Hacking the Toshiba AC100 - Recently Updated Pages

ARMedslack

louigi600 — Mon, 05 Mar 2012 01:46:06 CST

You can have ARMedslack running on the AC100 but you haveto do a little work to boot it as the official slackware port for ARM has no specific kernel for the AC100.

I worked around the problem by using ubuntu's 2.6.38 kernel for the AC100 and a custom initrd.
I've also found the sources used to build the ubuntu kernel here and if you like to go about it with the home-brew way the initrd really does not need much apart from busybox so the road ahead is not too steep.

What you'll need:
kernel 2.6.38 in zImage format for AC100 (from ubuntu natty for AC100)
initrd.img for 2.6.38 (you can use the initrd from natty for AC100 but you may run into problems is busybox is missing some applets I use in the init sript)
make_bootimg and unpack_bootimg utility (got the link to the sources from this wiki if I remember correctly)
tegra-linux utility for doing the nvflash stuff
ARMedslack miniroot tarball from here
A means of writing the the new initrd and the root fs image to the AC100 (This can be any one of: a working linux installation or initrd on the AC100, Toshiba tegra4linux nvflash util on a working linuc ordinary PC).
A copy of the content od /proc/cmdline bevore you change kernel

This is what my init script looks like in the initrd image (I used an initrd which had broken links so some commands hadto be called directly by the busybox binary):

#!/bin/sh
exec 3>&1
mount -t sysfs -o nodev,noexec,nosuid none /sys
mount -t proc -o nodev,noexec,nosuid none /proc
sysctl -w kernel.printk="4 4 1 7" >/dev/null 2>&1
mount -t tmpfs -o mode=0755 none /dev
mknod -m 0600 /dev/console c 5 1
mknod /dev/null c 1 3
mkdir /dev/pts
mount -t devpts -o noexec,nosuid,gid=5,mode=0620 none /dev/pts
busybox mdev -s
sleep 5
echo 0x0100 > /proc/sys/kernel/real-root-dev
mount -o ro /dev/mmcblk0p7 /root
if [ ! -r /root/sbin/init ]
then
/bin/sh
fi
umount /proc
umount /sys
umount /dev/pts
exec switch_root /root /sbin/init 3

Edit the above script to suit where you want to boot the miniroot from (in my case this is the internal EMMC drive biggest partition).
Make sure the minitoot fstab has the correct root device too.

My advice is that the first initscrip should drop you into a shell so that you can manually run the very few commands, this way you can test and debug problems very effectively.
Once you have booted into the ARMedslack miniroot succesfully you can then try do the same thing using the init script automatically.

Repackage a new image for partition 5 and flash it to the AC100 (after testing you may like to write it to partition 6 and boot without having to play with home button)
Boot while pressing HOME and then hit 1
You should get dropped into a shell as there is no init on the root yet.
Format your target root partition mount it and extract the tarball to it.
Reboot again with the HOME pressed and hit 1 again ... if all went well you should get a slackware prompt on the text console
If you get dropped into an inirtd shell don't worry ... it's some wierd timing issue that ofteh persists across reboots, it's better to work around the problem this way:
from the initrd shell type the following

busybox mdev -s
source /init

Once you have any sort of linux up and running on the AC100 (and the tegrapart commandline sent to kernel is correct for your hardware) you can manage your boot images directly from the AC100.

You can dump the raw images like this (this dumps the recovery partition boot image {partition 5 seen from nvflash} on my device)
dd if=/dev/mmcblk0p1 of=recovery.img

You can then extract kernel and initrd with the unpack_bootimage, modify things and repackage it with the make_bootimage. the bootimage utils are avalible in source and can be compiled on you AC100 linux distro.

Write back the image with dd again.
Once you're up the firs time you will need to complete the miniroot with all the other packages you need to make it into a desktop machine. The quickest way to do this is probabbly to install manually slackpkg and then use that to install the rest of the stuff.

Addobe Flash plugin: although you cannot download it from addobe aldroid has the blasted libflasplayer.so library but even if you hack it out of some apk you will run into trouble with incompatible libraries dew to the different instruction sets used in android and armedslack. In order to get some basit flash support in my armedslack AC100 I used swfdec: it will not play youtube videos as you get told that you need to update but it's better then nothing.

Mplayer from armedslack has unsuitable defaults for the AC100 so if you want video and audio playback go and edit /etc/mplayer/mplayer.conf and sete these two lines:
vo=x11
ao=alsa

pppd does not correctly setup /etc/resolve.conf ... I worked around this by writing very simple ip-up and ip-down to be put in /etc/ppp/

/etc/ppp/ip-up:
#!/bin/bash
if [ $USEPEERDNS -eq 1 ]
then
cp /etc/resolv.conf /etc/org_resolv.conf
> /etc/resolv.conf
[ "$DNS1" != "" ] && echo "nameserver $DNS1" >> /etc/resolv.conf
[ "$DNS2" != "" ] && echo "nameserver $DNS2" >> /etc/resolv.conf
[ -s /etc/resolv.conf ] && cat /etc/ppp/resolv.conf > /etc/resolv.conf
fi

/etc/ppp/ip-down:
#!/bin/bash
[ -s /etc/org_resolv.conf ] && cat /etc/org_resolv.conf > /etc/resolv.conf

mobile broadband

dmedme — Mon, 16 Jan 2012 15:48:03 CST

The 3G model contains an Ericsson F3307 Mobile Broadband Module. With the provided kernel sources, this presents itself as /dev/ttyACM{0,1,2} as well as a cdc network device "usb0". Excerpt from dmesg:

usb 2-1.1: New USB device found, idVendor=0bdb, idProduct=190a
usb 2-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1.1: Product: F3307
usb 2-1.1: Manufacturer: <DB>^KF3307
usb 2-1.1: SerialNumber: 352641XXXXXXXXXX
usb 2-1.1: configuration #1 chosen from 2 choices
cdc_acm 2-1.1:1.1: ttyACM0: USB ACM device
cdc_acm 2-1.1:1.3: ttyACM1: USB ACM device
cdc_wdm 2-1.1:1.5: cdc-wdm0: USB WDM device
usb0 (cdc_ether): not using net_device_ops yet
usb0: register 'cdc_ether' at usb-tegra-ehci.2-1.1, CDC Ethernet Device, 02:XX:XX:XX:XX:XX cdc_wdm 2-1.1:1.8: cdc-wdm1: USB WDM device
cdc_acm 2-1.1:1.9: ttyACM2: USB ACM device

/dev/ttyACM0 and 1 both behave as modems if you connect to them with eg. minicom. The "AT*" query gives a huge list of possible commands, many of which have been documented by someone with a similar device or within Ericsson's own guide

/dev/ttyACM2 appears useless (in some other Ericsson modules, it's for the GPS device.)

