 7 | This FW version already has the 'hardwarefehler' message for devices with possible factory audio amp defect. 8 | 9 | ### acquisition 10 | 11 | the images were downloaded using `adb pull`, ie. 12 | ``` 13 | adb root 14 | adb pull /dev/block/mmcblk0p1 mmcblk0p1.img 15 | ``` 16 | 17 | ### file identification 18 | 19 | mmcblk0p1.img: Android bootloader 20 | mmcblk0p2.img: Zero-filled 21 | mmcblk0p3.img: boot data; at 0x600 - Flattened device tree, size: 82422 bytes, version: 17 22 | mmcblk0p4.img: Linux kernel ARM boot executable zImage (little-endian) 23 | mmcblk0p5.img: Android bootimg, kernel (0x60408000), ramdisk (0x62000000), second stage (0x60f00000), page size: 16384 24 | mmcblk0p6.img: Android bootimg, kernel (0x60408000), ramdisk (0x62000000), second stage (0x60f00000), page size: 16384 25 | mmcblk0p7.img: Zero-filled 26 | mmcblk0p8.img: Linux EXT filesystem, `/cache`, blocks count: 32768, image size: 33554432, rev 2.0, ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9c0f9 27 | mmcblk0p9.img: Linux EXT filesystem, blocks count: 4096, image size: 4194304, rev 2.0, ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9c0f9 28 | mmcblk0p10.img: Zero-filled 29 | mmcblk0p11.img: Linux EXT filesystem, `/system`, blocks count: 153600, image size: 157286400, rev 2.0, ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9c0f9 30 | mmcblk0p12.img: Zero-filled 31 | mmcblk0p13.img: Linux EXT filesystem, `/data`, rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9c0f9 (needs journal recovery) (damaged-pulled live) (large files) 32 | 33 | ### download link 34 | 35 | [Download from Mega](https://mega.nz/file/AFlhSIaL#otZdXQySvUL6HOX5q3lVk-1KIIVlHkRnMnaTJz0tZ90) 36 | -------------------------------------------------------------------------------- /pics/AndroidVersion20201015.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/pics/AndroidVersion20201015.jpg -------------------------------------------------------------------------------- /pics/Backside-LQ.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/pics/Backside-LQ.jpg -------------------------------------------------------------------------------- /pics/Backside-UART.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/pics/Backside-UART.jpg -------------------------------------------------------------------------------- /pics/OpenBottom.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/pics/OpenBottom.jpg -------------------------------------------------------------------------------- /pics/OpenTop.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/pics/OpenTop.jpg -------------------------------------------------------------------------------- /pics/Topside-LQ.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tigerbox-reverse-engineering/tigerbox/644c738d295ab26bdf97991ac8115d4a02e98a81/pics/Topside-LQ.jpg -------------------------------------------------------------------------------- /wiki/Hardware-Overview.md: -------------------------------------------------------------------------------- 1 | # Pictures 2 | 3 | ## Board 4 | ### Top 5 | ![](https://github.com/tigerbox-reverse-engineering/tigerbox/raw/master/pics/Topside-LQ.jpg) 6 | ### Bottom 7 | ![](https://github.com/tigerbox-reverse-engineering/tigerbox/raw/master/pics/Backside-LQ.jpg) 8 | 9 | # Parts 10 | 11 | | Marking | Amt. | Pkg. | Function | Specification | 12 | | --------------------- | ----:| ---- | -------- | ------------- | 13 | | Rockchip RK3128 | 1 | | Processor | [datasheet](https://datasheet.lcsc.com/szlcsc/Rockchip-RK3128_C191248.pdf) | 14 | | BK3266 | 1 | | Bluetooth Audio SoC | [datasheet](http://c-chip.com.cn/userfile/productPic/20181201113141.pdf) | 15 | | Rockchip RK3128 | 1 | | Processor | [datasheet](https://datasheet.lcsc.com/szlcsc/Rockchip-RK3128_C191248.pdf) | 16 | | Samsung K4B2G1646F-BYMA | 1 | | RAM 2x256MB DDR3L SDRAM | [datasheet](https://www.samsung.com/semiconductor/global.semi/file/resource/2017/11/DS_K4B2G1646F_BY_M_Rev1_0-1.pdf) | 17 | | | 1 | | Memory 8GB eMMC | | 18 | | | 1 | | NFC Module | | 19 | -------------------------------------------------------------------------------- /wiki/Home.md: -------------------------------------------------------------------------------- 1 | Welcome to the tigerbox wiki! 2 | 3 | This wiki contains all tigerbox related information we gathered. 