So I came into possession of a commercial grade advertising kiosk (Nintendo Amiibo Display) that runs an Android OS 4.1.1. The device is setup to auto load the "AmiiboFrameWork.apk" package installed. The model of the system is DucoTech D185-ACA-720. I can access basic Android settings menus through a special key combination. Mainly system information, network setup, and volume controls. There is a menu that says App Install and gives the option of installing APKs from SD card or USB with a file structure of USB:\APKFiles\ or SD Card:\ApkFiles\. However no matter how I layout my file structure or name my APKs following that structure nothing appears in this menu to install. However There is a media tab for photos with a similar structure and photos I put on the card do show up. What I'm trying to figure out is how either install APKs, or access the base android system so I can customize the system to run custom apps I plan on making for it. However I want to retain the original AmiiboFrameWork APK or the whole OS so I can restore the system later if I want.
Now what I have tried is plugging it into my PC via the USB-OTG port while on, putting APKs in various file structures and naming conventions, booting it with my PC connected via OTG port, tried to trick my way into other menus through keyboard and settings menu tricks (similar to how people use to bypass lock screen security through menus).
Results:
1. OTG to PC while on: Device shows up as 2 USB 2.0 Flash drives in device manager. The drives appear in my computer but aren't accessible. ADB doesn't see it as an android device.
2. APKs on usb: Nothing shows up in the menu regardless of my naming convention or file structure.
3. Boot device while attached to PC via OTG port: My computer detects it as an NES Classic (previously installed the driver to mod my classic). This leads me to think its an Allwinner device or similar since that is what the driver was made for I believe? ADB still doesn't see it. This might be my best bet to get in.
4. Menus: Options are very limited and I wasn't able to access anything valuable aside from Install APK, Transfer Media, and Set startup APK.
5. Tapping build number: Tapping the build number in settings any number of times doesn't activate the developer mode options. The prompt doesn't even appear for it.
If anyone can assist in trying to gain access to this system, or even figure out the file structure so I can just install my own APKs like I want that would be great. Any ideas on where to look, what to try, and so on is greatly appreciated.
Here are some photos of the main board just in case
Any new updates to this? I made the mistake of uninstalling the Amiibo Framework APK so now all I can do is see the settings menu with no ability to install any APKS. Copying media files over does work though.
hedburnr said:
Any new updates to this? I made the mistake of uninstalling the Amiibo Framework APK so now all I can do is see the settings menu with no ability to install any APKS. Copying media files over does work though.
Click to expand...
Click to collapse
IDK what to say man other than what in God's name made u think framework.res needed to be pulled. It's gone man barring the original firmware and itself install method
hedburnr said:
Any new updates to this? I made the mistake of uninstalling the Amiibo Framework APK so now all I can do is see the settings menu with no ability to install any APKS. Copying media files over does work though.
Click to expand...
Click to collapse
I work with Ducos! In fact there's an Amiibo kiosk a few feet from me here in our offices
mojoswagger1980 said:
IDK what to say man other than what in God's name made u think framework.res needed to be pulled. It's gone man barring the original firmware and itself install method
Click to expand...
Click to collapse
AmiiboFramework doesn't have anything to do with the "framework.res", Nintendo just called the app the "AmiiboFramework"
They only install APKs with a specific package name in a specific folder on your USB device / SD Card (com.general.mediaplayer.player). Unfortunately Nintendo used a different folder than us, and I don't recall what it was. You can go into a "normal" Android screen using a special procedure if the AmiiboFramework app is installed, but it should work without it too:
- Wait for the Loading screen to appear
- Begin to press the CSR and Setup buttons together, quickly alternating between them. Repeat until the CSR appears
- After the CSR appears, leaving the screen open for an extended period of time will cause the Amiibo Display Framework to re-appear
- If Alt+Tab is used, be sure to return to the CSR before returning to any other app, or the CSR will reboot the player
Alt+Tab refers to using a USB keyboard, after you have the CSR up you can exit with it.
They're really not great hardware for general usage.
selaliadobor said:
I work with Ducos! In fact there's an Amiibo kiosk a few feet from me here in our offices
AmiiboFramework doesn't have anything to do with the "framework.res", Nintendo just called the app the "AmiiboFramework"
They only install APKs with a specific package name in a specific folder on your USB device / SD Card (com.general.mediaplayer.player). Unfortunately Nintendo used a different folder than us, and I don't recall what it was. You can go into a "normal" Android screen using a special procedure if the AmiiboFramework app is installed, but it should work without it too:
- Wait for the Loading screen to appear
- Begin to press the CSR and Setup buttons together, quickly alternating between them. Repeat until the CSR appears
- After the CSR appears, leaving the screen open for an extended period of time will cause the Amiibo Display Framework to re-appear
- If Alt+Tab is used, be sure to return to the CSR before returning to any other app, or the CSR will reboot the player
Alt+Tab refers to using a USB keyboard, after you have the CSR up you can exit with it.
They're really not great hardware for general usage.
Click to expand...
Click to collapse
Ohh, I tried to call and they wouldn't answer any of my questions lol. Is it possible to get any documentation on it? I'm sure Nintendo did their own setup, but having original documentation is a good step forward for what we have now. I'd love to setup my own configuration on it even if the hardware is meh.
Enmity said:
Ohh, I tried to call and they wouldn't answer any of my questions lol. Is it possible to get any documentation on it? I'm sure Nintendo did their own setup, but having original documentation is a good step forward for what we have now. I'd love to setup my own configuration on it even if the hardware is meh.
Click to expand...
Click to collapse
There isn't much more documentation than what I mentioned unfortunately. The people who you'd get in a call definitely don't know anything about them (I don't think Nintendo made the AmiiboFramework app in-house either). If you want to repurpose it, you can try getting into the CSR and going into the normal Android Launcher. Try connecting over ADB and force-stopping any process with the letters "csr" in it's name
---------- Post added at 11:44 AM ---------- Previous post was at 11:40 AM ----------
Enmity said:
Ohh, I tried to call and they wouldn't answer any of my questions lol. Is it possible to get any documentation on it? I'm sure Nintendo did their own setup, but having original documentation is a good step forward for what we have now. I'd love to setup my own configuration on it even if the hardware is meh.
Click to expand...
Click to collapse
There isn't much more documentation than what I mentioned unfortunately. The people who you'd get in a call definitely don't know anything about them (I don't think Nintendo made the AmiiboFramework app in-house either). If you want to repurpose it, you can try getting into the CSR and going into the normal Android Launcher. Try connecting over ADB and force-stopping any process with the letters "csr" in it's name
To connect to ADB use a USB mini cable on the "USB OTG" port and ClockworkMod's Universal ADB Driver
I have a few devices similar to this. They are duco DT156-AS4-1080. I was wanting to repurpose them as video players. The devices are wiped of content and load into a main menu. There is an option to exit to administrator, though it asks for a password. I dumped the partitions and tried to look through the binaries, but am unable to come up with anything. I can get into superSU and then exit to playstore, but then some type of watchdog kicks me back to the duco menu. Any help appreciated.
er0ck said:
I have a few devices similar to this. They are duco DT156-AS4-1080. I was wanting to repurpose them as video players. The devices are wiped of content and load into a main menu. There is an option to exit to administrator, though it asks for a password. I dumped the partitions and tried to look through the binaries, but am unable to come up with anything. I can get into superSU and then exit to playstore, but then some type of watchdog kicks me back to the duco menu. Any help appreciated.
Click to expand...
Click to collapse
Just uninstall com.general.mediaplayer.* (anything that starts with that package name) and you should have a normal device
I DID IT! Working tablet
So the story is yesterday I found an Amiibo display at my apartment dumpster where people put stuff they don't want that still works, I nabbed it with the intention of salvaging the "monitor." Judging by the hammer-marks on the acrylic enclosure, and pry marks on the metal cage that held the power supplies for the led strips and the tablet I assume somebody took it home, got frustrated by the locks and screws after some prying, and just busted in the acrylic window to get to the floor model Amiibos.
I cracked it open, and after some fun with a butane torch to melt the acrylic around the screws open (damn security hex) was surprised to find that the "monitor" had a usb dongle plugged into it. I plugged it into my station and found it was a 2.4/5 GHZ wifi dongle.
