ao2.it
Antonio Ospite, theorist attacks

I got a Teclast X98 Air 3G tablet from Aliexpress, it costed 168 € ( with free shipping) and has a high-definition screen and it's an Intel Bay Trail device; so Android, x86 architecture, 2GiB of RAM and 32 GiB of storage on EMMC.

I think the product has some minor design issues:

• the speakers are on the same side, the short side, not great when watching videos, but you want headphones or external speakers for better sound anyway;
• when displaying content with a white background at medium brightness, the screen shows some —very light— yellowish gradient;
• when using the leather cover the SIM slot and the MicroSD slot cannot be accessed, they are, well, covered;
• the device does not rotate the screen automatically when booted in landscape mode, the android login screen is shown always in portrait mode at boot; this is inconvenient when booting the tablet while it's on the desk; BTW the firmware screens and the boot logos are also always shown in portrait mode, I guess that's OK for a tablet, but I would have picked a logo with some radial symmetry, or maybe drawn it at an angle, in order to alleviate the feeling of wrong orientation when booting with the device in landscape orientation;
• the UEFI firmware informative screen is shown at boot, giving the boot experience and old PC feeling, or maybe I should say classic or familiar, I am not sure; this can be disabled in the firmware settings tho;

but beside that it's not bad considering the price, it's got HDMI output, 3G and a MicroSD slot (yeah, I'm lookin' right atch-ya, Google Nexuses...).

I eventually intend to run Debian on it, but let's take a look at the specs and do a full backup first.

Hardware and kernel support

Some info about the CPU:

ao2@localhost:~/WIP/Teclast $ adb shell cat /proc/cpuinfo | grep model\ name | uniq
model name      : Intel(R) Atom(TM) CPU  Z3736F @ 1.33GHz

On Debian unstable adb is available in the android-tools-adb package.

Here is the full dmesg log.

It's pretty easy to get it, as the device came pre-rooted:

ao2@localhost:~/WIP/Teclast $ adb root
ao2@localhost:~/WIP/Teclast $ adb shell dmesg > dmesg-Teclast_X98_Air_3G.log

UEFI firmware backup (with flashrom)

The firmware configuration menu (Aptio Setup Utility) can be accessed by pressing ESC or DEL on a USB keyboard connected to the USB OTG adapter.

The version I have reports these informations:

BIOS Vendor                    American Megatrends
Core version                    5.008
Compliancy                      UEFI 2.3; PI 1.2
Project Version	                A3G069 1.01 x64
Build Date and Time	        08/29/2014 09:41:04
...

There are newer firmware versions available on the net, so if I am going to test them it's better to save the one I have right now.

Get and compile flashrom on an x86 host:

ao2@localhost:~/WIP/Teclast $ git svn clone svn://flashrom.org/flashrom/trunk flashrom
ao2@localhost:~/WIP/Teclast $ cd flashrom
ao2@localhost:~/WIP/Teclast/flashrom $ make NEED_FTDI=no NEED_USB=no CFLAGS=-static LDFLAGS=-static

Copy it on the target device and read the firmware:

  
ao2@localhost:~/WIP/Teclast/flashrom $ adb push flashrom /data
ao2@localhost:~/WIP/Teclast/flashrom $ cd ..
ao2@localhost:~/WIP/Teclast $ adb root
ao2@localhost:~/WIP/Teclast $ adb shell
root@x98air3g_c6j6:/ # cd /data
root@x98air3g_c6j6:/data # ./flashrom -p internal -r Teclast_X98_Air_3G_IFWI_flashrom_dump.rom
flashrom v0.9.7-r1854 on Linux 3.10.20-g4a0098e-dirty (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OK.
No DMI table found.
Found chipset "Intel Bay Trail". 
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware with it,
then please email a report to flashrom@flashrom.org including a verbose (-V) log.
Thank you!
Enabling flash write... OK.
Found Winbond flash chip "W25Q64.W" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Reading flash... done.

root@x98air3g_c6j6:/data # exit
ao2@localhost:~/WIP/Teclast $ adb pull /data/Teclast_X98_Air_3G_IFWI_flashrom_dump.rom

So flashrom can read the flash memory just fine, I haven't tried to write it yet, but I think I'll do it soon. Since it's an SPI flash there is a chance that it's reasonably easy to re-program it with an external programmer in case of a brick. I haven't taken the device apart yet to see what physical package the flash chip uses.