4 | 5 | # Master plan for unlocking 6 | 7 | So let's say we have a [Tigerbox](https://tiger.media/tigerbox-touch/), and we 8 | want to use it for something more than the german audiobooks for kids. 9 | 10 | What are the general steps we have to take? You probably already have that in your mind: 11 | 12 | * As the box is an [Android](https://en.wikipedia.org/wiki/Android_(operating_system)) 13 | device, we need to enable a way of sideloading and installing Android applications. 14 | 15 | * When we're able to install applications, we should make some kind of menu-based launcher 16 | to be started in place of the fullscreen Tigerbox app. 17 | 18 | * After the menu starts instead of Tigerbox app, we can install further applications and use 19 | them to play any music or watch any videos. 20 | 21 | # Unlocking in more detail 22 | 23 | Now we can think about detais of each point in the plan. Knowing as much as 24 | possible about [[the hardware we're working on|Hardware Overview]] becomes 25 | important at this point. 26 | 27 | ## Enable a way of sideloading and installing apps 28 | 29 | Android devices can be controlled using [Android Debug Bridge](https://developer.android.com/studio/command-line/adb). 30 | The ADB can use USB or Wi-fi network to talk to the target device from any PC. 31 | But both these ways of communication are normally disabled on Tigerbox - we 32 | need to enable at least one of them. 33 | 34 | You can use the method without opening the box, then you need to Go directly to adb UART adb root, or you use the method in which you need to open the box. 35 | 36 | * [[Open the tigerbox|Open the tigerbox]] 37 | 38 | * [[Make UART connection to enable ADB|UART ADB Root]] 39 | 40 | After this is done, you shouldn't have to access the internal connections 41 | anymore - you can close it. 42 | 43 | ## Install launcher, store and other apps 44 | 45 | Now it is just a matter of utilizing the ADB connection to [[Install Launcher and Store]]. 46 | It might be worth to also install some shared services, so that apps can use 47 | them. 48 | 49 | ## Use the apps through the menu 50 | 51 | No tutorial needed for that. 52 | -------------------------------------------------------------------------------- /wiki/Install-Launcher-and-Store.md: -------------------------------------------------------------------------------- 1 | # Preparation 2 | 3 | Please use the [[UART-ADB root tutorial|UART ADB Root]] to gain ADB access. 4 | 5 | # Make Android GUI useable 6 | 7 | We need the ability to install and start apps from the screen, like on any Android device. 8 | 9 | ## Install F-Droid 10 | 11 | It is an app store, which is easy to get and has a lot of software we can use. 12 | It has very little dependency on existing software, so will work on any Android, 13 | no matter how much cut down. 14 | 15 | Download [F-Droid APK](https://f-droid.org/F-Droid.apk) and install it via ADB. 16 | 17 | ``` 18 | adb install F-Droid.apk 19 | ``` 20 | 21 | ## Install OpenLauncher 22 | 23 | Now we need to have a menu with applications - in other words, a launcher. 24 | 25 | Run _F-Droid_, and install _OpenLauncher_. 26 | 27 | ``` 28 | adb shell monkey -p 'org.fdroid.fdroid' -v 5 29 | ``` 30 | 31 | If the launcher isn't in the foreground, run it directly. 