All code here is from Windows power shell since I don't like to dual boot my main gaming rig. Usually I just use the Bash on Ubuntu on Windows developer option for stuff like this, but I didn't know if the fact I was using Windows usb drivers to connect to this would cause problems and I wanted one fewer step to troubleshoot if I had issues. Forgive me penguin for I have sinned.
I found the item number on the back of it and after some googling found it was an android device. Score!
I plugged the tablet in and it went into an Amiibo advertisement kiosk mode.
After about 8 hours I now have a limited (but functional!) giant Android tablet.
To any future adventurers I am making a guide to get you up and running quickly.
I followed selaliadobor's instructions:
To connect to ADB use a USB mini cable on the "USB OTG" port and ClockworkMod's Universal ADB Driver
Click to expand...
Click to collapse
As well as pressing CSR and Setup to get into the settings screen. This was interesting, but ultimately didn't do much. However using
Code:
./adb shell logcat >> log.txt
and waiting for it to reboot from the csr menu led me to find (with some help from my engineer father) that /system/app/CSR_A003_20160304_BT.apk was the culprit of the restarts.
This was solved with
Code:
./adb shell rm /system/app/CSR_A003_20160304_BT.apk
From there I was stuck. But then I discovered: THE CSR SETTINGS MENU IS NOT THE REAL ANDROID SETTINGS MENU. To get to the real android settings menu use this:
Code:
./adb shell am start -a android.settings.SETTINGS
This allows you to do a factory reset!
However when it reboots the default launcher is stripped of important features like back/home/running apps, keyboard, a launcher etc. I sideloaded the following apps:
Chrome Browser
Microsoft Arrow Launcher (I originally used Nova but it was too much a ram hog to be useful)
Multiling Keyboard (I originally used Swiftkey, but it too was taking up too much ram)
WebTube (stripped down youTube frontend)
Soft Keys (so I had a home and back button, the running apps button still doesn't work :'( )
First post so no links ;(
imgur .com/dGAOmoM
This is what it looks like after boot. I may also have an affinity for Amiibos.
imgur .com/uQ8u7js
Classic.
Quick note: This device doesn't support google play services, so no hulu, official youtube, netflix unfortunately. Try as I might I haven't found a solution.
i bought a box of these units a while back from the carboot and wanted to use them in our coffee shop were opening, i too didnt have much luck with them then i saw this thread, i know abit about computers but never messed with android, we basically wanted to use them for what they are used for now for displaying changing menus and advertising etc, i downloaded the clockworkmods adb, now how to enter the "./adb shell logcat >> log.txt" etc, presumably i just connect the otg port to the pc (win10) run the clockworkmod program then i use commandpromt? i did try it but i couldnt get it to work, do i have to put the android device into a mode like csr? any help would be appreciated?
N/A
Additional help needed
i got to the settings menu but it is only temporary i am wanting it to be like a regular tablet where can i get a rom to do that? to flash it so it will function like a galaxy tab 3 or so, as i would love to use my DT101-ASA-800 like a normal tablet with a keyboard and mouse. any help would be welcomed. as the factory reset doesn't let it work any different it keeps going straight to CSR settings.
so stuck... my head hurts
so i can not get my Model DT185-ACA-720 to connect to my pc..... ok it connects and a K: and F: drive appear but I cant access them. I managed to get .apk files to show up and transfer to the 12gb storage on the tablet but i cant access the storage on the tablet... im so lost... I downloaded the universal driver and ADB but both changed nothing... If anyone has any advice or updates im all ears since I basically destroyed the Kiosk to get this tablet free
jaybanc said:
i bought a box of these units a while back from the carboot and wanted to use them in our coffee shop were opening, i too didnt have much luck with them then i saw this thread, i know abit about computers but never messed with android, we basically wanted to use them for what they are used for now for displaying changing menus and advertising etc, i downloaded the clockworkmods adb, now how to enter the "./adb shell logcat >> log.txt" etc, presumably i just connect the otg port to the pc (win10) run the clockworkmod program then i use commandpromt? i did try it but i couldnt get it to work, do i have to put the android device into a mode like csr? any help would be appreciated?
Click to expand...
Click to collapse
Same issue here with the DT133-AC4-900 that I managed to pull out of a trashed google nest display from where I work. I managed to get the device to always load to the DUCO app by uninstalling the mediaplayer throught the DUCO app. However that is as far as I can get as the device will not communicate with ADB at all. Not sure if it's a win10 thing or if it's the device itself.
TheArcticGentoo said:
I DID IT! Working tablet
So the story is yesterday I found an Amiibo display at my apartment dumpster where people put stuff they don't want that still works, I nabbed it with the intention of salvaging the "monitor." Judging by the hammer-marks on the acrylic enclosure, and pry marks on the metal cage that held the power supplies for the led strips and the tablet I assume somebody took it home, got frustrated by the locks and screws after some prying, and just busted in the acrylic window to get to the floor model Amiibos.
I cracked it open, and after some fun with a butane torch to melt the acrylic around the screws open (damn security hex) was surprised to find that the "monitor" had a usb dongle plugged into it. I plugged it into my station and found it was a 2.4/5 GHZ wifi dongle.
All code here is from Windows power shell since I don't like to dual boot my main gaming rig. Usually I just use the Bash on Ubuntu on Windows developer option for stuff like this, but I didn't know if the fact I was using Windows usb drivers to connect to this would cause problems and I wanted one fewer step to troubleshoot if I had issues. Forgive me penguin for I have sinned.
I found the item number on the back of it and after some googling found it was an android device. Score!
I plugged the tablet in and it went into an Amiibo advertisement kiosk mode.
After about 8 hours I now have a limited (but functional!) giant Android tablet.
To any future adventurers I am making a guide to get you up and running quickly.
I followed selaliadobor's instructions:
As well as pressing CSR and Setup to get into the settings screen. This was interesting, but ultimately didn't do much. However using
Code:
./adb shell logcat >> log.txt
and waiting for it to reboot from the csr menu led me to find (with some help from my engineer father) that /system/app/CSR_A003_20160304_BT.apk was the culprit of the restarts.
This was solved with
Code:
./adb shell rm /system/app/CSR_A003_20160304_BT.apk
From there I was stuck. But then I discovered: THE CSR SETTINGS MENU IS NOT THE REAL ANDROID SETTINGS MENU. To get to the real android settings menu use this:
Code:
./adb shell am start -a android.settings.SETTINGS
This allows you to do a factory reset!
However when it reboots the default launcher is stripped of important features like back/home/running apps, keyboard, a launcher etc. I sideloaded the following apps:
Chrome Browser
Microsoft Arrow Launcher (I originally used Nova but it was too much a ram hog to be useful)
Multiling Keyboard (I originally used Swiftkey, but it too was taking up too much ram)
WebTube (stripped down youTube frontend)
Soft Keys (so I had a home and back button, the running apps button still doesn't work :'( )
First post so no links ;(
imgur .com/dGAOmoM
This is what it looks like after boot. I may also have an affinity for Amiibos.
imgur .com/uQ8u7js
Classic.
Quick note: This device doesn't support google play services, so no hulu, official youtube, netflix unfortunately. Try as I might I haven't found a solution.
Click to expand...
Click to collapse
This worked, but I couldn't get ADB to work in Windows, I had to go grab my laptop running Deepin Linux and set up ADB on that, but no USB drivers are needed in Linux, so once I set up ADB, it just worked. So I'm hoping that might be the solution for others who are having trouble, just use Linux, it just works. ADB works on the CSR level, so no need for security key. Got CPU-Z on there for any curious about the hardware specs, my model is a DT101-ASA-800
Related
I recently purchased a Nordic Track 9500 Elite Pro. This bad boy has a 10" android tablet built in. They really don't want you messing with the android part much, but I am sure there are plenty of other users out there like me that want to do more!
This is my first post so I am unable to show the pictures via the link. Hopefully you can copy and past the text to view the images. I will try to repost on my website so it all flows.
I don't see where a post like this would go, I am not sure if at some point it would gain it's own device forum... That would be exciting. So for now I will post here. I will also post my initial findings for others in the community that may want to purchase this treadmill and can't find any information regarding the built in Android Tablet with WiFi.