The usb0 device is used with Android's Radio Interface Layer. From the "libmbm-ril.so" file on the android filesystem, I think it's using the patches provided by the MBM project (this project also provides kernel patches for 2.6.28 similar to those in the massive archive provided by Toshiba). To use it on linux, you need to send the following AT commands to the modem:

AT+CFUN=1 # enable the radio - the orange LED should turn on
AT+CGDCONT=1,"IP","$APN" # set up the internet account - $APN depends on your provider. Only necessary after changing SIM.
AT*ENAP=1,1 # starts the PDP connection

Once the last command has completed (AT*E2NAP=1 will give status reports), you should be able to bring up the network connection with

dhclient usb0

For those who do not like to use networl managers it's possible to write peers and chatscripts so that you can bring up the connection by typing "pppd call <peer name>" on a shell prompt. The chat script will need, along with the other stuff, the 3 AT comands listed above. Here are the reference setup files:
root@ac100:~/# cat /etc/ppp/peers/generic
# /etc/ppp/peers/generic pppd peer script
# use "pppd call generic" to initiate connection

/dev/ttyACM0
noipdefault
defaultroute
persist
noauth
nodetach
usepeerdns
connect "/usr/sbin/chat -vf /etc/ppp/chatscripts/generic.chat"

root@ac100:~/# cat /etc/ppp/chatscripts/generic.chat
TIMEOUT 3
ABORT BUSY
ABORT 'NO CARRIER'
ABORT VOICE
ABORT 'NO DIALTONE'
ABORT 'NO DIAL TONE'
ABORT 'NO ANSWER'
ABORT DELAYED
"" ATZ
OK ATX3Q0V1E1S0=0&C1&D2
OK-AT-OK AT+CFUN=1
OK-AT-OK AT+CGDCONT=1,"IP",
OK ATDT*99#
CONNECT ""

root@ac100:~/#

If NetworkManager is already running, it may have already started a dhcp client as soon as the link became active. (This hacker spent a couple of days trying to work out which exact order of commands to use, trying arrangements that sometimes worked and sometimes didn't, before realising NetworkManager was automatically doing it behind the scenes. Check what your distro is doing.)

You can also use this device in much the same way as with a mobile broadband dongle, using pppd. However, this requires that you (re)compile the kernel with CONFIG_PPP selected, and you also can't use wvdial with Ubuntu-armel's libc because wvstreams relies on some unimplemented features (setcontext/getcontext).

To turn the radio off again (eg. for better battery life), send AT+CFUN=4. AT+CFUN=0 will turn the modem off completely, removing the /dev/ttyACM* devices, and you'll need a reboot (or reload the modules if avalible).

Ofono works, at least you can send sms with it if you are able to get it running. Currently the network support is not working but may in future release or with some hacks.

TODO:

Provide example peer and chat config files, and a script to set up usb0 from the chat output.

Hints:

verify that the SIM card is inserted correctly, the sticker on the back might be wrong
wvdial is not working until wvstreams is patched to work on ARM
pppd caused a kernel bug

Using a 3G Dongle

Starting with a rooted Toshiba AC100Z without a 3G module, and silver-alx's v4b (Froyo 2.2 with kernel 2.6.32.9-silver-v3-117-bl), I was able to get Huawei E160 and E169 wireless dongles to work.
The key was installing a proper 'chat' binary built from the pppd source distribution that can be found at ftp.samba.org, in place of the 'chat' that is linked in to busybox.
I start the connection from a root shell with 'pppd call tmobile'.
The E173 did not work. (I can get it to work with Ubuntu 10.04 on Intel, by providing its vendor Id and product ID when I modprobe usbserial, but USB_SERIAL is built in 2.6.32.9-silver-v3-117-bl rather than being a module).

Starting from a root shell, I remounted system read-write.

mount -o rw,remount /system
Then, I copied the chat binary to /system/bin/chat, and created a peers directory.

mkdir /system/etc/ppp/peers
Then, I created the following files in peers.
Note that neither tmobile nor O2, from my experience, need secrets to get them to work.

tmobile

ttyUSB0921600user tmobilecrtsctsmodempassivenovjdefaultroutenoipdefaultusepeerdnsnoauthhide-passwordpersistholdoff 10maxfail 0connect '/system/bin/chat -v -f /system/etc/ppp/peers/tmobile.chat'

tmobile.chat

TIMEOUT 40ABORT "DELAYED"ABORT "BUSY"ABORT "ERROR"ABORT "NO DIALTONE"ABORT "NO CARRIER"'' \nATOK AT&F0OK ATE0V1&C1&D2OK ATE0OK AT+CGDCONT=1,"IP","general.t-mobile.uk"OK ATDT*99#CONNECT ''

Ubuntu

corl — Mon, 16 Jan 2012 02:32:23 CST

Ubuntu PPA

An Ubuntu PPA is available that supports updating the Kernel from within a running system once the initial installation has been completed.
This is the choice for average users to pick as it makes the maintenance of the AC100 Linux installation become like any other.
Please follow the advice, including initial installation, on the PPAs page on launchpad at https://launchpad.net/~ac100/+archive/ppa
At the time of this writing, this type of installation seems to be most advanced in stability and comfort. (suggest site: replica rolex watches)

Ubuntu 10.10

The following HowTo is copy-pasted (and formatted) from http://ac100.gudinna.com/. You better read the README supplied there to get the most recent infromation: different machines use different partition numbers.

Update the bootloader

Get the linux4tegra package from tegradeveloper.nvidia.com, so you have the nvflash utility
Connect an USB to USB mini cable between your host PC and the AC100
On your ac100 hold down ctrl and esc on boot; the device will go into flash mode
Pull the tegra-2.6.29-arm2-ac100-boot.img from http://ac100.gudinna.com
Make a backup of the existing partition 5 (recovery mode) of the AC100:
sudo LD_LIBRARY_PATH=. ./nvflash -w --bl ../prebuilt/fastboot.bin --read 5 tegra_partition_5.bin --go
Write the linux autodetection boot image to partition 5 on the device (do not reboot between these commands):
sudo LD_LIBRARY_PATH=. ./nvflash -r --download 5 <path to downloaded tegra-autodetect-boot.img>
Note: Apparently some people are having problems when backing up and writing the boot image right after another. In that case you have to reboot your AC100 between the two commands and use:
sudo LD_LIBRARY_PATH=. ./nvflash -w --bl ../prebuilt/fastboot.bin --download 5 <path to downloaded tegra-2.6.29-arm2-ac100-boot.img>
From now on, the recovery mode on your AC100 will scan for linux on the SD card slot and USB port if you enter the recovery mode (hold down Home during boot, press 1 if the recovery menu shows up).