32 | 33 | ``` 34 | adb shell monkey -p 'com.benny.openlauncher' -v 5 35 | ``` 36 | 37 | Don't forget to set the _OpenLauncher_ as standard launcher in _Settings_. 38 | Otherwise, it will start the _Tigerbox App_. 39 | 40 | ## Install VirtualSoftKeys 41 | 42 | As the device only has a power button, you will need some kind of virtual buttons. 43 | [VirtualSoftKeys](https://f-droid.org/packages/tw.com.daxia.virtualsoftkeys/) 44 | is a good choice, and available in _F-Droid_ store. 45 | 46 | # Supplemental Android improvements 47 | 48 | ## Add more Stock Packages 49 | 50 | The Android you have is missing some standard packages which are used by other 51 | Apps. Not having these stock dependencies will make many applications not work. 52 | 53 | Where to get these packages from, you ask? You extract them from a stock image, 54 | preferably matching the Android version and SoC which you have in your _Tigerbox_. 55 | And what you have, you can check in _Settings_ -> _Device info_. 56 | 57 | If your Android is 5.1.1, and chip is rk312x, then you should be able to use the 58 | already extracted packages: 59 | 60 | * selection from images of some RK312x Tablets: 61 | [Download from Mega] https://mega.nz/file/S3B3iJAB#AzEKVNInkoZ3dvBPcdakYnN2Rh35uccJ4TCe-2GGJ4A 62 | 63 | The APK files could be installed by `adb install --user 0 `, but you would 64 | notice that some files are refusing to install unless modded, and in general - 65 | these packages should be really maintained by the Android system, not by the user. 66 | 67 | To include them into the system-maintained pool, you need place them into folders 68 | `/system/priv-app` and `/system/app`. Packages placed there are automatically 69 | installed on system reboot, as system-maintained packages. 70 | 71 | ### Add Stock Packages to 'priv-app' 72 | 73 | First, copy the files to a temporary folder on your device. 74 | 75 | ``` 76 | adb shell mkdir /sdcard/temp-priv-app 77 | adb push priv-app/* /sdcard/temp-priv-app 78 | ``` 79 | 80 | Now, log in to the device, and get _Super User_ privileges. 81 | 82 | ``` 83 | adb shell 84 | su 85 | ``` 86 | 87 | Then, you can move the folders into final location, and remove the temporary copy. 88 | 89 | 90 | ``` 91 | cp -r /sdcard/temp-priv-app/* /system/priv-app/ 92 | rm -rf /sdcard/temp-priv-app 93 | ``` 94 | 95 | While still in the ADB shell with elevated priveleges, change attributes of the folders 96 | and files you copied. This is neccessary, because this version of Android 97 | is very strict about attributes, and will ignore the packages which do not match. 98 | 99 | ``` 100 | chmod 755 /system/priv-app/CalendarProvider 101 | chmod 644 /system/priv-app/CalendarProvider/* 102 | 103 | chmod 755 /system/priv-app/Contacts 104 | chmod 644 /system/priv-app/Contacts/* 105 | 106 | chmod 755 /system/priv-app/ContactsProvider 107 | chmod 755 /system/priv-app/ContactsProvider/* 108 | 109 | chmod 755 /system/priv-app/DownloadProvider 110 | chmod 644 /system/priv-app/DownloadProvider/* 111 | 112 | chmod 755 /system/priv-app/MusicFX 113 | chmod 644 /system/priv-app/MusicFX/* 114 | 115 | chmod 755 /system/priv-app/TelephonyProvider 116 | chmod 644 /system/priv-app/TelephonyProvider/* 117 | 118 | chmod 755 /system/priv-app/TeleService 119 | chmod 644 /system/priv-app/TeleService/* 120 | ``` 121 | 122 | You can exit the shell by typing `exit` command, twice. Or make the device restart 123 | and install the new packages by typing `reboot`. 124 | 125 | After the packages are installed, you can switch from _OpenLauncher_ to 126 | the standard _Android Launcher_, if you prefer. The standard one is a bit 127 | more responsive, but both are useable. 128 | 129 | If the _Android Launcher_ doesn't show wallpaper, then execute in ADB shell: 130 | `pm enable com.android.systemui`. Effects are immediate. 