This image shows the version information. From what I can tell it looks like they purchase an APAD from someone and then stick it inside of their device. They also must have wrote some special drivers and software to interface with the equipment and hardware. I was very happy to see a mainstream current android OS.
Android OS 2.2
hungrykzoo.com/wp-content/uploads/2011/01/IMAG0027.jpg
Click to expand...
Click to collapse
Here are the pre-installed apps. Pretty basic. (note: I was able to find an APK and install Last.FM that wasn't included) Also a major bummer to see was that there wasn't a market application.
hungrykzoo.com/wp-content/uploads/2011/01/IMAG0026.jpg
Click to expand...
Click to collapse
This is the typical workout screen you see.
hungrykzoo.com/wp-content/uploads/2011/01/IMAG0024.jpg
Click to expand...
Click to collapse
I also noticed that the device doesn't have very much memory. This could be due to the built in applications taking up so much space. It only had about 57MB of internal memory free, but it had a built in 2GB SD Card. I have not gotten to the point where I have needed to take it apart yet to see if there is a replaceable SD card. I may wait another 5 years for my warranty to end to do that.
I have tried to install some apps but have not had very much luck. The only app that was I was able to install was the Last.FM.
I tried the follow apps, and they didn't install:
1. Market
2. Angry Birds
3. Pandora
Other disappointments:
1. Designed to not be in the Android Interface. They have an application that runs, and makes it tricky to get to the android desktop. It takes about 3 clicks to get from the main workout screen back to the Android Desktop.
2. The screen is not capacitive, it is resistive. I don't know how much more I need to say about that.
3. Only 3 buttons. Back, Menu, Home. Home takes you to their software not the android home screen. Long press on home does nothing.
4. When i go to the desktop the Time is all over the place. I have tried changing settings in every spot possible but something is telling it what time to think it is, occasionally it is correct... Just don't get it.
Even with the disappointments this thing is sweet. I wish i could install more apps, stream videos from a PC over the WiFi connection and stream music from a PC over the WiFi connection. Maybe with the help of the community we will figure some of these items out... Or I will be the only one who has this that knows about this website!
ntsteele,
How is your experience up to now with your 9500? I am looking at getting the c1250, which is the same as the 9500, but with a smaller motor and no decilne. Is the 10" screen worth it? The rep at Nordictrack told me the only differcence between the 7" screen is the web browser, the google maps display, and some basic apps. But overall the workout system is the same as the 7' display of the 1750 commercial and that you can view the google maps by logging in on ifit.com. Thanks for the info and screen shots.
iFit Android App
Have you or has anyone else been able to pull the apk files off of the NordicTrack Elite 9500 Treadmill. I would be interested to see if it works on any adroid phone to view the menu system.
I played with this today at Google IO. The rep said that the integrated tablet was rev 1 and that they wanted to eventually let users connect their own devices.
what do you need to press to get to the android home screen?
Where I work at there is a Proform Trailrunner 4.0 treadmill that has 10" Android tablet screen. From what I have been told nordic track and proform are made by the same manufacture or something. It was returned because of a broken display unit. Of course I wasn't going to let them throw the old one away so they let me keep it. I trashed the main display and now I have the 10" tablet but cannot power it because the treadmill doesn't operate without a magnetic key. How could I power this thing and see if it works?
I got the new incline trainer x9i which has the 10 inch android interface. I am interested to get in and try installing apps as you have but I am unable to even get to the android home screen. The only time I see it is when I turn the machine on and it is booting up, the screen comes up for a few seconds to where I can hit on the applications button and see what is on it. But within a second after I see the apps it automatically gets routed into the machine exercise interface and I have not figured how to get back to the android home screen from there. How did you do it? It would sure be nice to install a different browser. I hate the fact that I cannot create my own shortcuts. Anyway, love the machine.
How to get to the Android Home Screen
Any luck finding out how to get to the Android Home Screen? I am wanting to do that also. I was able to get to it one time accidentally, but haven't figure out how to stop the machine interface from loading since.
Home Screen
Ok, same question. I just got a C2150 which is a similar model to the 9500. Slightly smaller motor and belt, but same basic thing with the 10" tablet. I believe it's capacitive now, but still not great as far as that goes.
I too have hit the setup icon when it's booting and it goes to the Android setup screen for a second and then continues to boot into the Nordictrack IFit proprietary stuff.
So I can't believe the posts with the images and no explanation of how you got there? Please share with the rest of us.
Also, my console has a USB connector at the top of the thing. Any idea what if anything that'll let me do?
Thanks!
Anyone figure this out? Seems a shame to have a 10' screen and not be able to install apps on it. There must be some button combination that the Icon service team would use to stop the auto load of the iFit interface.
Internal Pictures
I took the tablet apart to see what information can be gathered. Apparently, HANNSTAR (TAIWAN) manufactures the board (HANNSTAR J MV-7); which uses a Samsung ARM8 CPU(5PV210AH-A0 1044); has 512MB; and a 4GB SANDISK FLASH (SDIN2C2-4G).
I haven't been able to find sufficient info to track a compatible ROM, yet I can't imagine for the life of me that HANNSTAR would design this just for Nordic. I am posting some pics hoping that someone might be able to id the hardware, which in turn might help point to a more fruitful search for a workable ROM.
Try to upload pics but not sure if it worked. It's late, and I can't figure out how to do it smoothly yet.
I'm gonna do another bump. I have a similar treadmill (or maybe the exact same one, I lost the the manual with product name). It is of the X9i series and when I saw it in the store, I had to go for it. I was a bit irritated to see that you are locked to the iFit application and you cannot return to the launcher. I need a male to male USB cable to see if I can get a bit of ADB on it.
From the (crappy) performance of it, I can tell it has about 512 MB RAM, a dated CPU clocked at around 600-800MHz, the screen looks like a crappy TFT display at 1280x700. Lastly, this thing runs Froyo. Mine features a full USB port and an Audio in port. Not much to screw around with. Downloads are disabled in the browser, and the Menu key does nothing.
I think something can be done though. The application that controls the treadmill can't crash as it is, and if it ever does FC, the motor shouldn't stop. NordicTrack doesn't have a recovery image up for some reason (thanks, NordicTrack -_-) so that's even less to work with.
Nevertheless, something can be done. It's not really a fun thing for an Android enthusiast to pick up an Android device with such dated hardware (the tredmill itself, as just tredmill is amazing).. Plus, it was $2,100 at Sears.
---------- Post added at 08:48 PM ---------- Previous post was at 08:43 PM ----------
here is a video of the Treadmill and the board;
http://www.youtube.com/watch?v=eKyf6MHIefk
USB and Audio in is on the right side of the console.
I've had my Nordictrack 9500 Pro for about a year now. Still working well for the most part (I do have messed up deck tension adjuster that I need to call support about).
Would love to be able to unlock the Android device to at least install Netflix, Pandora, etc.
I have had one over the air firmware upgrade that went pretty smoothly. Was hoping more updates would come from Nordictrack, but it has been a long time since that one.
Has anyone else noticed that the Speed Calibration utility under the iFit controls says that it isn't enabled yet? Maybe there's hope for future updates.
fanVrARCHITECT
Greetings,
I have been following this thread as a 9500 owner as well, and looking at what has been posted and see if there is any follow up.
1.) like everyone else what startup combinations may have disabled Nordic Tracks proprietary software.
2.) the usb socket on the top of the console, has anyone had anyluck attempting a usb male to male connection on a laptop? If so what has been tried?
3.) any idea of maybe porting something over via the Ifit updates or account? I noticed the HDvideo inside of the program is pretty descent from what I've seen, and looks like the video plays in the center of main app..just a thought.
I'm looking at getting the male to male usb cable and trying to interface it with the below. .. at least curious if the cable will talk, and most likely this unit is not root so view only but maybe a start if it works.
//www*howtogeek*com/howto/42491/how-to-remote-view-and-control-your-android-phone/
Cheers,
devmo
Did anyone figure out how to get android home screen????
I read somebody was able to email themselves an apk and install it? The tablet enables sideloading? Ding ding ding! I'm going to try sideloading launcherpro or any other replacement launcher to attempt to hijack the home screen
Update: Didn't work on my c2150's tablet. Bastards.... I did however get my c2150's to boot into "safe mode" which I have no idea what that entails. While it was powering on, I held down home and back I believe was the combo.