Create a rootfs SD card

Grab the tarball called tegra-rootfs.tgz from http://ac100.gudinna.com
Prepare an SD card, it should be at least 4G big and formated as ext3 with a single partition
Mount the SD card (e.g. to /mnt/sd) and uncompress the tarball to it (this needs to be done as root!)
Example: sudo tar xzvf tegra-rootfs.tgz --numeric-owner -C /mnt/sd
Do not forget to properly unmount the card afterwards

Instead of an SD card you can also use a USB-stick, the boot image will detect either.

Booting

Plug the SD card into the SD slot of the AC100, hold down Home while pressing the power button
Once the recovery menu shows up, press 1. Be patient until the welcome screen to configure the system comes up
Enable the network if you want to use a different language on the device, the language packs will be installed during configuration
Finish the Welcome screen and you will be dropped into your newly configured Ubuntu install

Known Issues

There is currently no sound driver, so no sound will work on the ac100. However, phhusson's version has sound working (it's linked on gudinna, same installation procedure).
If you have problems using your touchpad: the Welcome screen (oem-config) is usable via keyboard (apart from the timezone selection)

Finish the setup by using the keyboard, then use the test-ec command (preinstalled) with values as described on the Peripheral Control (ec_odm) page
To check the touchpad is working run the following in a terminal: sudo cat /dev/input/event1
If it works you should see grabage in the terminal as you move your fingers on the touchpad
On some devices the touchpad shows up as a different event device, so test others too. If this is the case, please adjust the touchpad entry in /etc/X11/xorg.conf.

Related external resources

Original OS

cederom — Thu, 22 Dec 2011 15:52:53 CST

The AC100 (or Dynabook AZ as it is called in Japan) originally comes with Android 2.1. The update to Android 2.2 has been released on 22 February 2011. The first thing most people will look for here, is rooting their device (tested with Android 2.1 on the AC100).

It is also possible to install Android Market And Google Apps on the AC100.

In case you are looking for instruction on how to backup/restore original firmware partition images take look at Backup and Restore section. In case you are looking for a clean images take a look at http://files.tomek.cedro.info/service/toshiba/ac100/toshiba-ac100-android2.2/ (nvflash and fastboot.bin included).

Backup and Restore

cederom — Thu, 22 Dec 2011 15:47:25 CST

This Howto shows you a way to backup the whole system on the AC100 to your hardrive. This is probably a good idea before you start playing with an alternativ OS. This Howto is written to be used on a Linux system, but it should easily usable on a Windows system as well.

For both procedures (Backing up and Restoring) your AC100 has to be in Recovery Mode!

Backing Up

Download the latest Linux For Tegra (L4T) package from here and unzip it

Open a terminal and change to the following directory: linux4tegra/nvflash

the following command sends the vanilla bootloader into your device RAM (it will not overwrite anything)
# LD_LIBRARY_PATH=. ./nvflash --bl ../prebuilt/fastboot.stock.bin --go

the following command saves your disk partitioning (very important!)
# LD_LIBRARY_PATH=. ./nvflash -r --getpartitiontable partitiontable.txt

use the following command with to save the partitions one by one to your harddisk (see Partition Layout for details)
# for i in $(seq 2 14); do LD_LIBRARY_PATH=. ./nvflash -r --read $i part-$i.img; done

You should endup with part-2.img, part-3.img [...] up to part-14.img, and partitiontable.txt.
Keep them in a safe place if you intend to play a bit with your AC100.

Restoring

In the partitiontable.txt, you should see following pattern (you need the highlighted values for each partition you want to restore):

PartitionId=[PartitionId]
Name=...
DeviceId=18
StartSector=[StartSector]
NumSectors=[NumSectors]
BytesPerSector=2048

Open a terminal and change to the following directory: linux4tegra/nvflash

Reload the vanilla bootloader using the following command:
# LD_LIBRARY_PATH=. ./nvflash --bl fastboot.bin --go

For earch part-[PartitionId].img you want to restore, execute the following command:
# LD_LIBRARY_PATH=. ./nvflash -r --rawdevicewrite [StartSector] [NumSectors] part-[PartitionId].img

Reboot your device.

I used rawdevicewrite for part4, and my bootloader ceased to work until I also restored part2.

In case you forgot to backup your partitions first, you can get them from http://files.tomek.cedro.info/service/toshiba/ac100/toshiba-ac100-android2.2/. Note that partition 14 is a UserData and its size can differ among different devices hard disk size (please verify if partitions 2..13 are the same for all devices).

Easily Backing up and Restoring with AC100 Toolkit

The AC100-Toolkit is a shell based utility that makes the backup and restore process easier.

It automatically downloads and installs nvflash for you.
It can backup all your partitions with two simple commands.
Restoring your partitions also becomes easier.

For more informations, visit http://www.blogarm.net/ac100-toolkit

Development Links

PhilippBlum — Fri, 28 Oct 2011 07:45:39 CDT

http://kotelett.no/ac100/phh/

http://kotelett.no/ac100/gildean/

http://markit.dyndns.org/ac100/

http://salaliitto.com/~gildean/ac100/

http://ac100.gudinna.com/

Deutsch: http://www.arm-community.de

Recommended applications

Darkij — Sun, 09 Oct 2011 09:02:04 CDT

Here a list whit the best applications for the AC100 on android 2.2.

Browsers:
Boat browser or/and Dolphin browser HD
** Firefox
**To download something on the internet, much download browser give sometime a download error. This is so, because they use the engine wrom android and that is just not so good.
The only one that I found. Whit his own download engine, is Firefox. This is the best application for downloading a file. But not for browsing.

Mediaplayer:
Moboplayer + arm7 codec app. This mediaplayer plays everything and has his own big software codecs. Its plays even MKV whit sub!! on software codec mode. But what more important. Its free! unlike rockplayer.

Office software:
OfficeSuite Pro or/and document to go (Full version unlocked)

File explorer:
**Es file explorer
**The stock file manager is great. But you want to see everything on you're ac100. I recommended: Es file explorer. This file browser is free and has great features. It can even unpack files, when astro file manager is doing nothing but giving a error.

Torrent downloader:
aDownloader

Security:
Lookout or AVG free.

Pic gallery:
QuickPic

MSN:
Epinephrine Pro

Task manager:
**Advanced task manager (Paid version)
**This task manager has great features. Also change the layout to the old version on the settings.

