« A simple su implementation in C | Home | Compose key not working with iBus »

By admin | November 24, 2012

Skip to the rooting process, if you wish.

The iPPea TV is a pretty neat gadget, to say the least. The USB-stick sized device features a full Android 4.0.3 OS, a 1Ghz Ingenic JZ4770 MIPS processor (complete with FPU!), 512 MB of RAM, 2 GB flash storage, and about 800 MB of internal memory. Overall, it is pretty impressive for only $65. Having received it about three weeks ago for use in the development of the MIPS port of VLC Android, I’ve been meaning to write about this device. Now that I’ve received this device and have time to write, let’s take a look at what’s in it.

The iPPea comes in its own packaging, in addition to the 3D gyroscopic remote offered by Option B.

The iPPea comes with some packaging.

So, after unpacking, we are ready to play with the iPPea. The iPPea simply “plugs in” to any HDMI-enabled TV, just like how a USB stick plugs into a computer. It doesn’t take too long to boot up, about 15-25 seconds-ish (I did not time this).

Just a curious note here, the iPPea claims to support full 1080p, but my television reports it to be 720p. I did not notice any lack of quality though, the picture was still very clear and not pixellated.

The iPPea boots into a full Android 4.0.3 installation, as mentioned before, with the twist that it runs a MIPS processor. It also features full wifi, which we will use in some diagnostics. Here are the /proc/cpuinfo and Android Sysinfo dumps for the iPPea TV:

system type : JZ4770 processor : MIPS-compatible processor JZ4770 cpu model : Ingenic XBurst BogoMIPS : 1001.88 wait instruction : yes microsecond timers : no tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : yes, count: 1, address/irw mask: [0x0fff] ASEs implemented : mxu shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available Features : fpu mxu CPU implementer : Ingenic CPU architecture : MIPS Hardware : linden Revision : 0005 Serial : 0000000000000000 EFUSE0 : d075370b EFUSE1 : 02c00811 EFUSE2 : fc460000 EFUSE3 : 8a54c84f EFUSE4 : 00000000 EFUSE5 : 00000000 EFUSE6 : 00000000 EFUSE7 : 00000000

…and the Sysinfo dump:

ID=IML74K Product=linden Device=linden Board=unknown CPU ABI=mips CPU ABI 2=mips-r2 Manufacturer=ingenic Brand=Ingenic Model=iPPea Type=eng Tags=test-keys Finger Print=Ingenic/linden/linden:4.0.3/IML74K/eng.spark.20120901.003556:eng/test-keys Time=1346431472000 User=spark Host=spark Hardware=linden Radio=unknown Bootloader=unknown Incremental Version=eng.spark.20120901.003556 Release Version=4.0.3 SDK Version=15

Rooting the iPPea TV

Curiously, the iPPea comes with busybox built-in into the image. This will make working with the iPPea easier, as we don’t have to compile/download busybox and deploy it – full access to all the busybox tools is available by default.

But what makes rooting really easy is the fact that the makers of the iPPea handed the blessing of leaving ro.secure off. This means that a simple adb connection is enough to grant root access – all that we have to do is install a su binary.

Unfortunately, the busybox su requires too much baggage of the traditional Linux system – notably /etc/passwd, /etc/groups and friends to work. Since this is a MIPS system and Superuser.apk is contains an ARM binary, that approach cannot work either. In addition, compiling su-binary from Superuser.apk requires the entire AOSP tree, which is too much work and network bandwidth for us. So, we will use a portable C implementation of su instead.

This step does require you to plug in the iPPea into a computer with ADB, so be prepared to do so. You will also need this prebuilt portable MIPS Android su binary. Skip over these steps if you are using the prebuilt binary (these are instructions to compile it yourself with the Android NDK):

export ANDROID_NDK=/opt/android-ndk-r8c # set as you need $ANDROID_NDK/toolchains/mipsel-linux-android-4.6/prebuilt/linux-x86/bin/mipsel-linux-android-gcc --sysroot=$ANDROID_NDK/platforms/android-9/arch-mips -g su.c -o su

Now that you have the ‘su’ binary handy as well as your iPPea detected in adb (adb devices, you may need to chown it to make it visible), here we go:

adb push su /dev/ adb shell # now we are on the iPPea busybox mount -o remount,rw /system busybox mv /dev/su /system/bin/su busybox chmod 4755 /system/bin/su busybox mount -o remount,ro /system exit # now we are back to our computer adb reboot # to reboot

At this point we can put the iPPea back on the TV. If we open Term.apk and put in “su” and press Enter, we should have root:

And of course, once we have root access, the opportunities increase without bound – chrooted Debian/Linux, Android apps that require root, reformat and reflash with a custom ROM – the sky becomes the limit. We do, however, owe many thanks (and this is not meant to be sarcastic) to iPPea for leaving ro.secure at 0, allowing hobbyists to make better use of the hardware (which in itself is very neat).

If you found this article helpful or interesting, please help Compdigitec spread the word. Don’t forget to subscribe to Compdigitec Labs for more useful and interesting articles!

Topics: Linux, Mobile | 17 Comments »

Comments