How to root TVPad2/3
In case no one shared this before, here is how to root the TVPad2 (M233). I never owned a TVPad3 (M358), but I believe this method should work for it as well.
Simply create a file called gvos2-sd1 or gvos2-sd3 on your USB stick and put the following content in it:
For the lazy ones, here is an app for firmware 3.70 or later.
Simply create a file called gvos2-sd1 or gvos2-sd3 on your USB stick and put the following content in it:
#!/bin/sh
echo "root:tvpad" | chpasswd
/usr/sbin/telnetd
/usr/bin/tcpsvd -E 0.0.0.0 21 ftpd -w / &
Now plug the USB stick into your TVPad and you have root access. Simply telnet to port 23 or FTP to port 21 using username root and password tvpad in order to login. Enjoy!For the lazy ones, here is an app for firmware 3.70 or later.
Post edited by padman on
Comments
now i can telnet into my tvpad2 box, below are the partition info:
(none) login: root
Password:
~ # ls
GVOS_USER_ID bin etc init lost+found program sys usr
Settings config home lib mnt sbin tmp var
backup dev image linuxrc proc storage tmphome
~ # df -h
Filesystem Size Used Available Use% Mounted on
/dev/ndda2 512.0M 62.8M 449.2M 12% /image
/dev/loop0 116.1M 116.1M 0 100% /home
/dev/ndda3 128.0M 2.5M 125.5M 2% /config
/dev/ndda5 1024.0M 39.1M 984.9M 4% /program
/dev/ndda6 1.6G 21.5M 1.5G 1% /storage
this seems to indicate tvpad has onboard storage of ~4G which runs the applications, though i'm not sure about the function of each partiton. it doesn't seem to be easy to put a custom os such as 'openelec' into the storage through telnet. i think in order to do that, one needs to tether the box with linux machine first...
here's the guide that i'm trying to follow:
http://wiki.openelec.tv/index.php/Manual_Installation
Hope you doing well, not sure if you going to make a FW to give root access for pad2 and pad3 like the one you did for tvpad1? or it's impossible to do it? thanks
now i realized that putting 'openelec' won't be possible because onboard rom would require the firmware be loaded first since it contains drivers specific to the tvpad. however, it's unclear to me how one tethers tvpad2 to computer for editing and transferring firmware, since tvpad2 only has one standard usb port( a host usb?). and the linked guide utilizes a miniUSB to usb cable to link the CX-01 mini PC to computer for updating the firmware. anyway, these procedures seem too complicated to go through for what tvpad is worth.
this is a link i found that contains some info on flash fwdn image with pc to devices with TCC8902/TCC8803 chipset:
http://forum.xda-developers.com/showthread.php?t=1101094
do you know tvpad2 have linux or android os installed?
i found an image showing a board with tcc8925 chipset, not sure whether tvpad2's board is similar to this
btw, i deleted 32 bytes from the beginning of the 3.94 firmware as you suggested in aussie forum and still couldn't open it as .tar archive. i use 'ultraedit' program in windows. maybe it should be done in linux?
e9f401636654cc602621000eb6b8b728
That's the part you need to remove.
here's hardware/software specs i gathered about tvpad2:
ARMv7 processor, TCC8920ST chipset, 4G onboard eMMC NAND storage, 377MB Ram, and busybox with Dalvik. what is unclear to me is how the tvpad2 achieves a graphical interface, busybox is just command line tools, also given the fact that box identifies itself as 'Android 2.3.4 customized' in 'settings-system' menu.
i've noticed running 'Dmesg' fro CLI identifies microSD slot as 'MMC0' and onboard storage as 'MMC1', this probably indicates if there's a corresponding bootable OS on microSD, tvpad will boot it first instead of booting from default onboard OS. in any case, i haven't found any suitable third party ROM for TVpad2, so the best bet is still to modify existing firmware since it contains hardware drivers specific to tvpad.
