Announcement

Collapse
No announcement yet.

Announcement

Collapse
No announcement yet.

Nexbook AMlogic root WORK!

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Rooting procedure for Nextbook NEXT8P12 (AMLogic) - USB 3G dongle method

    1) Download the zip file attached to this post to a folder on your PC and unzip it. Find "Superuser.apk"and download it to the same folder (it is too large for me to attach here - even zipped up). It was posted earlier in this thread or you can probably find it elsewhere, as well.

    2) Connect your tablet to the same PC and enable USB storage on the tablet.

    3) Copy the files "su", "Superuser.apk", and "init-pppd.sh" to the the NEXT8P12 drive. This will put them in the root directory of the internal flash of your tablet ("/sdcard").

    4) From the toolbar on your PC, click "Safely Remove Hardware and Eject Media". When the dialog appears, click "Eject Android". You should get a popup message from the PC when it is "Safe to Remove Hardware".

    5) Turn off USB storage on your tablet, disconnect it from your PC, and remove the USB data transfer cable.

    6) Using ASTRO, navigate to the "/sdcard" folder. Copy the file "init-pppd.sh" (shows up as "init-pppd") and paste it in the "external_sd" directory. This will save your original file so you can restore it easily later should you want to do so.

    7) Copy the modified "init-pppd.sh" file from the "/sdcard" directory (from step 3, above), navigate back to the "/etc" directory, and paste over the original "init-pppd.sh" file. Leave the filename the same. You will be asked if you want to overwrite the original file - click "Yes".

    8) Install an active SIM card into your 3G dongle (I used a Huawei E220) and connect it via an OTG USB to micro USB adapter to your tablet. The LED on the dongle should begin to flash in short order. I tried this several times without a SIM card installed and it did not work for me.

    9) Within a few seconds, you should see a new annunciator in the status bar in the lower right corner of your tablet's screen, where the time is displayed, between the WiFi and Battery annunciators. It looks like the one on your smart phone, with the familiar stepped bars. It will probably have an "X" at the bottom, for now - this is normal.

    10) Open up "Settings" on your tablet. Press the "More..." button under the "WIRELESS & NETWORKS" heading. You should see two choices: "VPN" and "Proxy settings". Leave everything connected and set the tablet aside for 5 minutes. When you come back, the annunciator in the status bar shoud show that you are connected. You should now see an additional choice in the settings window: "Mobile networks". If you don't see this, press the "WiFi" button and then press "More..." again.

    If it's still not there, give it a little more time... be patient! I thought it took a lot longer on the first tablet I did (like 10-15 minutes), but my wife's tablet only took 2-3 minutes to set up the 3G connection.

    You may have to disable your display timeout ("Sleep" set to "Never timeout") for this to work properly, I'm not sure. I disabled it on my wife's tablet, but I was using my tablet when I rooted mine so the display did not shut off.

    11) If you get this far, pppd has started on your tablet and your modified "init-pppd.sh" script has run. If you did everything right, your tablet is now rooted. Look in the "/system/bin" directory and you should find "su", and you should find "Superuser.apk" in your "/system/app" directory. You can delete the files you copied to the "/sdcard" folder in step 3 and restore the original "init-pppd.sh" file that you backed up to the external SD card to its original place in the "/etc" directory.

    Note: I started this procedure from memory, then updated as I attempted to root my wife's tablet. It should work. If it doesn't, check your work and try again.
    Attached Files
    Nextbook Premium 8 SE (Next8P12) - * ROOTED * (Sold on ****)
    AML8726-M3 Cortex A9 @ 1GHz

    Nextbook Premium 8 HD (N0008HD8G) - * ROOTED *

    Nextbook 8 (NX785QC8G) - STOCK (unfortunately)

    Comment


      Nice work on the root method!

      Hey, nice work on the root method there Eegor!

      I can't wait to see the rom dump and a custom rom from Finless!

      ShaunMT
      Freaktab Rom Developer

      Subscribe To My Developer Thread For Updates On My Projects: ShaunMT

      https://www.paypalobjects.com/en_US/..._donate_SM.gif

      Comment


        Originally posted by shaunmt View Post
        Hey, nice work on the root method there Eegor!

        I can't wait to see the rom dump and a custom rom from Finless!

        ShaunMT
        Thanks, but the credit should really go to ozymandiaz for finding the potential exploit - the unprotected init-pppd.sh file - in the first place.
        Nextbook Premium 8 SE (Next8P12) - * ROOTED * (Sold on ****)
        AML8726-M3 Cortex A9 @ 1GHz

        Nextbook Premium 8 HD (N0008HD8G) - * ROOTED *

        Nextbook 8 (NX785QC8G) - STOCK (unfortunately)

        Comment


          Originally posted by eegorr View Post
          Thanks, but the credit should really go to ozymandiaz for finding the potential exploit - the unprotected init-pppd.sh file - in the first place.
          Well, then thanks to Ozymandiaz as well!

          Now, lets get that rom dumped already!