EMMC backup

The EMMC contains a GPT, the available partitions can be listed following the approach in this post, we get this:

unit :  sectors
/dev/mmcblk0p1   :  start    =  40,       size  =  131072,    Id=XX
/dev/mmcblk0p2   :  start    =  131112,   size  =  131072,    Id=XX
/dev/mmcblk0p3   :  start    =  262184,   size  =  32768,     Id=XX
/dev/mmcblk0p4   :  start    =  294952,   size  =  32768,     Id=XX
/dev/mmcblk0p5   :  start    =  327720,   size  =  32768,     Id=XX
/dev/mmcblk0p6   :  start    =  360488,   size  =  32768,     Id=XX
/dev/mmcblk0p7   :  start    =  393256,   size  =  131072,    Id=XX
/dev/mmcblk0p8   :  start    =  524328,   size  =  65536,     Id=XX
/dev/mmcblk0p9   :  start    =  589864,   size  =  32768,     Id=XX
/dev/mmcblk0p10  :  start    =  622632,   size  =  32768,     Id=XX
/dev/mmcblk0p11  :  start    =  655400,   size  =  32768,     Id=XX
/dev/mmcblk0p12  :  start    =  688168,   size  =  2097152,   Id=XX
/dev/mmcblk0p13  :  start    =  2785320,  size  =  65536,     Id=XX
/dev/mmcblk0p14  :  start    =  2850856,  size  =  2097152,   Id=XX
/dev/mmcblk0p15  :  start    =  4948008,  size  =  56115160,  Id=XX

And the corresponding partition labels are:

ao2@localhost:~/WIP/Teclast $  adb shell 'ls -l /dev/block/platform/intel/by-label/' | sort -t '>' -k 2.21n | column -t
lrwxrwxrwx  root  root  2014-11-20  13:38  ESP         ->  /dev/block/mmcblk0p1
lrwxrwxrwx  root  root  2014-11-20  13:38  reserved    ->  /dev/block/mmcblk0p2
lrwxrwxrwx  root  root  2014-11-20  13:38  boot        ->  /dev/block/mmcblk0p3
lrwxrwxrwx  root  root  2014-11-20  13:38  recovery    ->  /dev/block/mmcblk0p4
lrwxrwxrwx  root  root  2014-11-20  13:38  fastboot    ->  /dev/block/mmcblk0p5
lrwxrwxrwx  root  root  2014-11-20  13:38  reserved_1  ->  /dev/block/mmcblk0p6
lrwxrwxrwx  root  root  2014-11-20  13:38  test        ->  /dev/block/mmcblk0p7
lrwxrwxrwx  root  root  2014-11-20  13:38  panic       ->  /dev/block/mmcblk0p8
lrwxrwxrwx  root  root  2014-11-20  13:38  factory     ->  /dev/block/mmcblk0p9
lrwxrwxrwx  root  root  2014-11-20  13:38  misc        ->  /dev/block/mmcblk0p10
lrwxrwxrwx  root  root  2014-11-20  13:38  config      ->  /dev/block/mmcblk0p11
lrwxrwxrwx  root  root  2014-11-20  13:38  cache       ->  /dev/block/mmcblk0p12
lrwxrwxrwx  root  root  2014-11-20  13:38  logs        ->  /dev/block/mmcblk0p13
lrwxrwxrwx  root  root  2014-11-20  13:38  system      ->  /dev/block/mmcblk0p14
lrwxrwxrwx  root  root  2014-11-20  13:38  data        ->  /dev/block/mmcblk0p15

I didn't have an empty MicroSD card handy, so I used an external hard drive connected to the USB OTG adapter to strore the backups, I had to use adb via TCP/IP:

ao2@localhost:~/WIP/Teclast $ adb tcpip
ao2@localhost:~/WIP/Teclast $ adb connect 192.168.0.99
ao2@localhost:~/WIP/Teclast $ adb root
ao2@localhost:~/WIP/Teclast $ adb shell

And I ran this script:

#!/system/bin/sh

# The data partition is more than 20GiB, let's skip it.
find /dev/block/platform/intel/by-label -type l | grep -v '/data$' |
while read partition;
do
  OUTPUT_FILE="/storage/usbcard1/$(basename "$partition").img"

  echo "Dumping '$partition' to '$OUTPUT_FILE'"
  dd if="$partition" of="$OUTPUT_FILE"
done

First quick inspection

There are some Android bootimgs (boot, fastboot, recovery) which can be modified with these Bootimg-scripts, I noticed that the kernel is compiled for a 32-bit architecture.

