How to root TVPad2/3

In case no one shared this before, here is how to root the TVPad2 (M233). I never owned a TVPad3 (M358), but I believe this method should work for it as well.

Simply create a file called gvos2-sd1 or gvos2-sd3 on your USB stick and put the following content in it:
#!/bin/sh
echo "root:tvpad" | chpasswd
/usr/sbin/telnetd
/usr/bin/tcpsvd -E 0.0.0.0 21 ftpd -w / &
Now plug the USB stick into your TVPad and you have root access. Simply telnet to port 23 or FTP to port 21 using username root and password tvpad in order to login. Enjoy!

For the lazy ones, here is an app for firmware 3.70 or later.
Post edited by padman on
Thanked by 3tylerlee erdos fadiaz

Comments

  • erdoserdos Junior Member
    edited December 2015
    thanks for the root pkg. the gvos2-sd1 root script works as well, it didn't work at first since i edited it in windows instead of linux.

    now i can telnet into my tvpad2 box, below are the partition info:

    (none) login: root
    Password:
    ~ # ls
    GVOS_USER_ID bin etc init lost+found program sys usr
    Settings config home lib mnt sbin tmp var
    backup dev image linuxrc proc storage tmphome

    ~ # df -h
    Filesystem Size Used Available Use% Mounted on
    /dev/ndda2 512.0M 62.8M 449.2M 12% /image
    /dev/loop0 116.1M 116.1M 0 100% /home
    /dev/ndda3 128.0M 2.5M 125.5M 2% /config
    /dev/ndda5 1024.0M 39.1M 984.9M 4% /program
    /dev/ndda6 1.6G 21.5M 1.5G 1% /storage

    this seems to indicate tvpad has onboard storage of ~4G which runs the applications, though i'm not sure about the function of each partiton. it doesn't seem to be easy to put a custom os such as 'openelec' into the storage through telnet. i think in order to do that, one needs to tether the box with linux machine first...

    here's the guide that i'm trying to follow:
    http://wiki.openelec.tv/index.php/Manual_Installation
    Post edited by erdos on
  • KMKKMK
    edited December 2015
    Here is my version in cpp, tested OK on my TVPad3, same operation as Phantoman but telnet on port 2345.

    #include stdlib.h

    int main()
    {
    system("cd ~");
    system("telnetd -p 2345 -l /bin/sh &");
    system("tcpsvd -E 0.0.0.0 21 ftpd -w / &");
    return 0;
    }
    Working sample here.
  • this seems to indicate tvpad has onboard storage of ~4G which runs the applications, though i'm not sure about the function of each partiton. it doesn't seem to be easy to put a custom os such as 'openelec' into the storage through telnet. i think in order to do that, one needs to tether the box with linux machine first...

    here's the guide that i'm trying to follow:
    http://wiki.openelec.tv/index.php/Manual_Installation
    You are correct. Not going to be easy. At least I had many sleepless nights trying to find a way to put Android on TVPad1/2/3. Probably not going to help you with your Openelec project, but for Android I found an interesting article which is mostly related to TVPad2/3 (tcc8925 chipset): http://www.cnx-software.com/2012/08/22/how-to-create-a-custom-android-firmware-for-cx-01/ . Never got much further with it since I never figured out how to put the TVPad2 into FWDN mode (bricked a perfectly working unit trying to figure that out). So I called it quits. I am a Windows guy though, so maybe for some Linux wizard it's a piece of cake.
  • tvbolontvbolon Junior Member
    Phantoman,
    Hope you doing well, not sure if you going to make a FW to give root access for pad2 and pad3 like the one you did for tvpad1? or it's impossible to do it? thanks
  • Phantoman,
    Hope you doing well, not sure if you going to make a FW to give root access for pad2 and pad3 like the one you did for tvpad1? or it's impossible to do it? thanks
    No, I am not planning to. It's too much work. I do not see any added benefits over what we currently have.
  • edited January 2016
    Btw, just to expand a bit on my previous reply. A few issues with TVPad2/3 firmwares are (that I remember from the top of my head):
    • The header of the firmware contains a hash. So if you change anything in the firmware you would need to calculate a new hash.
    • They use CRAMFS which is a read-only filesystem.
    • They check the hash of the carmfs image file to see if it has been modified.
    If I remember correctly, we solved all these problems in the past (lost with clubtvpad forum now), but didn't bother going through with actually modifying the firmware since we already had root access by the methods mentioned above.
    Post edited by Phantoman on
  • erdoserdos Junior Member


