Gudinna Wiki VisaÄndraBifogaVersionerUppdateratSökKarta

Inside Toshiba AC100-10D (scandinavian model)

NEWS?

http://forums.computers.toshiba-europe.com/forums/thread.jspa?messageID=218193 - root access gained and usb flash recovery mode found... cool!

http://ac100.gudinna.com/README - Ubuntu 10.10 install for Toshiba AC100
Ångstrom minimal rootfs on Toshiba AC100
@Debian on ac100 install instructions (translated to english from french)

http://www.funclang.net/cruel/ - Notes that the GPL sourcecode have been released on CD. Contains a lot of hits on how to setup your own ubuntu system from scratch. @- translated to english

How to get inside?

Tools of the trade.
Uploaded Image: 1.CIMG0243.JPG

First power the unit down and remove the battery.

Use a small "philips" screwdriver to remove all 5 screws from the backside.
3 screws are located at the (F4) markings.
Two screws are hidden beneath the two rear rubber feets at the (F6) markings.
Uploaded Image: 2.CIMG0242.JPG

Behind the battery you will find two small metallic screws, remove them.
Uploaded Image: 3.CIMG0241.JPG

It are now possible to lift up the keyboard, the keyboard easily gets stuck at the blue markings, use the guitar plectrum to set it free.

The keyboard module are then only connected by the flexible PCB that sticks into a foxcon connector, the flexible PCB are secured by two latches on the connector marked with green, pull the latches at the connectors ends towards the touchpad of the AC100 to free the PCB and fully remove the keyboard module.
Uploaded Image: 4.CIMG0240.JPG

Remove all screws marked red. Pull the three connectors marked blue using the black straps, they are not secured use mild force to separate them, these connector are quite stiff so it are not a problem to reinsert them by simply pushing them into place when you want to assemble the AC100 again. Now use the guitar plectrum once again to bend the case open and remove the plastic top containing the power-button, touch-pad and LEDs.
Uploaded Image: 5.CIMG0238.JPG

Inside!
Uploaded Image: 10.CIMG0226.JPG

Uploaded Image: 11a.CIMG0230.JPG

Uploaded Image: 11b.CIMG0231.JPG

List of components on the AC100 mainboard.

http://www.funclang.net/cruel/?p=128
http://ddevnet.net/wiki/index.php/AC100_IC_List

The Powerbutton

I got curious why the powerbutton got four wires so i dissected it a bit more more.
Uploaded Image: 8.CIMG0236.JPG

Pealing off some black tape revealed some numbers and circuit board traces.
Uploaded Image: 9.CIMG0237.JPG

To my disappointment i only found one transistor some resistors and one push button, what i was really hoping for was a hidden factory usb flashmode button similar to what are found on the Tegra 250 devkits.

It turned out that by holding down ESC+CTRL during poweron actually activates this usb flashmode. It can be used to repair a bricked ac100. When starting the ac100 in recovery mode then the screen will stay all black during power on and the power led gets lit up. You can then use the nvflash tool to manipulate the on board eMMC chip.
http://tosh-ac100.wetpaint.com/page/Backup+and+Restore

http://forums.computers.toshiba-europe.com/forums/thread.jspa?threadID=56355&start=15&tstart=0
http://forums.computers.toshiba-europe.com/forums/thread.jspa?threadID=56355&start=30&tstart=0

The powerbutton hardware can be disabled/enabled in software by sending commands to /dev/ec_odm
http://tosh-ac100.wetpaint.com/page/ec_odm

Hardware/Software mysteries to be solved

/dev/ec_odm are implemented by a proprietary Toshiba kernel driver with no available source-code how it operates. It are used to enable several hardware features of the AC100:
There is a tool in /system/bin/uoc that know how to talk to this proprietary kernel driver.
http://tosh-ac100.wetpaint.com/page/ec_odm

The system "dmesg" log reveals that a serial console have been activated on ttyS0. Where are this serial port physically located?
There are a tiny tiny connector on the mainboard without a header (JP1) http://wiki.gudinna.com/gudinna/uploads/768/11a.1.CIMG0230.JPG near the left speaker connector that might contain a serial console.

This model AC100-10D are equipped with WiFi wireless networking and Bluetooth, but as can be seen in the pictures both mini PCI-e slots are empty. ... and where is the WiFi/Bluetooth antenna cable? When checking the androids system "dmesg" log i can see that the WiFi and Bluetooth are connected to the USB bus and this means I have to disassemble the screen as well in my search for these missing wireless units.

Install Ubuntu

http://ac100.gudinna.com/

Nicely done!

Other disassembly ac100 hacking efforts


@Some hints on how to setup the RageAgainstTheCage exploit

http://developer.nvidia.com/tegra/forum/toshiba-ac100dynabook
http://www.blogarm.net/linux-et-le-toshiba-ac-100-a-quoi-faut-il-sattendre/
http://ubuntu.se/showthread.php/12141-Installera-Ubuntu-p%C3%A5-Toshiba-AC100-%28Android%29
http://www.listware.net/201008/debian-arm/115285-debian-on-toshiba-ac100-tegra-250.html
http://groups.google.com/a/chromium.org/group/chromium-os-discuss/browse_thread/thread/c297281902351b2e
http://forums.debian.net/viewtopic.php?f=7&t=55435

http://tosh-ac100.wetpaint.com/ - all about hacking the ac100


http://forums.computers.toshiba-europe.com/forums/thread.jspa?messageID=218193 - su root access gained and all other cool action happens here!

How to get root?

The Toshiba AC100 are vulnerable to the
RageAgainstTheCage exploit
made by the 743C project.

~/android-sdk-linux_x86/tools$ ./adb kill-server ; sudo ./adb start-server ; ./adb shell
$ ./rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C

[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3584, 3584}
[*] Searching for adb ...
[+] Found adb as PID 18795
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
~/android-sdk-linux_x86/tools$ ./adb kill-server ; sudo ./adb start-server ; ./adb shell
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
#
# busybox mount -o remount,rw /system
# busybox whoami
whoami: unknown uid 0


http://c-skills.blogspot.com/2010/08/please-hold-line.html
Sources to the RageAgainstTheCage exploit
made by the 743C project.
Thanks!

http://tosh-ac100.wetpaint.com/page/Rooting - more detailed how to get root on the ac100 instructions.

Chat with Toshiba AC100 hackers

/join #ac100 on irc.freenode.net!

untested stuff

http://freevec.org/repository/images/ -debian hardfoat port preinstalled root filesystem.

Referenser till aktuell sida


Frivillig gåva till stöd för driften av Gudinna Wiki :