home | links | feminist | studies | wishlist | cooking | !blog

Easy root for the Chiligreen E-Board HT400

su -

I recently got a Chiligreen E-Board HT400 tablet from Hofer (Aldi in Germany) to play around with. This is certainly not the greatest hardware around at only 1 GB of RAM and no 3G but still very usable. However, none Clockworkmod recovery image seemed to fit, even the device's USB ID did not match any of the known companies.

$ lsusb | tail -n 1
Bus 001 Device 079: ID 10d6:0c02 Actions Semiconductor Co., Ltd 

If you want to access the device via ADB as a non-root user (recommended), you might want to tell udev to make it readable, e. g. see point 5/6 of this ubuntu forum post by vanquishedangel, or you could just chmod 0666 /dev/bus/usb/xxx/yyy

Root access seemed ever so distant, but fortunately the firmware was not a production one, as I discovered after installing the Android sdk ("Tools only" is enough for using the Android Debug Bridge). Debian GNU/Linux or Ubuntu users could just apt-get install android-tools-adb. There is one catch - the tools don't recognize the "exotic" device out of the box, so you have to enable the device manufacturer ID in your SDK configuration:

wget http://dl.google.com/android/android-sdk_r24.1.2-linux.tgz
tar -xzvf android-sdk_r24.1.2-linux.tgz
mkdir ~/.android
echo 0x10d6 >> ~/.android/adb_usb.ini

Now you just need to enable the USB debugging interface on the phone (you might have to activate the developer options by tapping the "Build Number" in the "Settings" -> "About Tablet" Tab seven times, though they were already enabled on my device). I gather the more powerful options have been disabled in the production images, fortunately that does not hold for this tablet:

$ android-sdk-linux/platform-tools/adb root
restarting adbd as root
$ android-sdk-linux/platform-tools/adb remount
remount succeeded

There is no su binary on the system, but not to despair - Clockwork's Superuser Application has one, you just have to install it into your PATH. Above remount command set your /system directory writeble, so you can just use the one from the App after installing that (right via Google Play):

Clockwork Superuser App

Using a root shell (adb root; adb shell) copy it and enable the suid bit:

# cp /data/data/com.koushikdutta.superuser/files/su /system/bin
# chmod 4755 /system/bin/su
# ls -l /system/bin/su
-rwsr-xr-x root     root       311872 2015-03-23 12:04 su

There! Now any app demanding superuser rights will trigger the Superuser app to ask you, where you can set policies as well, e. g. see above screenshot.
Irritatingly that does not seem to go for adb shell access where su is executed without any confirmation. Hopefully that is due to the privileged interface and not the glaring loopholes?
Please let me know your toughts and experiences!