131 | 132 | ### Add Stock Packages to `app` 133 | 134 | We will do this using the same procedure as we did for `priv-app`. 135 | 136 | First, copy the files to a temporary folder on your device. 137 | 138 | ``` 139 | adb shell mkdir /sdcard/temp-app 140 | adb push app/* /sdcard/temp-app 141 | ``` 142 | 143 | Now, log in to the device, and get _Super User_ privileges. 144 | 145 | ``` 146 | adb shell 147 | su 148 | ``` 149 | 150 | Then, you can move the folders into final location, and remove the temporary copy. 151 | 152 | 153 | ``` 154 | cp -r /sdcard/temp-app/* /system/app/ 155 | rm -rf /sdcard/temp-app 156 | ``` 157 | 158 | While still in the ADB shell with elevated priveleges, change attributes of the folders 159 | and files you copied. 160 | 161 | ``` 162 | chmod 755 /system/app/Browser 163 | chmod 644 /system/app/Browser/* 164 | 165 | chmod 755 /system/app/BrowserProviderProxy 166 | chmod 644 /system/app/BrowserProviderProxy/* 167 | 168 | chmod 755 /system/app/Calculator 169 | chmod 644 /system/app/Calculator/* 170 | 171 | chmod 755 /system/app/Calendar 172 | chmod 644 /system/app/Calendar/* 173 | 174 | chmod 755 /system/app/ConfigUpdater 175 | chmod 644 /system/app/ConfigUpdater/* 176 | 177 | chmod 755 /system/app/DeskClock 178 | chmod 644 /system/app/DeskClock/* 179 | 180 | chmod 755 /system/app/DocumentsUI 181 | chmod 644 /system/app/DocumentsUI/* 182 | 183 | chmod 755 /system/app/DownloadProviderUi 184 | chmod 644 /system/app/DownloadProviderUi/* 185 | 186 | chmod 755 /system/app/Exchange2 187 | chmod 644 /system/app/Exchange2/* 188 | 189 | chmod 755 /system/app/Launcher3 190 | chmod 644 /system/app/Launcher3/* 191 | 192 | chmod 755 /system/app/MediaShortcuts 193 | chmod 644 /system/app/MediaShortcuts/* 194 | 195 | chmod 755 /system/app/MusicLocal 196 | chmod 644 /system/app/MusicLocal/* 197 | 198 | chmod 755 /system/app/PartnerBookmarksProvider 199 | chmod 644 /system/app/PartnerBookmarksProvider/* 200 | 201 | chmod 755 /system/app/RkApkInstaller 202 | chmod 644 /system/app/RkApkInstaller/* 203 | 204 | chmod 755 /system/app/RkExplorer 205 | chmod 644 /system/app/RkExplorer/* 206 | 207 | chmod 755 /system/app/SoundRecorder 208 | chmod 644 /system/app/SoundRecorder/* 209 | ``` 210 | 211 | Finally, make the device restart and install the new packages by typing `reboot`. 212 | 213 | After reboot, you should see new apps in the menu: _Calculator_, _Calendar_, _Music_, _File Explorer_. 214 | 215 | Since you've installed `com.android.providers.downloads.ui`, `com.android.documentsui` 216 | and `com.android.browser.provider`, you should now be able to save 217 | files locally in various applications, ie. music and videos, and play them later 218 | even if there is no wifi connection. 219 | 220 | ## Install Lucid Browser 221 | 222 | Web browser will be handy. [Lucid Browser](https://f-droid.org/packages/com.powerpoint45.lucidbrowser/) 223 | is fast, and works with minimal amount of dependencies. The video playback 224 | functionality works properly, so you can use any video services through it 225 | when _NewPipe_ isn't enough. Available in _F-Droid_ store. 226 | 227 | ## Install commonly used apps 228 | 229 | Some apps have a button which opens e-mail or calendar. Even if you don't need 230 | these functionalities, you probably do not want such apps to crash. So, install 231 | such apps from the store. 232 | 233 | For example, [SimpleEmail](https://f-droid.org/packages/org.dystopia.email/) 234 | fills the post for e-mail app quite well. 235 | 236 | Also, you will probably want a video player - [NewPipe](https://f-droid.org/packages/org.schabi.newpipe/). 237 | While not a dependency for other software, it is nice to have for this kind of device. 