How to Root the TVPad09 Jan 2015 · Comments
The TVPad M120/M121(S) models can be easily rooted. Please only follow and execute these instructions on your own risk (you might brick your TVPad).
The goal is to get root access via telnet. I will based this howto on the M121S model running firmware 3.06. The same method can be applied for the other models with minimal changes.
The trick is to exploit the firmware upgrade process by providing a custom firmware. To create a custom firmware, obtain a newer or a same version firmware. For the M121S model running 3.06, a quick google search by the names of
creatent_usb_update_m121_3311_gvos2.tar provides a newer 3.26 firmware. Make sure to get the the correct firmware for the appropriate model. The firmware tar file can be decompressed and unarchived.
> file creatent_usb_update_M121S_3311_GVOS2.tar creatent_usb_update_M121S_3311_GVOS2.tar: gzip compressed data, from Unix, last modified: Sun Nov 25 22:56:07 2012 > tar xf creatent_usb_update_M121S_3311_GVOS2.tar > ls home linux.rom ramdisk.rom tcboot.rom > file ramdisk.rom ramdisk.rom: Linux rev 1.0 ext2 filesystem data, UUID=339d0c45-1592-4ed4-86c4-8382f9520add
The firmware archive contains a couple files. The ones of interest are the
ramdisk.rom file and the
version files under
ramdisk.rom file contains the Linux image to be flashed on the TVPad and is a ext2 filesystem image, which can be mounted and modified. The
version files are text files with the firmware version string.
> mkdir tmp > mount ramdisk.rom tmp > ls tmp backup bin dev etc home lib linuxrc lost+found mnt proc program root sbin storage sys tmp usr
Once mounted, the following files will be modified to provide a known root password, enable telnetd, and customize firmware version number. The firmware version number get checked during the upgrade. The TVPad will only run the upgrade if the version files in the custom firmware is greater than the version on the system.
./home/program/data/version ./home/config/version ./tmp/etc/passwd ./tmp/etc/init.d/rc.demo > cat ./home/program/data/version 3.26 > cat ./home/config/version 3.26 > cat ./tmp/etc/passwd root:$1$qacY87Qt$G7PaT7/IPNNaJPBFKhVh1.:0:0:root:/:/bin/sh nobody:x:1000:1000:Linux User,,,:/home/nobody:/bin/sh guest:x:1001:1001:Linux User,,,:/home/guest:/bin/sh
For the version files, simply open them in a text editor and change the version string to a higher number than the running version on the TVPad. For the
passwd file, the line with the root user and
crypt generated password needs to be replaced with a known
crypt password. For the curious, the
$1$qacY87Qt$G7PaT7/IPNNaJPBFKhVh1. denotes a MD5 hashed password where
qacY87Qt is the salt and
G7PaT7/IPNNaJPBFKhVh1. the hashed salted password.
On an Ubuntu system, a
crypt MD5 password can be generated with
> md5pass mynewpass $1$1pWj.JV5$u4m/ols.hiWcCrBb/A.Fo/ > cat ./tmp/etc/passwd root:$1$1pWj.JV5$u4m/ols.hiWcCrBb/A.Fo/:0:0:root:/:/bin/sh nobody:x:1000:1000:Linux User,,,:/home/nobody:/bin/sh guest:x:1001:1001:Linux User,,,:/home/guest:/bin/sh
With the new known
crypt password for
mynewpass in the
tmp/etc/passwd file, the root user can now be accessed.
tmp/etc/init.d/rc.demo file runs when the system boots. Its job is to initialize services on the TVPad. One of the service is telnetd (the telnet daemon). For the 3.26 firmware, telnetd is disabled by default. To enable it, open
tmp/etc/init.d/rc.demo in a text editor and search for
telnetd. There should be two instances commented out, i.e.
# telnetd. Remove the
# in front of
telnetd and save the file.
After editing all the above files, unmount
ramdisk.rom and repackage using the same file name as the downloaded firmware. In this example,
creatent_usb_update_m121_3311_gvos2.tar for M121S version 3.26.
> sudo umount tmp > tar cf - home linux.rom ramdisk.rom tcboot.rom | gzip > creatent_usb_update_m121_3311_gvos2.tar # note using tar czf creatent_usb_update_m121_3311_gvos2.tar ./* doesn't work. The upgrade process does not like the tar file provided by it.
Copy the repackaged custom firmware tar file to the root of a USB stick. Plug the USB stick into the TVPad, go to Settings -> Upgrade and run. The upgrade process will detect the firmware in USB stick and use it for the upgrade. Once the upgrade process completes, telnet should be accessible.
> telnet 192.168.1.146 Trying 192.168.1.146... Connected to 192.168.1.146. Escape character is '^]'. (none) login: root Password: BusyBox v1.16.0 (2010-10-27 13:14:24 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. ~ # ls GVOS_USER_ID backup dev home linuxrc mnt program sbin sys usr Settings bin etc lib lost+found proc root storage tmp var ~ #
Have fun poking around the TVPad.