Homescreen launcher:
**VTL.Launcher.
**You want a other Homescreen. I recommended this one. Version 1.6.5 is available free on http://forum.xda-developers.com/showthread.php?t=1046302 The newest version is available on the market for 2 euro. Please beware that this Home launcher ask some tweaking in the options.

Root tools: (You want to root. See the rooting section)
Titanium backup pro
SD maid
LCDDensity (Change the dp)
Screen Shot It

Games:
Angry birds
Angry birds Seasons
Angry birds Rio
Bunny Shooter

Hacking the Toshiba AC100

ggrandou — Thu, 06 Oct 2011 02:09:38 CDT

Welcome to the Wiki about the Toshiba AC100 smartbook!

The AC100 (or Dynabook AZ as it is called in Japan) is a nice piece of hardware; a smartbook which many of us have been waiting for since more than a year when many companies announced ARM based netbooks for the future.

Unfortunately, the AC100 features Android 2.1, which is not the optimal OS for a smartbook, as the display size and the keyboard are not entirely Android-compatible. Another drawback is the rather limited choice of installable apps, as there is no way to access Googles Marketplace.

Although Android 2.2 has been released on 22 February 2011, bringing lots of benefits, many of us yearn for installing their own choice of (Linux based) operating system, be it Debian, Ubuntu or ChromeOS.

This Wiki aims to concentrate our activities around

rooting the device
reaching the Recovery Mode
hacking and extending the installed firmware, i.e. the original OS
installing other bootloaders (maybe uBoot) for making the AC100 capable of booting an (open) alternative OS.

Your contribution to this site is highly welcome!
Also feel encouraged to discuss issues at the bottom of each page...

Please join us on IRC : ac100 channel, on Freenode network.

Note:
Most of the content of this wiki is unmaintained and is slightly outdated. Most of Linux development happens on IRC and information is kept together here: http://ac100.grandou.net

Tips for this site:

It seems like CromiumBrowser is not compatible for editing wetpaint pages, sorry. Maybe other related browsers (Chrome, Safari, ...) will also be affected...
Remove the AdWords ads with an AdBlock extension for your webbrowser (e.g. firefox or chromium / chrome)

This site is listed at TuxMobil - Linux compatibility guides for laptops, notebooks, PDAs, mobile phones and GPS devices

Rooting

louigi600 — Thu, 06 Oct 2011 01:57:29 CDT

Gaining superuser (root) access on the Toshiba AC100.

Rooting an Android device usually means to gain the ability to run applications that require superuser (root) access.

VERY IMPORTANT NOTICE!

It seems that the Toshiba factory reset option does not truly reflash back to the original ROM on the device. In this tutorial, we will be making the /system partition writeable, and the factory reset does not amend this partition. Therefore, any changes you make to /system will persist even after a factory reset. If you do something silly in /system you could potentially get your device into a state where it no longer boots.

If you intent to follow this tutorial, I take no responsibility for any damage you may do to your device and its configuration, so if you are in any doubt whatsoever about what you are doing, my advice would be to stop now and progress no further!
Be also warned that precompiled bins can contain Trojan so if you can it's a good choice to compile the stuff you are going to use from source.

There are now 3 documented ways and a fourth that can be perused by fiddling with the backups and then restoring them back to the device.

In any way you will need the Androis Debug Bridge (ABD) from the sdk (get it from here). In order to use ADB you will need to enable the "USB Debugging" feature on the ac100 from the settings menu.
You should now choose which method you wish to use to root your ac100.

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

The newest and the easiest way to root a AC100:
Use on youre own risk!
Works also on android 2.2

1: Instal z4root.
- Link to z4root page.
- Download the APK file and instal it on youre AC100.

2: The usb debugging mode must be turn on.
- Settings> applications > development > click usb debugging on.

3: No SD card insert!
-unmount the Sd card

4: Root whit z4root.
-Start the app z4root.
-Click on permament root.
-The app is loading and is trying to root youre AC100.
-When it is done. You're AC100 should be turned of automatically.
-Turn on your AC100.
-There should be a app called Superuser.
-When yes, congratulations. When no, try again.

That was easy he!
Thanks to the maker of z4root.

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

The Easy Way

You now need to download two items:

rageagainstthecage-arm.bin (from Joey Krim's website here - note that you only need the rageagainstthecage-arm.bin binary, none of the others are required or source can be retreived from here)
Superuser.apk (from ChainsDD's XDA post here - you need the Eclair/Froyo update.zip or alternatively you can use a suid copy of the original sh in tour device to get you rooted after tou have your first root prompt)

Extract the contents of the update.zip to a directory, and copy the files Superuser.apk and su from their respective subdirectories into whatever location you downloaded rageagainstthecage-arm.bin.

The next step is to push the rageagainstthecage-arm.bin file to your device.

Note in the following, [HOST], [AC100 $ prompt], [AC100 # prompt] indicates the sort of shell/prompt you should be at when typing the command.

From your host command prompt:

[HOST] adb push rageagainstthecage-arm5.bin /data/local/tmp/rageagainstthecage-arm5.bin

This should copy rageagainstthecage-arm5.bin to /data/local/tmp on the AC100.

Now to run the binary on the device, enter from the command prompt:

[HOST] adb shell

You should connect to the AC100 and get a $ prompt:

[AC100 $ prompt] chmod 755 /data/local/tmp/rageagainstthecage-arm5.bin
[AC100 $ prompt] cd /data/local/tmp
[AC100 $ prompt] ./rageagainstthecage-arm5.bin

You should get a message similar to this:

[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C [*] checking NPROC limit ...
[+] RLIMIT_NPROC={3584, 3584}
[*] Searching for adb ...
[+] Found adb as PID 777
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.

Your ADB connection will drop. After a few seconds, your AC100 should chirp to indicated that USB debugging has been connected again. If you run "adb shell" again, you should now get a # prompt indicating you have superuser access. If you do not, follow these instructions again from your $ prompt until you do:

[AC100 $ prompt] cd /data/local/tmp

[AC100 $ prompt] ./rageagainstthecage-arm5.bin

IMPORTANT: This exploit does not survive a device reboot!

Assuming you at a # prompt, the next step is to remount /system as r/w, with the following command:

[AC100 # prompt] mount -o rw,remount -t ext3 /dev/block/mmcblk0p1 /system

You should now exit the ADB shell, and enter the following commands from your host command prompt:

[HOST] adb push su /system/bin
[HOST] adb shell

[AC100 # prompt] chmod 6755 /system/bin/su
[AC100 # prompt] ln -s /system/bin/su /system/xbin/su

From now on, you can gain su access via adb by entering su at the device shell prompt.

Now, we need to install ChainsDDs excellent Superuser application for Android:

[HOST] adb push Superuser.apk /system/app

Once this is done, you should find the Superuser application in your application drawer, and whenever a new application requires root access, it should pop up to give you the option to allow or deny access.