          ShaunMT
          Freaktab Rom Developer

          Subscribe To My Developer Thread For Updates On My Projects: ShaunMT

          https://www.paypalobjects.com/en_US/..._donate_SM.gif

          Comment


            Great write-up and .zip file there! I'll probably use superSU rather than superuser but that's personal preference! I'm just glad we managed to get around all their lock-downs on this thing. It's pretty ridiculous! I'm waffling about buying a 3g dongle just to root the tablet since I don't have any use for it with other devices but if another root method can't be found via a ROM / recovery dump from your device then I'll order one up via Amazon Prime and finally get this thing rooted

            Comment


              Ha! So I get no credit for writing the script to push su and super user?

              Kidding......


              OK so eegorr, we now need a ROM dump!

              Hang tight while I look back over posts for the parition table info and I will tell you how to dump it.
              You will need to get terminal emulator from google play and side load it.
              Please try to not mess with /system directory as this we need clean.

              ALso no worry about your private data, we will not be dumping /user as we do not need it.

              Be back later...

              Bob
              "Pzebacz im, bo nie wiedzą, co czynią"
              "Прости им, они не ведают, что творят"
              "Perdona loro perché non sanno quello che fanno"
              "Vergib ihnen, denn sie wissen nicht, was sie tun"
              "Vergeef hen want ze weten niet wat ze doen"
              "Pardonne-leur car ils ne savent pas ce qu'ils font"
              "Perdónalos porque no saben que lo que hacen"
              "Oprosti im, jer ne znaju Å¡to čine"
              "Forgive them as they know not what they do"





              Comment


                eegorr, look at post 23 from ozymandiaz

                You will use DD command to dumpt the following
                bootloader
                boot
                system
                recovery

                optional:
                logo
                aml_logo

                I am hoping DD will hit EOF on each partition and stop so we do not have to have you set the size in the DD command. So lets try that first.

                What I really need most for now is recovery! I will take it apart and remove the signing check and rebuild it. Then we can make ROMs using standrad google signing ZIP files


                Hey...GOOD JOB man! Freakin awesome work!

                Bob
                "Pzebacz im, bo nie wiedzą, co czynią"
                "Прости им, они не ведают, что творят"
                "Perdona loro perché non sanno quello che fanno"
                "Vergib ihnen, denn sie wissen nicht, was sie tun"
                "Vergeef hen want ze weten niet wat ze doen"
                "Pardonne-leur car ils ne savent pas ce qu'ils font"
                "Perdónalos porque no saben que lo que hacen"
                "Oprosti im, jer ne znaju Å¡to čine"
                "Forgive them as they know not what they do"





                Comment


                  Also if DD does not work try this instead

                  cat /dev/mtd/mtd0 > /mnt/sdcard/bootloader
                  cat /dev/mtd/mtd3 > /mnt/sdcard/recovery

                  etc....


                  Bob
                  "Pzebacz im, bo nie wiedzą, co czynią"
                  "Прости им, они не ведают, что творят"
                  "Perdona loro perché non sanno quello che fanno"
                  "Vergib ihnen, denn sie wissen nicht, was sie tun"
                  "Vergeef hen want ze weten niet wat ze doen"
                  "Pardonne-leur car ils ne savent pas ce qu'ils font"
                  "Perdónalos porque no saben que lo que hacen"
                  "Oprosti im, jer ne znaju Å¡to čine"
                  "Forgive them as they know not what they do"





                  Comment


                    not sure if this is helpful or not but this is from a dmsg dump i did awhile back..

                    <5>[ 1.368842] Creating 1 MTD partitions on "C revision NAND 4GiB MT29F32G-C":
                    <5>[ 1.368855] 0x000000000000-0x000000400000 : "bootloader"
                    <4>[ 1.369937] bus_cycle=17, bus_timing=10, start_cycle=10, end_cycle=10,system=5.2ns
                    <4>[ 1.369969] No NAND device found.
                    <4>[ 1.369990] NAND device id: 2c 68 4 4a a9 0
                    <6>[ 1.370003] NAND device: Manufacturer ID: 0x2c, Chip ID: 0x2c (Micron C revision NAND 4GiB MT29F32G-C)
                    <6>[ 1.370026] 1 NAND chips detected
                    <4>[ 1.370134] bus_cycle=4, bus_timing=5, start_cycle=5, end_cycle=6,system=5.2ns
                    <4>[ 1.370147] oob size is not enough for selected bch mode: NAND_BCH60_1K_MODE force bch to mode: NAND_BCH30_1K_MODE
                    <4>[ 1.375619] aml nand env valid addr: 606000
                    <6>[ 1.413412] nand env: nand_env_probe.
                    <5>[ 1.413987] Creating 8 MTD partitions on "C revision NAND 4GiB MT29F32G-C":
                    <5>[ 1.414007] 0x000000c00000-0x000001400000 : "logo"
                    <5>[ 1.414810] 0x000001400000-0x000001c00000 : "aml_logo"
                    <5>[ 1.415582] 0x000001c00000-0x000002400000 : "recovery"
                    <5>[ 1.416307] 0x000002400000-0x000002c00000 : "boot"
                    <5>[ 1.417058] 0x000002c00000-0x000022c00000 : "system"
                    <4>[ 1.417077] NAND bbt detect Bad block at 5a00000
                    <5>[ 1.417885] 0x000022c00000-0x00002ac00000 : "cache"
                    <5>[ 1.418659] 0x00002ac00000-0x00004ac00000 : "userdata"
                    <5>[ 1.419445] 0x00004ac00000-0x000100000000 : "NFTL_Part"

                    Notice the bad nand block .. lol ..
                    Last edited by bryman777; 05 January 2013, 07:10.