    You are correct. Not going to be easy. At least I had many sleepless nights trying to find a way to put Android on TVPad1/2/3. Probably not going to help you with your Openelec project, but for Android I found an interesting article which is mostly related to TVPad2/3 (tcc8925 chipset): http://www.cnx-software.com/2012/08/22/how-to-create-a-custom-android-firmware-for-cx-01/ . Never got much further with it since I never figured out how to put the TVPad2 into FWDN mode (bricked a perfectly working unit trying to figure that out). So I called it quits. I am a Windows guy though, so maybe for some Linux wizard it's a piece of cake.
    thanks for the info, it's good to know.

    now i realized that putting 'openelec' won't be possible because onboard rom would require the firmware be loaded first since it contains drivers specific to the tvpad. however, it's unclear to me how one tethers tvpad2 to computer for editing and transferring firmware, since tvpad2 only has one standard usb port( a host usb?). and the linked guide utilizes a miniUSB to usb cable to link the CX-01 mini PC to computer for updating the firmware. anyway, these procedures seem too complicated to go through for what tvpad is worth.

    this is a link i found that contains some info on flash fwdn image with pc to devices with TCC8902/TCC8803 chipset:
    http://forum.xda-developers.com/showthread.php?t=1101094

    do you know tvpad2 have linux or android os installed?

    i found an image showing a board with tcc8925 chipset, not sure whether tvpad2's board is similar to this
    TCC8925

    btw, i deleted 32 bytes from the beginning of the 3.94 firmware as you suggested in aussie forum and still couldn't open it as .tar archive. i use 'ultraedit' program in windows. maybe it should be done in linux?
  • do you know tvpad2 have linux or android os installed?
    TVPad1/2/3 are all Linux with BusyBox.
    i found an image showing a board with tcc8925 chipset, not sure whether tvpad2's board is similar to this
    The layout is different, but TVPad2 is also based on the tcc8925 chipset.
    btw, i deleted 32 bytes from the beginning of the 3.94 firmware as you suggested in aussie forum and still couldn't open it as .tar archive. i use 'ultraedit' program in windows. maybe it should be done in linux?
    No, I did it on Windows using Ultraedit in the past as well. In the hex-editor view you should see the following at the beginning of the file:

    e9f401636654cc602621000eb6b8b728

    That's the part you need to remove.
  • erdoserdos Junior Member


    e9f401636654cc602621000eb6b8b728

    That's the part you need to remove.
    i removed this and still no go, tried on both linux and win machines, linux i used 'Bless' hex editor and 'Archiver', windows using 'ultraedit' hex editor and '7-zip'. either i missed sth or the instruction is incomplete.

    here's hardware/software specs i gathered about tvpad2:
    ARMv7 processor, TCC8920ST chipset, 4G onboard eMMC NAND storage, 377MB Ram, and busybox with Dalvik. what is unclear to me is how the tvpad2 achieves a graphical interface, busybox is just command line tools, also given the fact that box identifies itself as 'Android 2.3.4 customized' in 'settings-system' menu.

    i've noticed running 'Dmesg' fro CLI identifies microSD slot as 'MMC0' and onboard storage as 'MMC1', this probably indicates if there's a corresponding bootable OS on microSD, tvpad will boot it first instead of booting from default onboard OS. in any case, i haven't found any suitable third party ROM for TVpad2, so the best bet is still to modify existing firmware since it contains hardware drivers specific to tvpad.
  • edited January 2016
    @erdos , I just tried with 7-zip version 15.14 64-bit and it was able to gunzip/untar the "creatent_usb_update_M233_4300.gv" archive. I didn't even have to remove the header which contained the hash. I seem to remember that it was required in the past. If it still does not work for you, then I really don't know anymore. Maybe someone else can give it a try as well and see.