Update: SUCESS!!! So by booting into "safe" mode, you can hit the preferences launcher while the device is booting to interrupt the ifit loading. From there, go enable unknown sources. Then launch the browser and google "z4 apk" and download it and run it. Did permanent root on mine and it worked.
ENJOY
I forgot. Once you get the device into safe mode, install "smart taskbar" by sideloading. It'll make you able to view a task bar over ifit.
EDIT: Since we don't have a custom recovery, or for that matter even a recovery at all it seems, I've not attempted gapps. Could anyone give a detailed response on how to install this? I assume just unzip it in the root directory? I'm worried about permissions, I always forget what to set there. Also, the device comes pre-bundled with busybox, fyi Another must have for this is adbWireless. I tried editing the init.rc but it seems those changes were for nothing. I'll keep people updated as I discover things etc. I'm by no means a dev, but do know a little.
jsteelm said:
I forgot. Once you get the device into safe mode, install "smart taskbar" by sideloading. It'll make you able to view a task bar over ifit.
EDIT: Since we don't have a custom recovery, or for that matter even a recovery at all it seems, I've not attempted gapps. Could anyone give a detailed response on how to install this? I assume just unzip it in the root directory? I'm worried about permissions, I always forget what to set there. Also, the device comes pre-bundled with busybox, fyi Another must have for this is adbWireless. I tried editing the init.rc but it seems those changes were for nothing. I'll keep people updated as I discover things etc. I'm by no means a dev, but do know a little.
Click to expand...
Click to collapse
Sorry - can you tell me the exact steps involved here. How do I get to safe mode and then what? I tried Home Back while powering on and it still goes to the ifit screen
You know I'm really not sure what trick it is to make it stay. I had good luck getting it to stay in android rubbing home/back/menu while it booted and as soon as I saw the android home screen, hit the preferences launcher and then grabbed the top menubar and half pulled it down. All I know is that when you get it to stick in android, its always in safe mode which is triggered by some combination of those buttons on boot. Even then it will boot into iFit, but if you go to the settings first, in safe mode, it wont exit that screen.
Nordictrack commercial 2150 Android Safemode
Very simple folks. Turn treadmill on and once you see ANDROID appear in the center of the screen, begin pressing the dashes button that is between the home and back buttons on the console. Not sure if holding down works any better. An "unable to load widget" will be seen in middle of screen once the I-FIT software has stopped and safe mode will appear at the lower left hand corner. You'll then be able to check out the various Android options etc for your tablet. Be careful in editing anything unless you know what you are doing! Wouldn't want to brick your treadmill unnecessarily. It took awhile to find the key to safe mode access, due to limited info out there, but I hope users will continue to make some progress on exploiting this device and maybe we'll be able to use it to our liking. I would like to stream my dish television to the tablet like I do on my i phone or i pad. Being able to install the dish app via google app store is what I'm looking forward to. I want to be able to watch tv on my treadmill while exercising. Please keep this thread going! I'm sure that future software updates may allow for a better user interface. The challenge is certainly in the storage capabilities in the tablet itself and the sd card inside.
How to make your Nexus Q awesome with built in Android ICS (using CyanogenMod Trebuchet Launcher per this example).
This is by popular demand on Youtube and other places to demonstrate how I love my Q at the moment, which I obtained from someone who attended IO 2012. I was playing with it to see how capable it is with stock OS and kernel at handling 1080 content. It took me longer to write these instructions than root the device. Much of what is noted here is scattered on the forums and internet, but more than one person told me they didn't see an explanation matching what they saw in the video.
WARNING WARNING WARNING:
If you proceed with these instructions, you will be unlocking your device. If you do not know what "fastboot oem unlock" means, you should research it FIRST and understand you are officially bypassing a disclaimer when running "fastboot oem unlock_accept". If you do not have Jelly Bean and got it off eBay (like me), you will need to hack the actual APK from Google some for core functionality. This document expects advanced understanding of Android, and many assumptions are made. I have tested it locally, but since my Q is already unlocked, I cannot go back to the beginning for complete testing. Proceed at your own caution.
Assumptions: You have a secksy Nexus Q. Also, if you have an ICS client device without Jelly Bean, or the Google Apps aren't doing enough for you, this document covers these areas. I run with the assumption you do not have a JB client device (I own a Note, Tablet S, and HTC Doubleshot all running ICS builds).
Pre-req:
*SKIP IF RUNNING JELLY BEAN ON CLIENT DEVICE* -- Somehow get the NexusQ client apk. I personally updated my SDK value to 16 in build.prop, and it showed up. Then adb pull the apk, use apktool to decompile it, edit the manifest to use SDK version 15 rather than 16, and use apktool/jarsigner to install it to an ICS client.
*SKIP IF YOU HAVE ENABLED USB DEBUGGING ON NEXUS Q* -- Use the Nexus Q Client app (installed above if in ICS) as owner, enable USB Debugging in Advanced. This (should) magically enable ADB Network mode too (it did for me). Via nmap, I found it listening on port 4321.
fastboot is installed on PC.
adb is installed on PC (and can see the Q).
Sources:
http://droidcloudshare.blogspot.com/2012/07/rooting-and-getting-hid-mouse-to-work.html#more
http://bliny.net/blog/post/How-to-Root-Nexus-Q-(Temporarily).aspx
For kernel (modules): git clone https://android.googlesource.com/kernel/omap. Branch is android-omap-steelhead-3.0-ics-aah.
Steps:
Connect PC to Q via USB.
Run 'adb reboot bootloader'
Run 'fastboot oem unlock'. Then (Within 5 seconds run this to confirm): 'fastboot oem unlock_accept'.
Download this file -- http://www.bliny.net/downloads/nexusq-boot.img. It is a Nexus Q boot.img with ro.secure=0, allowing us to remount /system and root device.
Setup USB Debugging in Nexus Q via client app all over again (may require clearing data from client device Nexus Q app).
Run 'adb reboot bootloader'
Run 'fastboot boot nexusq-boot.img'. Your Nexus Q will now boot up unlocked, allowing:
Run 'adb remount'
Push 'su' and 'Superuser.apk' from a good source. I use nightly CM9 su/Superuser from my HTC Doubleshot. Put su in /system/xbin/, put Superuser in /system/app. chmod the su binary 06755. (There's many pages documenting how this is done).
*OPTIONAL BUT RECOMMENDED* -- adb push busybox binary from a known good source (I also use recent CM9 binary). Busybox will allow you to do things like remount /system and other necessary shell commands after the temporary ro.secure=0 boot up. This might also be a good time to push bash, or whatever linux utilities you'd like to have.
*OPTIONAL BUT RECOMMENDED* -- adb install the default Browser.apk from your good source, such as CM9. No browser is on the Q by default. Chrome will work, so will Firefox. Adobe Flash works (very well) with the CM9 Browser.apk in stock ICS on the Q.
*OPTIONAL* -- Install gapps, just like you would via clockworkmod. Hell CWM maybe out there for all I know. I did it manually, pushing the libs/apks/etc to the right places on /system. Gmail/Play/Youtube all work.
Sideload/Install a Launcher, I choose Trebuchet, also from nightly CM9 Doubleshot. adb install the apk, it will work.
*OPTIONAL* -- Sideload as many apks as you like for testing. I was lazy, and grabbed my apps from my Doubleshot /data/app directory. I then did a simple scripted command to install them all. 'for i in *.apk ; do adb install $i ; done'.
Profit.
How I profit:
From a PC or phone (I personally use ssh on my HTC Doubleshot), adb into the device again (I use adb connect network), and run:
'am start com.cyanogenmod.trebuchet/.Launcher'
This starts Trebuchet, and you now have a Launcher. Not everything works (wallpapers and home button mapping), but you have it up. If using USB keyboard like I am, ALT+TAB gets you around well.
Use a USB Micro USB dongle with USB wifi keyboard/mouse combination. I have two of them (adapters and keyboards), they all work. It makes navigation neato.
Install CIFS module: Grab android-omap-steelhead-3.0-ics-aah branch from https://android.googlesource.com/kernel/omap, and compile the CIFS and md4 modules. Push these to the Q via adb. Install them in /system optionally. Load them via insmod. I scripted it: 'for i in /system/lib/modules/* ; do insmod $i ; done'.