238 | 239 | # Additional notes 240 | 241 | ## Missing GUI elements 242 | 243 | The _statusbar_ at top and the _navbar_ at bottom (collectively known as _systembar_) 244 | are deactivated. We don't really know where these were disabled - there surely 245 | is a way to re-enable, but it isn't known. Replacing _SystemUI_ with stock one 246 | doesn't bring the bars back. So maybe it's disabled in _Framework_? Or maybe 247 | there is a `build.prop` property to enable these? More experiments needed. 248 | 249 | ## Missing Action handlers 250 | 251 | The Android build used was severly cut down. It is missing several provider 252 | packages, and other commonly used parts of Android. Some of these can be easily 253 | re-added (see [Supplemental Android improvements](#supplemental-android-improvements). 254 | Others are harder, and still require figuring out. If you see a _Java_ crash 255 | dump starting with: 256 | 257 | ``` 258 | android.content.ActivityNotFoundException: No activity found to handle Intent { ... } 259 | ``` 260 | 261 | then the issue is just that - lack of handlers. For what action the handler is missing, 262 | that is explained within curly braces of the message above. 263 | 264 | ## Installing Play Store and microG 265 | 266 | Currently there is a way to install microG in this device, but Play Store isn´t working correctly. It´s opening, but sometimes it shows an Server Error. 267 | After installing F-Droid, add https://microg.org/fdroid/repo to the package repositories of F-Droid. 268 | Run a Package-Source update and install the following apps: 269 | ``` 270 | unifiedNlp 271 | microG Service Core 272 | ``` 273 | after installation, reboot. 274 | Download APK from ApkMirror and install as system app 275 | (PlayStore)[https://www.apkmirror.com/apk/google-inc/google-play-store/google-play-store-26-6-12-release/google-play-store-26-6-12-21-0-pr-389229320-2-android-apk-download/] 276 | Download APK and install as normal app 277 | (GSF)[https://www.apkmirror.com/apk/google-inc/google-services-framework/google-services-framework-5-1-1743759-release/google-services-framework-5-1-1743759-android-apk-download/] 278 | 279 | Now open the Play Store and log in. 280 | Then uninstall the google services framework and you'll get an working play store with microG. 281 | 282 | 283 | 284 | 285 | ## Custom recovery 286 | 287 | For popular Android devices, there is a _custom recovery_ available. It is a 288 | replacement for a recovery partition, which can be activated by starting the 289 | device with specific buttons combination pressed. For example, [TWRP](https://twrp.me/) 290 | is one of such recoveries. 291 | 292 | _Custom recovery_ allows installing many hacks created by the community. 293 | For example, there are packages to tweak Android UI, or enable _signature 294 | spoofing_ required for adding google services, or rooting (though you do not 295 | need rooting on _Tigerbox_, it just gives you full access). 296 | 297 | We haven't heared any reports of successful _TWRP_ installations on _Tigerbox_. 298 | You can be the first. 299 | 300 | ## Starting software via ADB 301 | 302 | In case you accidentally revert to original launcher, or for various other 303 | reasons, you may sometimes want to start an app without using the screen. 304 | 305 | To start an app, first get a list of your available packages, then run it 306 | (replace ``) 307 | 308 | ``` 309 | adb shell pm list packages 310 | adb shell monkey -p '' -v 500 311 | ``` 312 | 313 | ## Finding issues with installation of system packages 314 | 315 | If you want to add even more system-maintained packages, or for some reason there is 316 | an issue with adding the ones from [Supplemental Android improvements](#supplemental-android-improvements) 317 | chapter, you may want to look at logs which may shed light on what is wrong. 