Some ext4 filesystems (cache, config, factory, logs, system).

Some raw data partitions (misc, panic, reserved_1, reserved, test).

The ESP partition is the UEFI boot partition (EFI System Partition), it's a FAT32 filesystem and can be loop-mounted with no problems.

A quick analysis with binwalk shows that this partition contains some 800x1000 bitmaps:

ao2@localhost:~/WIP/Teclast $ binwalk ESP.img 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1051648       0x100C00        Microsoft portable executable
1149888       0x118BC0        PC bitmap, Windows 3.x format, 800 x 1000 x 24
2465927       0x25A087        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size
3620864       0x374000        Microsoft portable executable
3676128       0x3817E0        PC bitmap, Windows 3.x format, 800 x 1000 x 24
4992167       0x4C2CA7        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size
6100480       0x5D1600        Microsoft portable executable
6198720       0x5E95C0        PC bitmap, Windows 3.x format, 800 x 1000 x 24
7514759       0x72AA87        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size

The pictures can be spotted with a really rough approach using rawtoppm from netpbm:

  ao2@localhost:~/WIP/Teclast $ rawtoppm -bgr 800 $(($(stat -c "%s" ESP.img) / 3 / 800)) ESP.img > ESP.ppm

It turns out that all the three pictures are equal: it's the logo shown at boot right after the UEFI firmware screen.

The logo is contained once in each of the EFI binaries:

ao2@localhost:~/WIP/Teclast $ mkdir ESP
ao2@localhost:~/WIP/Teclast $ sudo mount -o loop ESP.img ESP/
ao2@localhost:~/WIP/Teclast $ find ESP/
ESP/
ESP/EFI
ESP/EFI/Intel
ESP/EFI/Intel/Data
ESP/EFI/Intel/efilinux.efi
ESP/EFI/Intel/warmdump.efi
ESP/EFI/BOOT
ESP/EFI/BOOT/bootx64.efi
ao2@localhost:~/WIP/Teclast $ binwalk ESP/EFI/BOOT/bootx64.efi

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Microsoft portable executable
98240         0x17FC0         PC bitmap, Windows 3.x format, 800 x 1000 x 24
1414279       0x159487        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size

ao2@localhost:~/WIP/Teclast $ dd if=ESP/EFI/BOOT/bootx64.efi of=boot_logo.bmp skip=$((0x0017fc0)) count=$((800 * 1000 * 3 + 0x36)) iflag=count_bytes,skip_bytes
ao2@localhost:~/WIP/Teclast $ sudo umount ESP

I guess the logo can be pretty easily replaced with a custom one, but I haven't done that yet.

Maybe the EFI binaries just display the logo and then boot an Android boot image from the right partition, depending on the boot option.

The tablet has three boot options:

1. normal boot (just quick press the power button);
2. DROIDBOOT PROVISION OS (quick press the power button and keep pressed for a while the volume-down key);
3. DnX mode, accepting fastboot commands (quick press the power button and keep pressed both volume keys for a while);

and there are three efi binaries, are these things connected?

I need to learn more about how this UEFI thing works in order to confirm that.

Just to conclude the boot-logos-analysis™, the device shows three logos during the boot sequence:

1. the generic Teclast t-pad logo mentioned before;
2. an animated logo referring the X98 Air 3G device, it's in Chinese but it's pretty straightforward to see that, even with zero knowledge of the language;
3. an Intel-Inside logo.

The last two logos are boot animations, fired up one after the other by the bootanim service invoked by the init.rc file that is on the boot partition; the animation data is taken from the system partition, it's in the media/bootanimation.zip file: just PNGs, one per frame.

Pictures attached below.

So after some hours of looking I found that it'd be super easy to customize the root filesystem and even all the logos of the boot sequence; however what I really want to do is to load a custom kernel, but that's meat for another day.

Attached files: 

dmesg-Teclast_X98_Air_3G.log