EDIT -- See Page 3 for instructions verbose on making a cifs module and loading it.
I map the IP in /etc/hosts on my PC, so "nexusq" is the network address, making adb connect simply 'adb connect nexusq:4321').
I know there's more. I love this thing. Highlights include Netflix and Youtube HQ, Vplayer playing 1080 mkvs of 17gb in size across CIFS, games working (Angry Birds, etc), Apollo music working, G+ is neat, etc.
And there's much more hacking to do, I did this with limited time.
You tube video (CAUTION IT SUCKS FOR SHAKINESS):
http://youtube.com/watch?v=ejYNDt0EUuA
kornyone said:
You tube video (CAUTION IT SUCKS FOR SHAKINESS):
http://youtube.com/watch?v=ejYNDt0EUuA
Click to expand...
Click to collapse
i have that youtube shakiness issue even with the stock build when using my galaxy nexus to play the files on the q
mejdam said:
i have that youtube shakiness issue even with the stock build when using my galaxy nexus to play the files on the q
Click to expand...
Click to collapse
I actually meant my recording was shaky, as in I was moving all over the place and more focused on showing off stuff than keeping the camera pointed at the TV. I also rambled. It was late. I planned to re-record the video on Youtube, but it picked up popularity over night.
As for Youtube on the Q to the TV via HDMI -- as you can see in the video I am playing Radiohead Coachella HD, and it looks/works great. I have watched quite a bit of content on YouTube without issue.
I got my Q today. Can't wait to modify it to make it more capable of stuff
Sent from my Galaxy Nexus using xda premium
Great work! Could you test the tablet remote app to control the q? Would be incredible if it worked. Thanks!
Does the Android Market work?
Are there any apps/limitations that don't work?
How is the responsiveness on the device, using the keyboard and mouse and loading up heavy websites? Can the processor keep up?
I saw in your video that when you press home on the keyboard it takes you to the Nexus Q's "home". Would it be possible to go to your apps on the settings screen and remove all the defaults from the Nexus Q's launcher, then when you press home it should ask you about which home do you want to go to and have a check-box for if you want to set one as default? I'm not sure if that would work, but it's an idea.
Would it be possible for you to post the modified apk that works on ICS devices for those that are unfamiliar with the apktool? I promise a quick and generous donation for your time and effort if you can. :good:
thevaristy said:
Great work! Could you test the tablet remote app to control the q? Would be incredible if it worked. Thanks!
Click to expand...
Click to collapse
I plan to play with more input devices, specifically Bluetooth soon. I have not had a chance to hack the Q since Saturday, but soon It's near the top of my list.
You say "app" -- is there one in specific you're referring to?
Paul22000 said:
Does the Android Market work?
Are there any apps/limitations that don't work?
Click to expand...
Click to collapse
Yes, Google Play Market works. I don't have a screenshot of it, but I have one of play.google.com telling me my Q is not compatible with Github's new app (I saw it yesterday at work) -- http://dl.dropbox.com/u/44767242/images/google-play-cut.png.
I would say 75% of the apps of the apps I looked at in my history of downloaded apps were "Not Compatible" via Market. I am sure this is due to build.prop data and other build information. Sideloading "Not Compatible" apks proves most are compatible. Since the Market is so vast, many applications do show up as "Compatible" with the Q, and will install natively.
yokken said:
How is the responsiveness on the device, using the keyboard and mouse and loading up heavy websites? Can the processor keep up?
Click to expand...
Click to collapse
Keyboard and mouse are quick. No issues there. Loading heavy websites is fine depending on the type of content on it, and browser chosen. I found some pages that brought it to a halt when using desktop browsing mode (like G+) in Browser.apk from my recent CM9 builds (there's not a Brwoser on the Q). However things I thought would bomb out, like heavy Flash video embedded pages or other pages were fine.
Putting it in Tablet DPI range (~213 or so) makes the Chrome browser use native tabs like you're used to on your PC. @1080p, this is sweet. It's a shame it requires a DPI hack to get this.
Mars11_ said:
I saw in your video that when you press home on the keyboard it takes you to the Nexus Q's "home". Would it be possible to go to your apps on the settings screen and remove all the defaults from the Nexus Q's launcher, then when you press home it should ask you about which home do you want to go to and have a check-box for if you want to set one as default? I'm not sure if that would work, but it's an idea.
Click to expand...
Click to collapse
It's not the defaults option, I did check this. I also installed third party apks to help remap it. I found it's embedded in the startup of the Q's hub activities, and I did not want to rip it out, since I have not found a Factory Restore Image from Google (yet).
bobukcat said:
Would it be possible for you to post the modified apk that works on ICS devices for those that are unfamiliar with the apktool? I promise a quick and generous donation for your time and effort if you can. :good:
Click to expand...
Click to collapse
I can whip that up. I will make sure it's the latest Nexus Q apk in the Market, which last I looked, had never been updated.
Also JB did drop for AOSP, depending on your device, you could have compatibility soon
kornyone said:
I plan to play with more input devices, specifically Bluetooth soon. I have not had a chance to hack the Q since Saturday, but soon It's near the top of my list.
You say "app" -- is there one in specific you're referring to?
The app is called tablet remote. Name is kind of lame, but here is the link...
https://play.google.com/store/apps/...wxLDMsImNvbS50b3VybmVzb2wudGFibGV0cmVtb3RlIl0.
Click to expand...
Click to collapse
Oh yeah, I got a lot of feedback for this video. and I have more planned (as I am sure plenty others do!).
I created ##nexusq on Freenode, as I could not locate a pre-existing Freenode channel for Nexus Q haxxoring conversation. I am on there. I am not very good at checking XDA.
Is it possible to connect a mouse via bluetooth, or even connect to a laptop via bluetooth?
As for the mouse yeah. Its advertised on the front page:http://www.xda-developers.com/android/connect-an-hid-bluetooth-mouse-to-the-nexus-q/
I'll give you a killer feature request: Play my own media either via (preferred) an attached network drive or a an directly attached drive.
I tried the entire Saturday to make the "Tablet Remote" to work on Q but I couldn't, for some reason the Q showed as connect to the Galaxy Nexus when I asked for the connection but the Gnex showed as declined.
There is something related to the pairing key that is not working, the logcat showed that was not giving the correct key as answer and also the key didn't show on the Q screen...
I'll keep digging it, and really hope that someone discover how to do it quickier than me, it's something that is killing me and it's now the matter of honor!
I'm not too skilled, but without keyboard and mouse I did a lot of tricks on my Q using the adb, waiting for the host cable to start to play hard on it! I hope to discover something that could help the community!
thanks for getting the ball rolling!
Thanks so much for the groundbreaking work on this, I managed to reproduce all the steps excepting compiling CIFS.
To those that want to play networked stuff - I'm able to stream video via upnp over a network either through vplayer or upnp + mxplayer. Able to play angry birds, etc. Although Google Play movies aren't showing the free transformers one I got from Google I/O. Maybe cause it's locked to my Nexus 7?
Sideloading helps a lot, take advantage of adb over the network. Installing gapps from CM9 nightly works awesome. It would be nice to get trebuchet to autostart, I'm sure there's a way to do this, but I'm not knowledgeable enough to know if there's a way to start it via a run time / on boot level.
For keyboard and mouse, I'm using one of these: USB-Micro-Female-Male-Adaptor that I trimmed down with a knife to fit in the port.
I plug in a keyboard with a built in hub and a mouse goes into that. Works great, sort of like an Atrix docked.
If anyone is stuck I'm more than happy to help.
help
which program are you using on your sideshoot? I am trying to adb from my transformer prime and I guess I am not as much of an expert as I thought. Any help would be awesome.
ace2die said:
which program are you using on your sideshoot? I am trying to adb from my transformer prime and I guess I am not as much of an expert as I thought. Any help would be awesome.
Click to expand...
Click to collapse
Hey there
I'm sideloading on an ubuntu machine. I can't post links yet, but you basically need to follow
http:// forum.xda-developers.com/showthread.php?t=1550414
That will put adb on your machine. Use a charging cable to connect to the back and use a Nexus 7 to put your Q in developer mode.
Download the fastboot image and follow the directions from there.
Then run the adb scripts from that pc.