318 | 319 | If you are installing a package which doesn't add icon to the Launcher (ie. it's a 320 | Provider package), and you want to make sure it got installed, you should check: 321 | 322 | 323 | ``` 324 | adb shell dumpsys package 325 | ``` 326 | 327 | If the name of your package appears anywhere above `Package warning messages:` 328 | in that log, then it was successfully installed and it provides some functionality. 329 | 330 | And if it only appears in the `Package warning messages:`, then the warning might 331 | tell you what exactly is a problem with installation. 332 | 333 | ## Finding issues with crashing app 334 | 335 | If any app or service is crashing, the information shown in GUI is not very 336 | informative, and often deceptive (ie. it often says _Android Core_ crashed, 337 | even though the issue is with specific application, not with the _Android Core_. 338 | 339 | To get more descriptive error message, run: 340 | 341 | ``` 342 | adb shell logcat 343 | ``` 344 | 345 | After the crash happens, break the command (ctrl+c), and look at the messages 346 | finding errors. 347 | 348 | ## Use scrcpy as remote control 349 | 350 | The tool [scrcpy](https://github.com/Genymobile/scrcpy) makes remote controlling the 351 | device very convient. Just connect your device via ADB and start _scrcpy_. 352 | 353 | ## Working Software 354 | 355 | * [F-Droid](https://f-droid.org/F-Droid.apk) - F-Droid - Store 356 | * [Aurora Store](https://f-droid.org/packages/com.aurora.store/) - F-Droid - Play Store 357 | * [OpenLauncher](http://f-droid.org/packages/com.benny.openlauncher/) - F-Droid - Launcher 358 | * [NewPipe](https://f-droid.org/packages/org.schabi.newpipe/) - F-Droid - YouTube GUI 359 | * [VirtualSoftKeys](https://f-droid.org/packages/tw.com.daxia.virtualsoftkeys/) - F-Droid - Hardware button replacement 360 | 361 | ## Non-Working Software 362 | 363 | * YouTube - Aurora Store - Crashes because of no Google Services 364 | * Spotify - Aurora Store - Just crashes 365 | -------------------------------------------------------------------------------- /wiki/Open-the-tigerbox.md: -------------------------------------------------------------------------------- 1 | # Top 2 | ![](https://github.com/tigerbox-reverse-engineering/tigerbox/raw/master/pics/OpenTop.jpg) 3 | Gently push something between the wood and mesh at the top. Then leverage it up. Beware the cables! 4 | From here you gain access to everything beside the reset button, usb-c connector, bottom leds and the headphone output. 5 | # Bottom 6 | ![](https://github.com/tigerbox-reverse-engineering/tigerbox/raw/master/pics/OpenBottom.jpg) 7 | You will have to remove the bottom rubber stand which is glued onto the bottom. The you can unscrew the bottom. -------------------------------------------------------------------------------- /wiki/UART-ADB-Root.md: -------------------------------------------------------------------------------- 1 | # UART - Console 2 | 3 | ## Hardware Preparation 4 | 5 | ![](https://github.com/tigerbox-reverse-engineering/tigerbox/raw/master/pics/Backside-UART.jpg) 6 | 7 | Just connect your favorite 3.3V UART Interface to the marked test pads on the back. Reverse TX/RX and use the grey marked test pad as GND. 8 | 9 | * Voltage: 3.3V 10 | * Baudrate: 115200 Baud 11 | * Parity: None 12 | * Flow control: XON/XOFF 13 | 14 | ## Serial Console - Root / SU 15 | 16 | Feel free here. Just type `su` and gain root. Done... 17 | 18 | ## FIQ Debugger 19 | 20 | It may be possible to get into the FIQ debugger while booting and sending something in the right moment. 