Tolino Shine 3

Tolino Shine 3: use adb as root

These are the steps I took to get:

$ adb shell
root@ntx_6sl:/ # id
uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)

Disclaimer

I am not responsible if you brick / ruin your device in any way. Basic computer skills required. Proceed with caution. I cannot be held responsible if anything goes wrong.

Prerequisites

  1. I’m working on Ubuntu 21.10 so I’ve to install this package

    apt install abootimg
    
  2. We need a patched adbd which can run as root, so follow these steps.

  3. It could be a good idea to have a full backup.

Procedure

  1. download the right version of your update (for me it’s currently 14.1.0)

    wget https://download.pageplace.de/ereader/14.1.0/alldevices/update.zip
    
  2. extract boot.img

    unzip update.zip boot.img
    
  3. unpack boot.img (we need the initial ramdisk initrd.img)

    abootimg -x boot.img
    
  4. extract the ramdisk in a directory

    mkdir ramdisk
    zcat initrd.img | ( cd ramdisk/ && cpio -imd )
    
  5. modify the ramdisk to enable debug mode, disable secure modes, enable mtp and adb

    cd ramdisk/
    sed -i 's:^ro.secure=1$:ro.secure=0:' default.prop
    sed -i 's:^ro.debuggable=.*$:ro.debuggable=1:' default.prop
    sed -i 's:^persist.sys.usb.config=mass_storage$:persist.sys.usb.config=mtp,adb:' default.prop
    sed -i 's:setprop ro.adb.secure 1:setprop ro.adb.secure 0:' init.rc
    
  6. replace adbd with a patched one which runs with root privileges (let’s suppose it’s in /tmp/adbd.patched, see here)

    cat /tmp/adbd.patched > sbin/adbd
    
  7. recreate the initrd.img

    # we're still working in ramdisk/ directory
    find . ! -name . | LC_ALL="C" sort | cpio -o -H newc -R +0:+0 | gzip -c > ../initrd.img
    cd ..
    
  8. replace the old initrd.img inside boot.img

    abootimg -u boot.img -r initrd.img
    
  9. safely temporarily test the new boot.img, type on the pc

    fastboot boot boot.img
    
  10. reboot Tolino in fastboot mode

  11. test on the pc if adb is running in privileged mode, you should see

    $ adb shell
    root@ntx_6sl:/ # id
    uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)
    
  12. permanently flash the new boot.img, type on the pc

    fastboot flash boot boot.img
    
  13. reboot Tolino in fastboot mode and you shoud see

    $ fastboot flash boot boot.img
    < waiting for any device >
    Sending 'boot' (4376 KB)                           OKAY [  0.146s]
    Writing 'boot'                                     OKAY [  0.437s]
    Finished. Total time: 0.601s
    
  14. after flashing, reboot

    fastboot reboot