You'll also need, as in the instructions, a way to get certain programs off ICS (Su and superuser) and some launcher (trebuchet, nova, etc).
Hope this helps!
Hello everyone
This is my first time to the forum
I recently got the 2016 honda civic and it comes with android auto and carplay (for iphone). The car is great however I noticed that there is an "apps" section in the IMID display. There's options to install apk files on a USB drive, browser/search when connected to WI-FI, and a downloader app to view progress of downloads. I've tried having the apk files on a USB and was able to see the apk files, but the "install" button was grayed out so I couldn't install it. I looked on the web for tutorials on getting around it. Since the IMID is linux / android based - I managed to find the android settings window, select "about", scrolled down to "build #", and tapped it 7 times to try and enter the developer mode. I get the countdown till I enter developer mode, but after the last tap, it asks to enter a "passcord" which I think is a typo for "password"? and no keyboard appears to do any sort of typing for the password. I wanted to see if anyone got further than I did.
Tried a lot of things to see if there was a way to access the developer mode or by pass the car system to be able to install apps. I've read it's futile but just wanted to give it a shot.
Thank you for any help / advice!
(i've attached the info of the version that's in the car. need to remove a couple spaces in the link below)
https: //www .anony.ws/image/JgJ1
Found This
Hello,
I was digging in some more and found this under System>Legal Information>Open source licenses
When I selected "Open Source Licenses," it discusses the open source software and provides a link that I posted below.
(remove the spaces in the links below)
http ://www .embedded-carmultimedia.jp/linux/oss/download/H_ADA_163400_00001
(this is a picture of what I found)
https ://www .anony.ws/image/Jgbl
I have some software background but this is beyond what I can understand for Linux/android coding language.
Has anyone heard of updates?
This code appears to just be for the Bluetooth protocol stack, BlueZ. I don't think it would be useful. Is there any other downloads in that text?
T3h Ub3r K1tten said:
This code appears to just be for the Bluetooth protocol stack, BlueZ. I don't think it would be useful. Is there any other downloads in that text?
Click to expand...
Click to collapse
Unfortunately, I've tried digging in more, but haven't found anything besides the open source download link. But thank you for taking a look into what is in the source code. :good: All I know was that it was in C/C++ which I do not have a lot of expertise in following.
We just need to figure out how to get passed the "enter passcord" issue :/ or other methods of cracking into the system. I greatly appreciate the help
Technically, it is supposed to be possible to unlock the radio and navigation system through this website :
https:// radio-navicode.honda.com/
Apparently, the code seems to be unique for each vehicles... Now I don't own a Honda, so I cannot verify it myself.
Enjoy!
Martarek said:
Technically, it is supposed to be possible to unlock the radio and navigation system through this website :
https:// radio-navicode.honda.com/
Apparently, the code seems to be unique for each vehicles... Now I don't own a Honda, so I cannot verify it myself.
Enjoy!
Click to expand...
Click to collapse
Thanks, I got my code, but now, how to type it in? It doesn't provide a keyboard.
Btw, the device has about 2G disc space.
Nice! Thanks for the info =) . For the keyboard entry, first thing I would try would be either trying to pair the radio with a bluetooth keyboard or simply plugging a USB keyboard in the USB connector inside the car. Chances are, it might be able to load the proper drivers by default if Android was not too much modified. Still, a long shot. Otherwise, I am rather surprise that there are no software keyboard on the device...
Martarek said:
Nice! Thanks for the info =) . For the keyboard entry, first thing I would try would be either trying to pair the radio with a bluetooth keyboard or simply plugging a USB keyboard in the USB connector inside the car. Chances are, it might be able to load the proper drivers by default if Android was not too much modified. Still, a long shot. Otherwise, I am rather surprise that there are no software keyboard on the device...
Click to expand...
Click to collapse
The unit has a software keyboard (it pops up in different places, like the browser for ex), it just doesn't pop up in this case. I guess it is disabled on purpose. I don't have a bluetooth or USB keyboard. Will have to search one. Actually, I'm thinking there should be some hidden USB port somewhere because the ones exposed are very limited.
Apparently if you
[...]enter the diagnostic menu press the green power button, menu button, and brightness setting button at the same time. Diagnostic menu will pop up in about 2 seconds. If it does work take your finger off the buttons and try again. To enter the developers menu select detail information & setting then hold the menu button. To enter the hidden android settings select android settings in the developer menu.
Click to expand...
Click to collapse
Source :
htt ps://youtu.be/y-C1odfr0vU
Maybe there is more to be done this way...?
The radio seems to be able to provide a lot of information about the car (a CANBus connection?). Let me know if it gets you any further =) . But still, the USB keyboard seems to me like one the most promising ways of inputing the code you obtained at the moment...
The radio code is only for theft protection. Normally the head unit stores the VIN for its original car and will lock if it gets put in a car with a different/inaccessible VIN. The code lets you unlock the head unit then. You can actually view it in one of the diagnostic menus.
I can confirm that a USB keyboard plugged into either of the two USB ports does not work. I have found out a few things, though. If you open the browser and go into Google or something so the on-display keyboard appears, you can then plug in the USB keyboard and the on screen keyboard will glitch. It will not allow you to type on the USB one. This to me seems like the device is purposefully recognizing the USB, then blocking it from being used. It would make sense to be that there may be a third, hidden USB somewhere that allows much more access.
I also have a 2016 Civic and went through all same things.
On another note, has anyone figured out how to do the brake bypass, how to ground it? I used the web browser by tethering my phone and youtube videos loaded fine, but it won't work if the car is not parked. Anyone know how to have functionality while the car is in motion?
me trying to figure things out earlier today https: //youtu.be/ ionETf7ZL30
johnleewins said:
I also have a 2016 Civic and went through all same things.
On another note, has anyone figured out how to do the brake bypass, how to ground it? I used the web browser by tethering my phone and youtube videos loaded fine, but it won't work if the car is not parked. Anyone know how to have functionality while the car is in motion?
me trying to figure things out earlier today https: //youtu.be/ ionETf7ZL30
Click to expand...
Click to collapse
It's more complicated than that I'm sure. I'm pretty sure it's getting speed sensor information. Also in the hidden diagnostic menu there are two entries that are something like VIDEO Moving or something like that and it's value is 0 meaning that it's off.
an1m3psycho said:
I've tried having the apk files on a USB and was able to see the apk files, but the "install" button was grayed out so I couldn't install it.
Click to expand...
Click to collapse
If you turn the power off then quickly back on, the button is no longer grayed out and you can select it but even still, the install still fails later on.
You guys are a lot smarter than me. Maybe this will help out?
civicx.com/threads/navi-on-non-navi-model-is-it-possible.3107
There is hidden usb port, when you open device. Search on forum, there sre threads where people are trying to root it
jdubau55 said:
It's more complicated than that I'm sure. I'm pretty sure it's getting speed sensor information. Also in the hidden diagnostic menu there are two entries that are something like VIDEO Moving or something like that and it's value is 0 meaning that it's off.
Click to expand...
Click to collapse
Where i can find those settings? can you point out ?
Developper mode asked password
My Honda Civic 2016 (Canadian version) asked me a password to activate the Developper mode. Any one here had the same issue, i have done a complete reset of the system to default and still the same things.
To be clear, after tapping 7 time on Build number, the popup appeared.
My Android Version is 4.2.2 Build: 1.F186.67 and Model number: MY16ADA
Pls help !!
zahurkho said:
My Honda Civic 2016 (Canadian version) asked me a password to activate the Developper mode. Any one here had the same issue, i have done a complete reset of the system to default and still the same things.
To be clear, after tapping 7 time on Build number, the popup appeared.
My Android Version is 4.2.2 Build: 1.F186.67 and Model number: MY16ADA
Pls help !!
Click to expand...
Click to collapse
USA version is the same way it asks for a passcord I believe it is a USB cord for diagnostic that Honda has
Sent from my Pixel using Tapatalk
Sorry if this is in the wrong location, if it is please let me know where to move it.
So the story goes I found an Amiibo Kiosk at my apartment dumpster. It was originally designed to run a single app meant to be interacted with by customers and a settings app meant to be accessed by a technician and nothing more. Using adb I managed to get into the /actual/ android settings menu instead of the custom "CSR" one that you can access by pushing some buttons on the back and perform a factory reset. If you need more information I documented everything I did here: https://forum.xda-developers.com/android/help/commercial-grade-android-tablet-issues-t3594279 the post is at the very bottom.