TVPad has 3 framebuffers for graphical output. One is dedicated to the apps and one is dedicated to video. I think the last one was dedicated to the boot screen. TVPad2/3 comes with a command-line utility to play with the framebuffers called FbMixerManager. From the TMP app I see that I was running the following commands to turn on blending (where you would mix the output of the framebuffers):
FbMixerManager -c 1,0,16317688
FbMixerManager -a 0,0,1
And to turn blending off you would run the following:
FbMixerManager -c 0,16253176,16777215
FbMixerManager -a 0,1,255
TVPad1 didn't have this utility, so we had to compile our own version.
Like I mentioned before, it was a long time ago since I played with all this, so I do not remember all the details. I also don't intend to spend much more time hacking the TVPad to refresh my mind (too busy with other stuff). Furthermore I am a Windows guy, so someone who knows Linux/UNIX would be much better equipped to work on this.
Edit: Looking further at the TMP source code, to clear fb0 you can use "FbMixerManager -r 1". I believe fb0 was used for the video playback and fb2 was used by the apps. The blending commands above enable chroma keying (the green screen effect) which allows you to overlay the app on top of the video stream. Wish I knew this when I was working on the Record app. Back then we couldn't figure out how to overlay a record icon on top of the video.
thanks a lot! it's working now. turned out i used an older version of 7zip.
appreciate your insights on how tvpad works.
Since the TVpad 2 is obsolete now..what would rooting it do?... I mean would it let me install normal android .apk files and just use it like a normal android box, like install kodi or something? or is there a way to get the live chinese channels back on?
Just seems a waste now with it being a doorstopper now.
cheers.
I follow your instructions trying to get the root access for my TVpad3. However, after I have apply the gvos2-sd3 with the USB. I cannot logon with the password "tvpad".
I got error "login incorrect" when do the telnet. Not sure it is the script did not able to make the change.
I have install your Phanto APP "tvpad2 or 3-phanto app" to the box. I noticed that your installation package also a script called "gvos2-sd1".
Could it be the root password already set to something else when I install your APP package ?
Thanks for your work on helping the group.
Have a great day
Tom
Update:
I put KMK's version of the file in USB and able to get the root command prompt (no login required) on telnet. However, when I try to change the passwd, I found that the /etc/passwd is not get modified even though message said root passwd has been changed.
This is confirmed the when I reboot without the USB - I am not able to logon with the new passwd.
from what i've learned, a cross-compiler for ARM will be needed to compile the code with added new features, then the new code need to be loaded into the rom.
busybox's site offer some extra utilities (https://www.busybox.net/tinyutils.html) and a crosscompiler is available for download on its site as well. i've downloaded them but i'm not sure how to compile the source code of the tinyutilities into custom build busybox binaries.
then there's the issue with transferring the code. phantoman's link above points to transfer firmware with mini USB to USB cable for cx-01. but tvpad2 doesn't have a min usb port.
then how do one transfer the code to onboard ROM? programmers use programming header on the SBC to load the firmware through RS-232 serial cable. but that involves expensive hardware tools and software suites.
Does this the rooting method work for TVPad v1. I have found my TVPad M121 from storage a couple of days ago. I used it years ago and I remembered I upgraded it to v3.26 firmware, probably following some intruction from this site. I got TMP app installed too, to play video files off my samba network share.
Now I found I can't apply the greenman fix provided by Phantoman the original poster (from another thread), because the mega links are no longer available. I am thus wondering if I can root my TVPad and make some use of it.
Thanks.
Interested enough, I created the script gvos2-sd1 exactly as the original post and saved it to the usb stick. It did not work. Today a gentleman, i.e., Goodan, from another thread here , https://tvpad.ca/discussion/484/how-to-permanently-activate-the-green-man-on-tvpad1/p8
provided me necessary files. I checked the gvos2-sd1 there, there is not much difference. The script there is with a few extra lines appended, mainly to force login.
I am wondering if the EOL in the script makes such a difference. My one that did not work was created on Linux so the text file is in UNIX line-ending style. The working one is in MS-DOS style line-ending. And of course the USB stick is in FAT format.