    TVPad has 3 framebuffers for graphical output. One is dedicated to the apps and one is dedicated to video. I think the last one was dedicated to the boot screen. TVPad2/3 comes with a command-line utility to play with the framebuffers called FbMixerManager. From the TMP app I see that I was running the following commands to turn on blending (where you would mix the output of the framebuffers):

    FbMixerManager -c 1,0,16317688
    FbMixerManager -a 0,0,1

    And to turn blending off you would run the following:

    FbMixerManager -c 0,16253176,16777215
    FbMixerManager -a 0,1,255

    TVPad1 didn't have this utility, so we had to compile our own version.

    Like I mentioned before, it was a long time ago since I played with all this, so I do not remember all the details. I also don't intend to spend much more time hacking the TVPad to refresh my mind (too busy with other stuff). Furthermore I am a Windows guy, so someone who knows Linux/UNIX would be much better equipped to work on this.

    Edit: Looking further at the TMP source code, to clear fb0 you can use "FbMixerManager -r 1". I believe fb0 was used for the video playback and fb2 was used by the apps. The blending commands above enable chroma keying (the green screen effect) which allows you to overlay the app on top of the video stream. Wish I knew this when I was working on the Record app. Back then we couldn't figure out how to overlay a record icon on top of the video.
    Post edited by Phantoman on
  • erdoserdos Junior Member
    @Phantoman
    thanks a lot! it's working now. turned out i used an older version of 7zip.

    appreciate your insights on how tvpad works.



  • edited March 2016
    Hi Phantoman... I had been following you on Club tvpad a while back and now its closed down so I managed to find u on here.

    Since the TVpad 2 is obsolete now..what would rooting it do?... I mean would it let me install normal android .apk files and just use it like a normal android box, like install kodi or something? or is there a way to get the live chinese channels back on?

    Just seems a waste now with it being a doorstopper now.

    cheers.
  • cmc4141cmc4141 Junior Member
    edited March 2016
    Hi Phantoman / KMK,

    I follow your instructions trying to get the root access for my TVpad3. However, after I have apply the gvos2-sd3 with the USB. I cannot logon with the password "tvpad".

    I got error "login incorrect" when do the telnet. Not sure it is the script did not able to make the change.

    I have install your Phanto APP "tvpad2 or 3-phanto app" to the box. I noticed that your installation package also a script called "gvos2-sd1".

    Could it be the root password already set to something else when I install your APP package ?

    Thanks for your work on helping the group.
    Have a great day
    Tom

    Update:
    I put KMK's version of the file in USB and able to get the root command prompt (no login required) on telnet. However, when I try to change the passwd, I found that the /etc/passwd is not get modified even though message said root passwd has been changed.

    This is confirmed the when I reboot without the USB - I am not able to logon with the new passwd.
    Post edited by cmc4141 on
  • erdoserdos Junior Member
    i'm not a programmer but i've been poking around Tvpad2 ever since it died.

    from what i've learned, a cross-compiler for ARM will be needed to compile the code with added new features, then the new code need to be loaded into the rom.

    busybox's site offer some extra utilities (https://www.busybox.net/tinyutils.html) and a crosscompiler is available for download on its site as well. i've downloaded them but i'm not sure how to compile the source code of the tinyutilities into custom build busybox binaries.

    then there's the issue with transferring the code. phantoman's link above points to transfer firmware with mini USB to USB cable for cx-01. but tvpad2 doesn't have a min usb port.

    then how do one transfer the code to onboard ROM? programmers use programming header on the SBC to load the firmware through RS-232 serial cable. but that involves expensive hardware tools and software suites.
Sign In or Register to comment.