21 | 22 | # ADB 23 | 24 | ## via WiFi 25 | 26 | ### Preparation - UART 27 | You will need to enable WiFi ADB via UART. This pr 28 | ``` 29 | setprop service.adb.tcp.port 5555 30 | stop adbd 31 | start adbd 32 | ``` 33 | ### ADB Connection 34 | ``` 35 | adb connect :5555 36 | ``` 37 | 38 | ## via USB 39 | 40 | To enable ADB over USB, you need to make the following lines go into `/system/build.prop`: 41 | ``` 42 | persist.service.adb.enable=1 43 | persist.service.debuggable=1 44 | persist.sys.usb.config=mtp,adb 45 | ``` 46 | Stock image has this configuration instead: 47 | ``` 48 | persist.sys.usb.config=charging 49 | ``` 50 | 51 | So it's as easy as modifying one line and additng two new ones to one file? Yes. 52 | Though it's not always easy, tigerbox doesn't protect your device from you. 53 | 54 | First, check if the partition is mounted to `/system` with write enabled. 55 | To do that, execute `mount` to list all mount points, and find the line for 56 | that partition. Make sure it's marked as read-write by `rw` attrib, ie: 57 | ``` 58 | /dev/block/platform/1021c000.rksdmmc/by-name/system /system ext4 rw,seclabel,noatime,nodiratime,noauto_da_alloc,data=ordered 0 0 59 | ``` 60 | If you see `ro` instead, remount the partition. 61 | 62 | Then, check which properties are set in your `build.prop`. On a stock image, I got: 63 | ``` 64 | shell@rk312x:/ $ cat /system/build.prop | grep persist 65 | persist.tegra.nvmmlite = 1 66 | persist.sys.caration.standby=60000 67 | persist.sys.caration.antiaddic=false 68 | persist.sys.timezone=Europe/Amsterdam 69 | persist.sys.boot.check=false 70 | persist.sys.strictmode.visual=false 71 | persist.sys.usb.config=charging 72 | persist.sys.dalvik.vm.lib.2=libart.so 73 | ``` 74 | Now we need a text editor. The Android image has `busybox`, so we can use the utilities inside. 75 | One option is visual editing with `vi`, my preference is command line editing with `sed`: 76 | ``` 77 | su 78 | busybox sed -i 's/^\(persist[.]sys[.]usb[.]config\)=.*$/\1=mtp,adb/' /system/build.prop 79 | busybox sed -i '/^persist[.]sys[.]usb[.]config=.*$/a persist.service.debuggable=1' /system/build.prop 80 | busybox sed -i '/^persist[.]sys[.]usb[.]config=.*$/a persist.service.adb.enable=1' /system/build.prop 81 | ``` 82 | After you reboot the device, it will report as adb device and media device. 83 | Note: if you damage `build.prop`, fixing it might be tricky. Be careful. 84 | 85 | You will have to make sure the specific USB identifier (Vendor ID and Product ID) 86 | is treated as "Composite ADB Interface" on your PC. If using Windows, either modify 87 | ADB driver from Google so that it recognizes your device, or force install the 88 | Google ADB driver on unrecognized "ADB Device" in "Device Manager". 89 | 90 | ## via WIFI 91 | May be possible with 92 | https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-13208 93 | 94 | 95 | # via USB Android Recovery without opening 96 | 97 | ## Currently only works on Linux or Windows Subsystem for Linux 2 with adb installed. 98 | 99 | Use a Paperclip to press it in the RESET hole right from the USB Connector. While doing this press the on/off button to boot in Android Recovery. Use `adb root` and `adb pull /dev/block/mmcblk0p12 /patch/to/file`. And mount over `sudo mount -t ext4 /patch/to/file/mmcblk0p12 /mount/patch/` `nano /mount/patch/build.prop` and add 100 | ``` 101 | persist.service.adb.enable=1 102 | persist.service.debuggable=1 103 | ``` 104 | 105 | and change `persist.sys.usb.config=charging` to `persist.sys.usb.config=mtp,adb` 106 | 107 | then `sudo umount /mount/patch/` and `adb push /patch/to/file/mmcblk0p12 /dev/block/mmcblk0p12` and `adb reboot` 108 | -------------------------------------------------------------------------------- /wiki/_Footer.md: -------------------------------------------------------------------------------- 1 | Attention, do not edit the wiki directly. It is generated automatically from the master branch! 2 | --------------------------------------------------------------------------------