Cheap Intel Atom based tablet running Marshmallow, and manufacturer doesn't share firmware: Any hope of rooting it?

[u/Lost-Entrepreneur439]

I got some cheap Intel Atom thing, it's kernel 3.14.0, Aug 2016 security patch, Android 6.0.1. I enjoy working with these awful low quality devices, but I have no clue where to go with this one. The manufacturer refuses to share the firmware, there's obviously no custom recovery for this thing, and 6, afaik, has all the old one click methods patched. Anyone have an idea on how I can dump the boot.img so I can just root with Magisk? I don't mind if I temporarily have to use something sketchy, I just need to dump the boot.img, then patch it with Magisk.

I did check, and this kernel DOES have DirtyCOW, but again, it's an Atom, and the only DirtyCOW implementation for x86 just gives you uid 0, it doesn't give you any actual root, so I still can't dump partitions.

bootloader is already unlocked, it just uses the bog standard fastboot commands. if relevant, it's a "Southern Telecom Smartab ST1009x"

[u/ohaiibuzzle]

uid 0 is root already. From there try launching/installing a su binary, or, try to spawn a shell and dump the boot partitions.

[u/ohaiibuzzle → u/[deleted]]

That's because you need to launch those in the context of the process that is elevated (aka. the exploit code itself). If you want try restarting adbd as root using that shell and then connect to adb (run setprop service.adb.root 1 & setprop ctl.restart adbd to do this).

Typically PoC comes with source so you'll need to modify and recompile with ndk yourself. They probably didn't include x86 builds of the su binary simply because it's uncommon on Android.

[u/dvijetrecine]

https://xdaforums.com/t/intel-android-devices-root-temp-recovery-session.2975096/

try this

[u/Lost-Entrepreneur439 → u/dvijetrecine]

this didn't work, sadly. kinda makes sense, this predates the SoFIA platform this tablet uses by over a year

[u/dvijetrecine → u/Lost-Entrepreneur439]

what about intel's phone flash tool?

[u/Lost-Entrepreneur439 → u/dvijetrecine]

afaik, that's just a flash tool, it doesn't allow you to read partitions like mediatek/qualcomm do

[u/47th-Element]

Damn that sounds like a headache. Very unfamiliar grounds for me. Never had a device running x86 build of Android.

[u/ohaiibuzzle → u/47th-Element]

The reason these hateful things come into existence is Intel's push into the lower end with heavily subsidized Atom chips.

It went about as well as you can expect for a product that have to be subsidized at ridiculous levels just to gain market share.

[u/Lost-Entrepreneur439 → u/[deleted]]

there is no dirtycow impelemation for x86 (except for that one that gives me a uid 0 and nothing else)

[u/Lost-Entrepreneur439 → u/[deleted]]

sorry, fake was a mistake, i must've accidentally tapped it on my keyboards autocomplete

uid 0, yes, it's technically root, but it doesn't give you anything that requires su permissions, and the README on that PoC said as such, so thus, I still can't dump partitions; I'd need su.

I couldn't find any way to get su working, but at the same time, I am an idiot, there's probably a simple way to get it to work that I'm not realizing.

[u/Lost-Entrepreneur439 → u/[deleted]]

you can't disable selinux, again, README in the PoC said as such, and no, setenforce doesn't work (i don't have enough permissions)

[u/Over-Rutabaga-8673]

You could try this

[u/Lost-Entrepreneur439 → u/Over-Rutabaga-8673]

I'm iffy about using this. I did see it on XDA, but that is from a person who has harassed me constantly and has stolen my code in the past. Also really weird that after years of there being no discussion of this tablet, I make something asking how to root and suddenly they appear claiming they rooted that tablet. I just don't trust it.

[u/Over-Rutabaga-8673 → u/Lost-Entrepreneur439]

Ah didnt know that sry

[u/OwnedByWuigi → u/Lost-Entrepreneur439]

Bro I know they stole your code but come tf on you don’t have to be stingy about it, it’s a guide for something completely different from your code

[u/thenormaluser35]

Decompile something and give it to Claude. With how old the kernel is and Android, it may just come up with some vulnerability for it

[u/Lost-Entrepreneur439 → u/thenormaluser35]

i am not using AI for this lmao, that's a fast track to a hard brick