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

The Hard Way

You chose the more impervious way because you're paranoid about Trojans and what more or because you just want to learn how to use a cross compiler or whatever pushed you to the hard way.

Ok you need the rageagainstthecage source code. I got it form here but link may get broken so you might haveto google a little to find it. You might also like to google to learn how the exploit works.
You need the android SDK to do testing and Android Debug Bridge stuff. You can download it from here.
To build the binary you will need a cross compiler for android-7 api. I downloaded the NDK that has such cross compiler for all android api from here. There are known issues with the android NDK but for compiling these 2 simple programs it's OK. If you prefer you can get a cross compiler from codesourcery here. You will need to setup a different runsdk script for using the codesourcery cross compiler though but if you want to compile busybox or other more complex projects I strongly advise the use of codesourcery's cross compiler or some other third party cross compiler .
I did not want to go trough all the crap for using it with eclips I just wanted to use it from command line (like I used to do for Zaurus) so I made a runsdk script to set the environment variables for using it.
You obviously also need a linux based pc to run the NDK ;-)
I extracted the NDK to /root/ac100/devel/android-ndk-r6 ... modify to suit your needs:

#User configureble
ARCHITECTURE=arm
API_LEVEL=7
NDK=/root/ac100/devel/android-ndk-r6

#END User configureble

TOOLCHAIN_SYSROOT=$NDK/platforms/android-${API_LEVEL}/arch-$ARCHITECTURE
TOOLCHAIN_PREFIX=${ARCHITECTURE}-linux-androideabi
CC="$TOOLCHAIN_PREFIX-gcc --sysroot=$TOOLCHAIN_SYSROOT"
PATH=$NDK/toolchains/arm-linux-androideabi-4.4.3/prebuilt/linux-x86/bin:${PATH}

export NDK ARCHITECTURE API_LEVEL TOOLCHAIN_SYSROOT TOOLCHAIN_PREFIX CC PATH

echo -n "Press ENTER to start using the NDK end/or type 'exit' to quit NDK"
read
bash

Place such a script in the NDK root directory.
No extract the rageagainstthecage source tarball wherever you like. You will see other code if you got it from the same place where I got it all you are interested in is just the rageagainstthecage.c code.
Now before you proceed in building the binary you might want to examine the code to see if it looks safe then proceed in compiling first by setting up the cross compiler environment with the runsdk scrip above
then proceed to compile the bin by typing something like:
$CC -o rageagainstthecage-android-7.bin rageagainstthecage.c

This should produce a binary called rageagainstthecage-android-7.bin that should run on your AC100. You can first test it out on an android virtual device using the android-sdk and once you're satisfied you then use adb to push it to your AC100 like this:

adb push rageagainstthecage-android-7.bin /data/local/tmp/rageagainstthecage-android-7.bin

Make sure you writhe the bin in a place that will allow unprivileged user to execute it. If you change destination you may run into trouble when you try executing the bin.
After you pushed it to your AC100 you need to enter a shell prompt on the AC100 using the adb again like this:

adb shell

Once you get the shell prompt give execute permissions to and execute it. Things should work exactly like stated in "The Easy Way":
Your ADB connection will drop. After a few seconds, your AC100 should chirp to indicated that USB debugging has been connected again. If you run "adb shell" again, you should now get a # prompt indicating you have superuser access. If you do not, go and execute again rageagainstthecage-android-7.bin until you do. It may take several more then one attempt to drop into a root shell but generally it works first go whils the downloaded bin generally takes more then one go (indicating that it may be doing other things while making it look like attempting the exploit).

Once you drop into a temporary root shell you will need to do something in order to make it easy to get a root shell again in the future. You could compile yourself busybox and what more but the easiest way is to make a very simple c program that gets you root and drops you in a shell. The binary needs to be setuid or it will not work anyway. Jus incase yo've no idea how to to that here is a small and very basic code fragment that does this (make sure the path to your system's sh is correct the code below is the one I used on my spartphone):

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>

int main(void)
{ int current_uid = getuid();
printf("My UID is: %d. My GID is: %d\n", current_uid, getgid());
system("/usr/bin/id");

if (setuid(0))
{ perror("setuid");
return 1;
}

//I am now root!
printf("My UID is: %d. My GID is: %d\n", getuid(), getgid());
system("/system/bin/sh");

return 0;
}

Compile this just like you did for the rageagainstthecage source and push this on your device, drop in to the adb root shell again and make sure root owns it and give it setuid like this:
chmod 6555
You will need to put it in a place where it's allways executable (like /system.bin) which will require you to remount with read write permissions a filesystem (see "The Easy Way" for remounting).

Have fun.

Alternative OS

louigi600 — Sun, 04 Sep 2011 10:26:47 CDT

The only way to enjoy maximum flexibility and freedom on the AC100 will be to install an open operating system. Obviously the most common choice will be a Linux flavour.
Some may also want to have a DualBoot option as well, with the Original OS as fallback.

From what we read in various blog postings, Ubuntu, Debian and ChromeOS are the most promising candidates. The Gentoo page has instructions for installing Gentoo and contains hints for porting other distributions.

You can also have ARMedslack (an official ARM slackware port).

Ubuntu / Linux

ArranShort — Sun, 10 Jul 2011 16:22:30 CDT

!!! This section is still under construction. Refer to "Alternative OS" in the meantime. !!!
!!! This Doesn't work if you have updated to 2.2!!!
This section is intended to help you to set up Ubuntu (or other Linux distributions) on your Toshiba AC100. It is an extended version of the guide at http://ac100.gudinna.com/README, experienced users can refer to that to save time. As of yet, this section focuses on Ubuntu, as we have the most experience with that distribution. Installing other distributions will be similar to what is shown here.
If you encounter problems or errors in the course of installing, please have a look at the Problems & Solutions section. If you can’t find an answer there, you can get help via IRC (irc.freenode.net) on channel #ac100.

Repartition Internal Storage

lawaa — Tue, 28 Jun 2011 05:02:06 CDT

In the latest kernel the tegra partition tables are supported. No need to alter the table the complicated way.

BACKUP EVERY PARTITION AND THE PARTITION TABLE

Altering the layout of the storage is a really intrusive thing and might lead to point of no return. If you are not sure what to do or how to do it in detail go on and ask before you flash it or let it be.
All values from files and in commands are specific to my device and actions, which is also true for generalized values.

IF ANYTHING GOES WRONG:

nvflash --bct orginal.bct --setbct --configfile cfg/real.cfg --bl fastboot.bin --go
nvflash --resume ...

