Use a small "philips" screwdriver to remove all 5 screws from the backside.
3 screws are located at the (F4) markings.
Two screws are hidden beneath the two rear rubber feets at the (F6) markings.
Behind the battery you will find two small metallic screws, remove them.
It are now possible to lift up the keyboard, the keyboard easily gets stuck at the blue markings, use the guitar plectrum to set it free.
The keyboard module are then only connected by the flexible PCB that sticks into a foxcon connector, the flexible PCB are secured by two latches on the connector marked with green, pull the latches at the connectors ends towards the touchpad of the AC100 to free the PCB and fully remove the keyboard module.
Remove all screws marked red. Pull the three connectors marked blue using the black straps, they are not secured use mild force to separate them, these connector are quite stiff so it are not a problem to reinsert them by simply pushing them into place when you want to assemble the AC100 again. Now use the guitar plectrum once again to bend the case open and remove the plastic top containing the power-button, touch-pad and LEDs.
I got curious why the powerbutton got four wires so i dissected it a bit more more.
Pealing off some black tape revealed some numbers and circuit board traces.
To my disappointment i only found one transistor some resistors and one push button, what i was really hoping for was a hidden factory usb flashmode button similar to what are found on the Tegra 250 devkits.
It turned out that by holding down ESC+CTRL during poweron actually activates this usb flashmode. It can be used to repair a bricked ac100. When starting the ac100 in recovery mode then the screen will stay all black during power on and the power led gets lit up. You can then use the nvflash tool to manipulate the on board eMMC chip. http://tosh-ac100.wetpaint.com/page/Backup+and+Restore
/dev/ec_odm are implemented by a proprietary Toshiba kernel driver with no available source-code how it operates. It are used to enable several hardware features of the AC100:
There is a tool in /system/bin/uoc that know how to talk to this proprietary kernel driver. http://tosh-ac100.wetpaint.com/page/ec_odm
The system "dmesg" log reveals that a serial console have been activated on ttyS0. Where are this serial port physically located?
There are a tiny tiny connector on the mainboard without a header (JP1) http://wiki.gudinna.com/gudinna/uploads/768/11a.1.CIMG0230.JPG near the left speaker connector that might contain a serial console.
This model AC100-10D are equipped with WiFi wireless networking and Bluetooth, but as can be seen in the pictures both mini PCI-e slots are empty. ... and where is the WiFi/Bluetooth antenna cable? When checking the androids system "dmesg" log i can see that the WiFi and Bluetooth are connected to the USB bus and this means I have to disassemble the screen as well in my search for these missing wireless units.
The Toshiba AC100 are vulnerable to the
RageAgainstTheCage exploit
made by the 743C project.
~/android-sdk-linux_x86/tools$ ./adb kill-server ; sudo ./adb start-server ; ./adb shell
$ ./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3584, 3584}
[*] Searching for adb ...
[+] Found adb as PID 18795
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
~/android-sdk-linux_x86/tools$ ./adb kill-server ; sudo ./adb start-server ; ./adb shell
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
#
# busybox mount -o remount,rw /system
# busybox whoami
whoami: unknown uid 0
Debian on ac100 install instructions (translated to english from french)