It's a giant 18.5 inch 720p commercial tablet from DUCO meant to be mounted in customer-service kiosks: (product page) http://www.ducotech.com/product/18-5-android-based-720p-hi-def-lcd-media-player/
I sideloaded arrow launcher, aosp keyboard, google chrome, and a stripped-down youtube front-end so it can be used as an actual tablet. Unfortunately Google Play services in not supported on this device (although I could probably spoof it as an officially supported device to make it work, but I want to fix my biggest problem first.)
My problem is that after a pretty consistent amount of time it unceremoniously black-screens with a pop from the speakers, then starts back up. I logcatted it and it shows nothing but wlan polls and ram cleanup before it shuts down, however I'll include it anyway since I'm sure that'll be the first thing anybody asks for.
My best guess is that there is some kernel watchdog resetting it since it's not being tickled by DUCO's CSR app that is normally installed when the system is sitting on a salesfloor.
Is there any way to check for this and/or disable it?
Additional info:
Running Android 4.1.1
Sun4i architecture
I attempted to install Busybox, but the tablet resets itself before Busybox can finish installation.
Logcat is here since the logcat.txt is a few kb too big to upload.
How did you get PowerShell to accept the line code. It errors everytime I type the codes you are recommending
Picked up a Moto G8 Power off Ebay and I havent touched an Android since I flashed a HTC Desire with Cyanogen Mod years ago.
Product/Variant: sofair XT2041-3 64GB PVT
?BootLoader? BL:MBM-3.0-sofiar-reteu-0f8934adaf8-210928
BaseBand: M6125_43.45.03.48R Sofia_rowdsds_cust
Recovery mode shows: RPES31.Q4U-47-35-9/54bc43
oem_locked
Spent all of today going around in circles.
Google Locked = it wants a pin to verify. Ebay ad stated it was google locked house clearance and not stolen. Nothing shows up in CheckAmend.com
On an offline PC
Android Studio installed - strangely ADB nowhere to be found.
ADB installed separately.
Got Magisk apk
Got from lolinet mirrors
XT2041-3_SOFIAR_RETEU_11_RPES31.Q4U-47-35-9_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml
blankflash_sofiar_RPE31.Q4U-47-35
From Motorola
Motorola_Mobile_Drivers_64bit
Rescue_and_Smart_Assistant_v6.3.2.12_setup - This will not install and I find this error in the Windows eventlog
MDM Declared Configuration: Function (checkNewInstanceData) operation (Read isNewInstanceData) failed with (The parameter is incorrect.)
Motorola support cant help until monday, but it might be a ASLR or some other MS security thing.
TWRP is missing the Motorola G8 on their website, G7 and G9 and others exist, so this is not an option.
Followed some of those youtube videos showing how to bypass the FRP, which appear to use a variety of tricks to either disable the Google Play Service or use an app to launch another app, a bit like getting the 2nd dial tone by calling a business freephone number, and hacking their phone system to get an onward outbound dial tone in the 80's.. Showing my age!
Before I put the device online using wifi and no sim for mobile data, I could get access to the Androids settings, where I could list apps, set permissions and other things so I'd tried to disable the play store, but these tricks wouldnt work. Put it online and it appears Android has been updated so those previous tricks for getting all the apps listed and makiing changes to their permission etc is no longer there. One of them was using the emergency phone, getting to the contact detail and then choosing a pic to gain access to other apps and that also stopped working and has disappeared which is why I say I think its been updated in all but version number!
I can access a fat32 sd card in recovery mode, but the apk files I put on it dont show, just the folders Android created on blank Fat32 partitions.
USB and ADB dont detect this device so I cant use the Wireshark USB to watch what is going over the USB connection.
AFAIK Android DeveloperMode/Debugging Mode is disabled.
I havent touched an android since the HTC Desires appeared and then I ported it Cyanogen Mod, but I subsequently learnt the UK Police had access to my phone even back then!
Not taking it apart to get access to the JTAG (just yet), I bought a few broke Pixel4A to see what I could learn about them when they arrive as well.
I see in fastboot, the mention of a "console [NULL]:null" is this the fastboot.exe alongside adb.exe in android tools, or something else?
So is there any other way or suggestion to get root for this device?
I fancied looking at LineageOS, or maybe some other OS like an unofficial port of GrapheneOS. I've found the device tree info put up by someone on here which would suggest its possible to port from Android 10Q to an Android11 distro/os, but my first hurdle is my stumbling block, I cant get the USB to work and have not found any other way to get beyond this stage to poke around with the OS and phone.
So any pointers, suggestions, advice, will be much appreciated!
TIA
Edit. It looks like Android/Google/Motorola have done a good job at locking down this OS and phone.
Edit2
Saw this thread here about making sure the Motorola drivers are installed properly.
[HELP] I seem to have bricked my Moto G Power and not it's stuck on bootloader.
This is what it looks like, and if I try to boot into recovery or system it just says "no operating OS found." Windows won't recognize it when trying to connect via USB. Any way to fix this? Help would be greatly appreciated.
forum.xda-developers.com
On Win10x64 I've been into c:\windows\system32\DriverStore\FileRepository, sorted the subfolders by todays date/time and can see a number of subfolders like
motoandroid.inf_amd64_dd80f24dcfb3dc931
motoandroid2.inf_...
motodrv.inf_....
motousbnet.inf....
and when inspecting one of the .inf files in notepad I can see there appears to be a service linked to the driver, but when I check the services, there isnt any services installed.
So I'm starting to think maybe Motorola's installation software doesnt work on windows with the default windows security settings, like exploit protection running.
More investigations...
Edit4
In the Control Panel (yes its still there in Win10), Device Manager, Other Devices are a couple of entries which the latest attempt to install the Motorola USB x64 msi installer created.
These are:
Mot Composite ADB Interface
Motorola ADB Interface
In c:\Windows\system32\drivers are a couple of 0KB wdf files (Windows Driver Foundation) files:
Msft_Kernel_WinUSB_01009.Wdf
MSft_Kernel_motoandroid_01009.wdf
Msft_User_WpdFs_01_11_00.wdf
So when looking at the c:\windows\system32\DriverStore\FileRepository I think the driver that needs to be installed can be found in the subfolder:
motoandroid.inf_amd64_dd80f24dcfb3dc931
However opening the motoandroid.inf file inside I can see lines like
DriverVer=03/25/2013, 1.3.0.0
As this folder was created about 30mins+ earlier, am I correct to believe the actual motorola driver was created back in 25th March 2013 and is version 1.3?
I know its possible to edit inf files to make drivers W2k and XP drivers work on later versions of windows, but the motorola website has the version number 6.4 but is this 6.4 the version number of the installation program?
Anyway scrolling further down the motoandroid.inf I can see towards the bottom instructions to install a service
"Mot ADB Interface Installation Driver" and it needs to find the actual driver in %root%\System32\Drivers\motoandroid.sys
Various paramaters, like a transfer size 4096bytes, a debug level of 2 and plenty of guids which will be found in the registry.
Anyway uninstalling the software as now removed these subfolders from the DriverStore\FileRepository, so a reboot and another attempt to see where its failing.
I just hope it doesnt need an internet connection, as this offline pc is a dev machine.
Onwards and upwards....
Edit 5
So the Windows 10 setting which prevents the Lenevo Rescue and Smart assist from installing is the Windows App and Browser Control > Exploit Protection > Force randomisation for images (Mandatory ASLR) when its on.
You can have every other windows setting on, like ransomware protection, normal ASLR, DEP etc etc and LMSA installs fine, right now its downloading an image to flash from FastBoot, but its not got the Developer mode/USB debug enable in android to make this possible.
Now lets see if I can get the Motorola USB drivers to work with ADB...
Got to say these forums are excellent cheap intelligence gathering tools for manufacturers and software companies to harden their products.
So tried lots and lots of these types of YouTube videos which are exploiting an SE Linux "vulnerabilities/design flaw" by getting access to enough of the system in order to disable/force stop certain apps in order to get past FRP block.