Note that you need the orginal.bct and real.cfg therefor

Step 1: Prepare the files

real.cfg (attached, see links below)

IMPORTANT you need it for resetting partition table to factory but if you have the partition table you can create it afterwards

retrieve the partition table with nvflash
you can use my real.cfg as a sample for AC100-10V
alter the section size ( in bytes ) according to your layout and size

altered.cfg (attached), layout recommendations

change real.cfg according to your needs and save it under a new name
I would highly recommendto keep the partitions BCT, PT, EBT in size and start point since at least EBT seems to be the hardcoded bootloader section and cannot be altered at the moment
if you experience something different let everyone know
in my case I sacrificed SOS as a place for my new MBR (see my altered.cfg) be aware that you cannot "dual boot" with this layout
another fixed point is the position of LNX although you can alter its size
as you can see in my altered.cfg I chose to name my big partition RT and kept it as last you can add partitions as you like here
be aware that the sizes are multiples of 2048

change type of partition 4 (EBT) in altered.cfg

[partition]

name=EBT
id=4
type=data
...

be warnedthis part may seem strange since you expect a valid layout to contain a bootloader but with a bootloader section nvflash will fail hence you will never be able to write a layout with a type=bootloader section to the device

copy fastboot.stock.bin from the directory prebuilt to nvflash und ther new name fastboot.bin that it can be send with the --create command wheere it is needed for the filename=fastboot.bin part of EBT
since in every sample file of L4T I found this part I decided to keep it in my aswell

TODO test if it is possible to send other backup files directly with --create to be more efficient and have a proper verification

fastboot.bin

nvflash will require fastboot.bin in current folder, so copy it from linux4tegra/prebuid like that:

[root@pc nvflash]# ln -s../prebuilt/fastboot.stock.bin ./fastboot.bin

orginal.bct

the orginal bct file is the first 4080bytes of Partition 2

dd if=backup_part-2.img bs=1 count=4080 of=orginal.bct

I noticed that with hexdump -C original.bct everytime the second line ( offset 0x20 ) has to star like '01 00 02 00' which seems a good point of verification

Step 2: creating the new partition

IMPORTANT since this alters the partition table it could really mess everything up so be warned
make sure you have backups of every partition AND a partition table

double check and execute

./nvflash --bct orginal.bct --setbct --bl fastboot.bin --configfile altered.cfg --create --verifypart -1 --go

OUTPUT is like that:

Nvflash started
rcm version 0X20001
System Information:
chip name: t20
chip id: 0x20 major: 1 minor: 2
chip sku: 0x8
chip uid: 0x161c10c4432132d7
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 1
device config fuse: 0
sdram config strap: 1

sending file: orginal.bct
- 4080/4080 bytes sent
orginal.bct sent successfully
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: fastboot.bin
| 931920/931920 bytes sent
fastboot.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 2 3
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: MBR
creating partition: LNX
creating partition: RT
Formatting partition 2 BCT please wait.. done!
Formatting partition 3 PT please wait.. done!
Formatting partition 4 EBT please wait.. done!
Formatting partition 7 MBR please wait.. done!
Formatting partition 6 LNX please wait.. done!
Formatting partition 8 RT please wait.. done!
done!
Enabling verification for partition ID = 4...
sending file: fastboot.bin
| 931920/931920 bytes sent
fastboot.bin sent successfully
Verifying partition ID = 4...Please wait!!
Verification successful!!
VERIFICATION COMPLETE....

Step 3: I altered it and now?

first I would get the new partition table with --getpartitiontable take a look at it and compare it to your original partition table
BCT, PT, EBT must not be altered and LNX should start at the same offset
after that back it up
the next step was always for me to restore partition-4 ( EBT ) back to the device

after that you can turn on your device it should show you the familiar Toshiba Logo

if it doesn't something is wrong with either your layout ( BCT, PT, EBT altered?) or the rewriting of the bootloader
the worst experience I had was ./nvflash --bl fastboot.bin ... being rejected after a --create because of a faulty bootloader section ( see "If anything goes wrong" )

install a distro but keep in mind:
you have to alter the kernel image you write to LNX:

Alter the commandline

my original was '... tegrapart=recovery:300:a00:800,boot:d00:1000:800,mbr:1d00:200:800,system:1f00:10032964:800'
I altered to the following 'tegrapart=mbr:300:a00:800,boot:d00:8000,system:8d00:3b0b00'
scheme explained name:offset:length:blocksize
IMPORTANT: in linux you will only see everything after mbr imho if you choose a wrong location here I assume linux will just write there
as you can see my cmd line now starts with the mbr because it is the first partition for me after EBT ( I sacrificed SOS for it )
the offset 0x300 is for the first partition after EBT I havn't changed that
I kept the size of 0xa00 for MBR that LNX can start at its good old position but as you can see I grew LNX to the size of 0x8000
the last part is RT my big root partition with the calculated values ( boot offset + boot length == system offset ... )
as you can see I have two devices after MBR (LNX==boot and RT==system) which will show up in linx as /dev/mmcblk0p1 and mmcblk0p2

Alter the initrd

if something gets mounted e. g. in init you may have to change the device name

create a kernel image with those changes and hopefully

Custom ROM android 3.0

GavrusCiprian — Sun, 19 Jun 2011 04:07:49 CDT

There is a custom honeycomb rom for ac100 at this link:

http://tabletroms.com/forums/showthread.php?949-aComb100-v0.2-Honeycomb-3.0

Its still in early development stages!

Custom ROM android 2.2

GavrusCiprian — Sun, 19 Jun 2011 04:00:29 CDT

i have found a custom rom at xda developers ... i'm not a very tehnical person but i managed to write it on my ac100 and it works great!

major highlights:

all google services working!

rotation patch (all apps forced landscape)

ntsc support

standby without waking up! (finally!)

many other!

I am not the creator of the rom! I have just found it and i thought it would be good to share it with you!

Thread: http://forum.xda-developers.com/showthread.php?t=957009

note: links are not on the first page! read the hole thread! it was very easy for me with minimalknowledge to flash it. if you do not understand all that is written there do not attempt to flash because you might brick your device!

Chrooted Ubuntu

AndrewGryaznov — Sat, 04 Jun 2011 10:00:17 CDT

An Ubuntu can be installed in a chroot, and accessed through a VNC client.

Why do this?

You run Android and Ubuntu at the same time. Just press Home and you're back in Android.
WiFi works out of the box - Ubuntu just picks up Android's connections.
It's relatively stable. Also, this is a well-understood technique - people did it with many phones.

Why not do this?

