How to Root the TVPad

The TVPad M120/M121(S) models can be easily rooted. Please only follow and execute these instructions on your own risk (you might brick your TVPad).

The goal is to get root access via telnet. I will based this howto on the M121S model running firmware 3.06. The same method can be applied for the other models with minimal changes.

The trick is to exploit the firmware upgrade process by providing a custom firmware. To create a custom firmware, obtain a newer or a same version firmware. For the M121S model running 3.06, a quick google search by the names of creatent_usb_update_m121_3311_gvos2.tar provides a newer 3.26 firmware. Make sure to get the the correct firmware for the appropriate model. The firmware tar file can be decompressed and unarchived.

> file creatent_usb_update_M121S_3311_GVOS2.tar
creatent_usb_update_M121S_3311_GVOS2.tar: gzip compressed data, from Unix, last modified: Sun Nov 25 22:56:07 2012

> tar xf creatent_usb_update_M121S_3311_GVOS2.tar
> ls
home  linux.rom  ramdisk.rom  tcboot.rom

> file ramdisk.rom
ramdisk.rom: Linux rev 1.0 ext2 filesystem data, UUID=339d0c45-1592-4ed4-86c4-8382f9520add

The firmware archive contains a couple files. The ones of interest are the ramdisk.rom file and the version files under home. The ramdisk.rom file contains the Linux image to be flashed on the TVPad and is a ext2 filesystem image, which can be mounted and modified. The version files are text files with the firmware version string.

> mkdir tmp
> mount ramdisk.rom tmp
> ls tmp
backup  bin  dev  etc  home  lib  linuxrc  lost+found  mnt  proc  program  root  sbin  storage  sys  tmp  usr

Once mounted, the following files will be modified to provide a known root password, enable telnetd, and customize firmware version number. The firmware version number get checked during the upgrade. The TVPad will only run the upgrade if the version files in the custom firmware is greater than the version on the system.


> cat ./home/program/data/version

> cat ./home/config/version

> cat ./tmp/etc/passwd
nobody:x:1000:1000:Linux User,,,:/home/nobody:/bin/sh
guest:x:1001:1001:Linux User,,,:/home/guest:/bin/sh

For the version files, simply open them in a text editor and change the version string to a higher number than the running version on the TVPad. For the passwd file, the line with the root user and crypt generated password needs to be replaced with a known crypt password. For the curious, the crypt string $1$qacY87Qt$G7PaT7/IPNNaJPBFKhVh1. denotes a MD5 hashed password where qacY87Qt is the salt and G7PaT7/IPNNaJPBFKhVh1. the hashed salted password.

On an Ubuntu system, a crypt MD5 password can be generated with md5pass.

> md5pass mynewpass

> cat ./tmp/etc/passwd
nobody:x:1000:1000:Linux User,,,:/home/nobody:/bin/sh
guest:x:1001:1001:Linux User,,,:/home/guest:/bin/sh

With the new known crypt password for mynewpass in the tmp/etc/passwd file, the root user can now be accessed.

The tmp/etc/init.d/rc.demo file runs when the system boots. Its job is to initialize services on the TVPad. One of the service is telnetd (the telnet daemon). For the 3.26 firmware, telnetd is disabled by default. To enable it, open tmp/etc/init.d/rc.demo in a text editor and search for telnetd. There should be two instances commented out, i.e. # telnetd. Remove the # in front of telnetd and save the file.

After editing all the above files, unmount ramdisk.rom and repackage using the same file name as the downloaded firmware. In this example, creatent_usb_update_m121_3311_gvos2.tar for M121S version 3.26.

> sudo umount tmp
> tar cf - home linux.rom ramdisk.rom tcboot.rom | gzip > creatent_usb_update_m121_3311_gvos2.tar

# note using tar czf creatent_usb_update_m121_3311_gvos2.tar ./* doesn't work. The upgrade process does not like the tar file provided by it.

Copy the repackaged custom firmware tar file to the root of a USB stick. Plug the USB stick into the TVPad, go to Settings -> Upgrade and run. The upgrade process will detect the firmware in USB stick and use it for the upgrade. Once the upgrade process completes, telnet should be accessible.

> telnet
Connected to
Escape character is '^]'.

(none) login: root

BusyBox v1.16.0 (2010-10-27 13:14:24 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ # ls
GVOS_USER_ID  backup        dev           home          linuxrc       mnt           program       sbin          sys           usr
Settings      bin           etc           lib           lost+found    proc          root          storage       tmp           var
~ #

Have fun poking around the TVPad.