                    Comment


                      Originally posted by Finless View Post
                      Also if DD does not work try this instead

                      cat /dev/mtd/mtd0 > /mnt/sdcard/bootloader
                      cat /dev/mtd/mtd3 > /mnt/sdcard/recovery

                      etc....

                      Bob
                      Okay, I had the following in a text file that I had tried a while back with no luck:
                      dd if=/dev/block/mtdblock0 of=/sdcard/bootloader.img
                      dd if=/dev/block/mtdblock1 of=/sdcard/logo.img
                      dd if=/dev/block/mtdblock2 of=/sdcard/aml_logo.img
                      dd if=/dev/block/mtdblock3 of=/sdcard/recovery.img
                      dd if=/dev/block/mtdblock4 of=/sdcard/boot.img
                      dd if=/dev/block/mtdblock5 of=/sdcard/system.img
                      dd if=/dev/block/mtdblock6 of=/sdcard/cache.img
                      dd if=/dev/block/mtdblock7 of=/sdcard/userdata.img
                      dd if=/dev/block/mtdblock8 of=/sdcard/NFTL_Part.img


                      I ran it again as superuser, and it still didn't work, so I ran the following instead:

                      cat /dev/mtd/mtd0 /mnt/sdcard/bootloader
                      cat /dev/mtd/mtd4 /mnt/sdcard/boot
                      cat /dev/mtd/mtd5 /mnt/sdcard/system
                      cat /dev/mtd/mtd3 /mnt/sdcard/recovery
                      cat /dev/mtd/mtd1 /mnt/sdcard/logo
                      cat /dev/mtd/mtd2 /mnt/sdcard/aml_logo


                      and now I have a 200MB zip file to send you. How am I going to do that?

                      BTW, the sizes of the individual files are as follows:

                      bootloader (4,096KB)
                      boot (8,192KB)
                      system (524,288KB)
                      recovery (8,192KB)
                      logo (8,192KB)
                      aml_logo (8,192KB)


                      Do these file sizes seem right?

                      EDIT: According to bryman's last post, the file sizes look right to me:

                      0x000000000000-0x000000400000 : "bootloader" = 4,194,304 = 4,096KB
                      0x000000c00000-0x000001400000 : "logo" = 8,388,608 = 8,192KB
                      0x000001400000-0x000001c00000 : "aml_logo" = 8,388,608 = 8,192KB
                      0x000001c00000-0x000002400000 : "recovery" = 8,388,608 = 8,192KB
                      0x000002400000-0x000002c00000 : "boot" = 8,388,608 = 8,192KB
                      0x000002c00000-0x000022c00000 : "system" = 536,870,912 = 524,288KB
                      Last edited by eegorr; 05 January 2013, 07:40.
                      Nextbook Premium 8 SE (Next8P12) - * ROOTED * (Sold on ****)
                      AML8726-M3 Cortex A9 @ 1GHz

                      Nextbook Premium 8 HD (N0008HD8G) - * ROOTED *

                      Nextbook 8 (NX785QC8G) - STOCK (unfortunately)

                      Comment


                        you can get a drop box account here . its free . https://www.dropbox.com/ .. then upload them .. thanks bro .. you rock !!!! im not sure about the filesizes .. but it looks good to me ..

                        Comment


                          This forum thread reeks of progress today, someone light a match or something!

                          Comment


                            I put the files on my Google drive and it is syncing now. Can you guys see the files here:


                            EDIT: Since Bob has already downloaded these files, I just made this folder private. They are really useless to anyone else. If someone needs access to them, let me know.
                            Last edited by eegorr; 06 January 2013, 23:44.
                            Nextbook Premium 8 SE (Next8P12) - * ROOTED * (Sold on ****)
                            AML8726-M3 Cortex A9 @ 1GHz

                            Nextbook Premium 8 HD (N0008HD8G) - * ROOTED *

                            Nextbook 8 (NX785QC8G) - STOCK (unfortunately)

                            Comment


                              Opening link from my nexus 7 takes me to my own Drive account, might be different from computer but I'm not near my desktop at the moment to check.

                              Comment


                                I just looked, I believe you have to make it public or take privacy off, im not sure how to do that. but it will take awhile to upload and sync .. i have a 2mb upload, it took me about 20 minutes to upload a similar size file to drop box ..

                                Comment

                                Working...
                                X