The graphics performance is abysmal. You view Ubuntu through a VNC client, and with 1024x600 it's really slow.
Sound doesn't work out of the box (but you can listen to music through the Android player while working in Ubuntu)
Many keys don't work: ctrl, alt, pgup, pgdn, tab (tab emits an X event however, just the wrong one). Esc works.
Right and middle clicks don't work too. You have to go through VNC client menus to send a right click.
Chromium doesn't work out of the box.

HOWTO

Prerequisites - root, busybox

1. On the desktop, mount the AC100 storage. Make sure you have exec and suid mount options. Then run 'debootstrap--arch=armel maverick <directory>' into a directory, say 'ubuntu'. Unmount.

2. On AC100:
$ su
# export PATH=/bin:/usr/bin:/sbin:/usr/sbin:$PATH
# export USER=root
# export HOME=/root
# export TERM=xterm
# busybox mount -o remount,exec,suid /storage
# cd /storage/ubuntu
# busybox mount -o bind /proc proc
# busybox mount -o bind /sys sys
# busybox mount -o bind /dev dev
# busybox mount -o bind /dev/pts dev/pts
# busybox chroot . bash
root@localhost:/#

That's the Ubuntu shell!

3. apt-get install lots of stuff. I feel ubuntu-desktop is too fat, but opinions vary. In the very least, we need tightvncserver and some window manager.

4. Set your timezone with dpkg-reconfigure tzdata.

5. Create a user with adduser username. You must also create a group with numeric ID 3003 and add yourself to it, otherwise vncserver's sockets will be blocked! So,
addgroup --gid 3003 sockets
usermod -G sockets -a username

6. Su to the user and create a file ~/.Xsession. Write there a list of stuff you want to run for a session, like a window manager. Here's an example:
xterm &
tint2 &
openbox

7. Run vncpasswd to set a vnc password, then run vncserver -geometry 1024x600. It will tell you the VNC display number, most likely :1.

8. Install android-vnc-client and connect to 127.0.0.1:5901 (actually, 5900 + the VNC display number).

Enjoy!

OpenVPN Client Support

milanzelenka — Sun, 29 May 2011 03:39:33 CDT

How to connect to OpenVPN server with Toshiba AC100? This method and all resources here is for original Android 2.2 (Froyo) on AC100 device.

For OpenVPN client you need:
- Rooted AC100 device
- My boot image (part6-10W.img, mirror) with kernel compiled with tun device support and tun.ko module (mirror)
- nvflash from linux4tegra package
- adb tool (part of Android SDK)
- abootimg and new zImage (mirror) (only if you need repack boot image, for other models than AC100-10W)
- android-openvpn-installer and android-openvpn-settings apks

## Boot image with kernel and tun.ko support (only for AC100-10W model!)
Original kernel of AC100 doesn't compiled with tun.ko module. So I downloaded 2.2 kernel source codes (thanks to xandrster and his post) and compiled new zImage with tun.ko as a module. Every model of AC100 has different boot command line. I updated partition 6 (boot image) from my AC100-10W with abootimg, so users with AC100-10W model can flash my boot partition (part6-10W.img):

- download part6-10W.img
- goto recovery mode (hold down the CTRL + ESC/back keys and power on the device)

- from linux4tegra/nvflash directory run:
LD_LIBRARY_PATH=. ./nvflash --bl ../prebuilt/fastboot.stock.bin --go

- don't forget backup your partition 6:
LD_LIBRARY_PATH=. ./nvflash -r --read 6 part6-backup.img

- install downloaded part6-10W.img
LD_LIBRARY_PATH=. ./nvflash -r --download 6 path/to/downloaded/part6-10W.img

- long press power button and then turn on

## Update your boot image with new kernel (for all AC100 models)
Because of different boot command line on every AC100 submodel, you need to update YOUR boot partition.

- download zImage kernel
- goto recovery mode (hold down the CTRL + ESC/back keys and power on the device)

- from linux4tegra/nvflash directory run:
LD_LIBRARY_PATH=. ./nvflash --bl ../prebuilt/fastboot.stock.bin --go

- get your partition 6:
LD_LIBRARY_PATH=. ./nvflash -r --read 6 part6.img

- update zImage with abootimg tool (don't forget to make backup of part6.img before)
abootimg -u part6.img -k zImage

- install new part6.img to device
LD_LIBRARY_PATH=. ./nvflash -r --download 6 path/to/downloaded/part6.img

- long press power button and then turn on

## tun.ko module and OpenVPN install

- download tun.ko and place it to somewhere on storage (eg. /storage/openvpn/)
adb shell mkdir /storage/openvpn/
adb push tun.ko /storage/openvpn/

- download and install android-openvpn-installer and android-openvpn-settings and install openvpn according to the manual. WARNING: because of ac100's incompatible version of ifconfig/route tools, it's needed to use busybox. You need to create /system/xbin/bb folder and symlink busybox to ifconfig, route commands:

adb shell
$ su -
# busybox mount -o rw,remount /system
# busybox mkdir /system/xbin
# busybox mkdir /system/xbin/bb
# cd /system/xbin/bb/
# busybox ln -s /system/bin/busybox ifconfig
# busybox ln -s /system/bin/busybox route
# cd /
# busybox mount -o ro,remount /system
# exit
$ exit

In openvpn-installer select "/usr/xbin/bb" as your ifconfig/route bin dir.

- put your openvpn-client.conf file with certificates to /storage/openvpn/

- run android-openvpn-settings, in the Advanced settings check "Load tun kernel module" and TUN module settings chose insmod and "/storage/openvpn/tun.ko" as a path to tun module.

- DONE. You can click to openvpn config file and connect.

Market

MarcSpitz — Tue, 24 May 2011 13:00:19 CDT

1st method

This process is tested on my AC100 running Froyo Android 2.2. The page will get updated with links to the required software later. This guide is not nearly complete, use at own risk. If someone knows how, it is possible to make a update.zip. This would make it as easy as "put zip on SD, reboot and load recovery, reboot and login to google account, start Market"

To get a working copy of Android Market, it is possible to copy some progress made on the Toshiba Folio and Elocity A7 tablets, wich are similar to the AC100's hardware.