Some of these are less than a month old with less than 100 views, but I also suspect some of them of doing a bit of camera editing. I guess its a way of bunking up the number of views for a youtube account, before it gets rebranded, if thats even possible!?!
Now I managed to get the Lenovo Rescue and Smart Assist program to work, once I realised it will not install when Windows Exploit protection/Mandatory ASLR is enabled (which is a give away as to what the installer is doing on my system as well), and the give away information which suggests it might be worth downloading wireshark and installing the USB "packet" sniffer is the fact that when LMSA is running and you plug your usb cable into the Motorola phone, the phone displays the battery power as a xx% inside a swirling circle of sorts.
So there is some sort of USB communication taking place?
The other thing that gives it away is when you type in your IMEI number into the LMSA Rescue section, its detecting the version of firmware and wants to download the latest version.
LMSA did this to me last night as it downloaded
SOFIAR_RETEU_RPES31.Q4U_47_35_12_subsidy_DEFAULT__regulatory_DEFAULT_CFC.XML.zip
which I guess I can search for on this computer, or at least search for files on my windows hard drive created within a certain date/time frame, as the filename might be scrambled/obfuscated in some temp folder.
So is it just Firmware level communication, or is there some sort of Android communication taking place as well?
If its just firmware, then what could be elucidated/deduced from attacking the firmware? Perhaps its time to get the Wireshark USB sniffer out after all.
As I can also put an SD card into the phone (the start of a potential side channel attack) and the phone will load the SD card, I could explore different routes like some "malware" embedded using a picture to attach to the Emergency Contact details, maybe some PHP embedded in the pictures EXIF data or something that could trigger some other secondary app/process in Android into action.
It might pay for me to lookup the Google Android source if its open source, and look at the Android project source which is open source for any vulnerabilities. Anything mentioned in Github could give away clues
Configure on-device developer options | Android Studio | Android Developers
Learn how to configure system behaviors that help you profile and debug your app performance.
developer.android.com
So are there any issues listed here which doesn't just affect Android 13, but maybe earlier versions as well?
Google Issue Tracker
issuetracker.google.com
So lots of less obvious or not publicly mentioned intelligent sources of potential attack vectors in plain sight.
Seeing if I can alter the cpu clock speed and quantum could also help to introduce some instability, Linux has a wider range of cpu schedulers than windows, but this route tends to hang systems and I have to get enough access to this phone in order to change the route.
The recovery msg logs seen when selecting different bootloader options give away info, I think this is DMesg output of sorts. I'm not a linux programmer, just a boring old windows programmer.
I could explore what else could be loaded from the SD card, using the Bootloader menu options. I was surprised the APK packages dont appear in SD card in the "Recovery Mode > Apply updates from SD card" option. Maybe its not expecting a APK file extension? Mybe its expecting a different file of sorts like a .bin file or .img file. Is this where BlankFlash comes into play?
I have to admit, buying a second hand phone like this with FRB enabled off Ebay from a guy purporting to be in Salisbury home of Noivchok, is also a great way of spreading the latest and greatest malware to unsuspecting hackers and also to phish those who could potentially get around the FRB restriction with the minimum of effort. The UK civil service have their own internal postal system so has something been posted internally down the M5 motorway from Cheltenham, for some intelligence gathering or a cheap way of outsourcing some device cracking?
Oh well the silence is deafening.
So Motorola Support Centre have been in touch and stated:
I am really sorry to say that the kill switch feature, which is known as "Google Lock" is not bypassable by anyone other than the repair center.
So they are stating the Android Factory Reset Protection (FRP) can be bypassed which is another way of saying it can be undone, so the next challenge is finding out where on the device this flag or flags resides.
Is it something like the RaspberryPi One Time Programmable (OTP) switch's that may not be One Time Programmable but like the dip switches seen on the motherboards of early 8086/286/386/etc personal computers, or something else like a file on the main storage device with the rest of android.
I think the first thing to do is get Wireshark and the USB sniffer to see what information is being sent over the USB cable.
And as its possible to get the device online via wifi, it's probably a good idea to see what information is being sent over wifi, so using wireshark on a raspberrypi masquerading as an access point might be useful as well.
So the first thing to do is have a look at the Android documents
Android
Android has 74 repositories available. Follow their code on GitHub.
github.com
https://developer.android.com/reference/android/app/admin/FactoryResetProtectionPolicy
The factory reset protection policy determines which accounts can unlock a device that has gone through untrusted factory reset.
So it looks like Android are also stating the Factory Reset Protection can be undone. It seems a that a single user setup and a corporate setup exist, where a corporate account could be used to remotely wipe a device and then reenable the device, I guess if the user hands it back to the company.
https://developer.android.com/about/versions/marshmallow/android-6.0-changes API 23
EXTRA_PROVISIONING_RESET_PROTECTION_PARAMETERS is removed so NFC bump provisioning cannot programmatically unlock a factory reset protected device.
You can now use the EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE extra to pass data to the device owner app during NFC provisioning of the managed device.
Interestingly, NFC can be used to unlock FRP in earlier versions of Android. and its possible to use NFC to potentially configure and more other devices using NFC. As NFC is just a low power and thus low range frequency in the RFID range of frequencies alot of other things could be possible. NFC to me is just like any other form of communication method, beit a usb cable, telephone wire, wifi, ultrasonic sounds, or Infrared.
Radio-frequency identification - Wikipedia
en.wikipedia.org
NFCIP-1 and NFCIP-2
Near-field communication - Wikipedia
en.wikipedia.org
As NFC can communicate a request and response, and Android is using NFC to configure devices, using NFC may be a novel attack vector for peoples android devices, without them knowing about it unless they capture on a personal webcam everyone and every NFC device they come in to close contact with. Maybe using payment terminals could become a new attack vector at your favorite local retail outlet?
Well if Covid doesnt make people socially distanced, then maybe an NFC attack vector might if it works beyond the claimed 4cm operating range! Unfortunately this phone does not come with NFC, but others do.
I've got to find the source code....
Android (operating system) - Wikipedia
en.wikipedia.org
Most versions of Android are proprietary. The core components are taken from the Android Open Source Project (AOSP), which is free and open-source software (FOSS) primarily licensed under the Apache License.
Search results for "factory reset protection" | Android Open Source Project
source.android.com
The default implementation of Test Harness Mode uses the same storage mechanism as Factory Reset Protection to store the ADB keys temporarily in a persistent partition.
So it looks like I need to gain access to this "persistent partition" and try to find this ADB for starters.
Seems a bit sneeky of Google and Android here. https://source.android.com/docs/security/bulletin/2016-02-01
At the bottom of the Android webpage is a link to Factory Images of the Google Nexus and Pixel phones which jumps you to Google web page. No indication what so ever I'm leaving Android and going to Google!
Flashing devices | Android Open Source Project
source.android.com
To enable OEM unlocking on the device:
In Settings, tap About phone, then tap Build number seven times.
When you see the message You are now a developer!, tap the back button.
In Settings, tap System, then tap Developer options and enable OEM unlocking and USB debugging. (If OEM unlocking is disabled, connect to the internet so the device can check in at least once. If it remains disabled, your device might be SIM locked by your carrier and the bootloader can't be unlocked.)
Reboot into the bootloader and use fastboot to unlock it.
For newer devices (2015 and higher):
fastboot flashing unlock
For older devices (2014 and lower):
fastboot oem unlock
Tip: if you're seeing `adb devices` output before reboot but fastboot or the flash script are misbehaving, it might be issues with your USB cable. Try a different port and/or switching connectors. If you are using a USB C port on your computer try a USB A port instead.
Confirm the unlock onscreen.
Well the instructions I've seen only talk about the gaining access to settings and the doing 7 taps on the Build Number. Lets see if the rest of the instructions work.
Onwards and upwards....
Well sent the phone back the Ebay seller claiming to be a house clearance business wouldnt provide any paperwork to back up his claims of how he came to be in possession of the phone. So as I planned to do some computer forensics on it, like retrieve the files wiped by a Factory Reset, and the perverse interpretation of the law in this UK, I wasnt prepared to go any further with the phone. So its been sent back. The banks have already shown how untouchable they are, other big businesses are also in the same position and finding illegal stuff on a phone is not a risk I'm not prepared to take without paperwork.