Currently you need:
adb from the google sdk
USB driver from the sdk
USB hack to enable tegra support
SuperOneClick root tool (only works until next reboot)

Google apps mdpi for tegra from cyanogenmod
wpa_supplicant from elocity (folio version might also work, but untested) It is important to change permissions on this file

Once adb and the usb driver is up and running, connect the ac100 to your computer. Use SuperOneClick psneuter to initiate "shell root"
enter the ac100 with
"adb shell"
mount the /system partition with
"mount -o remount,rw -t ext2 <insert_partition> /system" <-Will get updated later with correct partition
"exit"

Create a zipfile containing Vending.apk, Google<something>framework.apk, Talk.apk, GoogleContactsSyncAdapter.apk, MarketUpdater.apk and wpa_supplicant
"adb push zipfile.zip /storage"
"adb shell"
"cd /storage"
"unzip zipfile.zip -d /system/app"

On the AC100, disable wifi
back on the commandline:
"cd /system/bin"
cp wpa_supplicant /storage
cd /system/app
cp wpa_supplicant /system/bin
cd /system/bin
chmod 755 wpa_supplicant

On the AC100, enable wifi, if it works then you might be ready to try to logon to the google market. If wifi doesn't work, then there is a permissions problem
Note, the wpa_supplicant from elocity will not show your current wifi signal once you're connected to a wifi network.

This is all for now, I will complete this guide on a later date.

2nd method

First root your device in order to be able to edit /system/app directory. You can follow this website's guides. What I did was using "psneuter" to get root access and then move Superuser.apk and su (unix executable) to /system/app and /system/bin respectively.

This guide is adapted from tharf (thanks to him!!) on XDA http://forum.xda-developers.com/showpost.php?p=11917503&postcount=5

1] Download this file :gapps-mdpi-tegra-20101020-signed.zip from http://goo-inside.me/gapps/

2] Extract it.

3] Replace YouTube.apk with the one from there :http://forum.xda-developers.com/showpost.php?p=11917503&postcount=5

4] Use this bash script where your adb executable is (change FOLDER variable to the name of the extracted gapps folder:
[code]

#!/bin/bash

FOLDER=system-mdpi-tegra-20101020-signed

./adblinux devices

echo "push $FOLDER/etc/.."

./adblinux push $FOLDER/etc/permissions/com.google.android.maps.xml /system/etc/permissions/com.google.android.maps.xml

./adblinux push $FOLDER/etc/permissions/features.xml /system/etc/permissions/features.xml

echo "push $FOLDER/app/.."

./adblinux push $FOLDER/app/GoogleBackupTransport.apk /system/app/GoogleBackupTransport.apk

./adblinux push $FOLDER/app/NetworkLocation.apk /system/app/NetworkLocation.apk

./adblinux push $FOLDER/app/GenieWidget.apk /system/app/GenieWidget.apk

./adblinux push $FOLDER/app/YouTube.apk /system/app/YouTube.apk

./adblinux push $FOLDER/app/MediaUploader.apk /system/app/MediaUploader.apk

./adblinux push $FOLDER/app/GoogleServicesFramework.apk /system/app/GoogleServicesFramework.apk

./adblinux push $FOLDER/app/Talk.apk /system/app/Talk.apk

./adblinux push $FOLDER/app/GoogleContactsSyncAdapter.apk /system/app/GoogleContactsSyncAdapter.apk

./adblinux push $FOLDER/app/MarketUpdater.apk /system/app/MarketUpdater.apk

./adblinux push $FOLDER/app/Vending.apk /system/app/Vending.apk

./adblinux push $FOLDER/app/GoogleFeedback.apk /system/app/GoogleFeedback.apk

./adblinux push $FOLDER/app/GoogleCalendarSyncAdapter.apk /system/app/GoogleCalendarSyncAdapter.apk

echo "push $FOLDER/lib/.."

./adblinux push $FOLDER/lib/libvoicesearch.so /system/lib/libvoicesearch.so

./adblinux push $FOLDER/lib/libspeech.so /system/lib/libspeech.so

echo "push $FOLDER/framework/.."

./adblinux push $FOLDER/framework/com.google.android.maps.jar /system/framework/com.google.android.maps.jar

[code]

5] Factory Reset your device (HOME + POWER buttons simultaneously)

6] Market should be working, otherwise re-factory reset

Hardware

EgonAlter — Tue, 29 Mar 2011 02:48:56 CDT

Maybe you also want to give your votes in the poll on the right?!

Get the hardware specs at Toshiba Europe.
See what is inside. Looks like hardware upgrade (Flash, RAM) is virtually impossible

[Please post here if you can provide:]

$( dmesg )
/proc/cpuinfo

Processor : ARMv7 Processor rev 0 (v7l)
processor : 0
BogoMIPS : 1998.84

processor : 1
BogoMIPS : 1992.29

Features : swp half thumb fastmult vfp edsp vfpv3 vfpv3d16
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x1
CPU part : 0xc09
CPU revision : 0

Hardware : Tegra generic
Revision : 0000
Serial : 0000000000000000

$( lspci )

no pci bus ...

$( lsusb )

Bus 002 Device 003: ID 0bda:58f2 Realtek Semiconductor Corp.
Bus 002 Device 002: ID 0424:2513 Standard Microsystems Corp.
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 0db0:3822 Micro Star International
Bus 001 Device 002: ID 0424:2512 Standard Microsystems Corp. USB 2.0 Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

$( fdisk -l)

Disk /dev/mmcblk0: 7928 MB, 7928807424 bytes
4 heads, 16 sectors/track, 241968 cylinders
Units = cylinders of 64 * 512 = 32768 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Disk /dev/mmcblk0 doesn't contain a valid partition table
The kernel has been modified by Toshiba so it does not provide access to the first part of the flash. This is where the boot configuration (BCT), partition table (PT), boot loader (EBT) and the kernel images are stored (LNX, SOS). Unpatching the kernel should make these partitions accessible. This is somewhat complicated, because then the MBR partition is not at the 'start' of the device. Unpatching has been done, but is not used in any of the prebuilt kernels as of writing. Using a BSD disklabel has been suggested in the irc channel, because it is not required to be in the first sector.

Available models

There are several models available, mostly depending on the country they are sold. All have WiFi support, but differ in the
amount of internal storage and addition wireless connections. The table below lists some of them:

Name AC100-

Part #

Storage

additional wireless connection

Country

10E

PDN01E-006018PL

32 GB

BlueTooth 2.1+EDR
UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

Poland

10D

PDN01E-008013G3

PDN01E-00800SIT

16 GB

BlueTooth 2.1+EDR

Germany

Italy

10G

PDN01E-00C00SIT

16 GB

BlueTooth 2.1+EDR
UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

Italy

10K

PDN01E-001013G3

8 GB

Germany

10N

PDN01E-00200QHU

32 GB

Hungary

10T

PDN01E-005001AR
PDN01E-00500CDU

8 GB

BlueTooth 2.1+EDR
UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

Nederlands
Middle East
Africa?

10U

PDN01E-00500EEN

8 GB

BlueTooth 2.1+EDR
UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

United Kingdom

10V

PDN01E-003016GR

8 GB

UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

Germany

10W

PDN01E-004015CZ

16 G

UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

Czech

10Z

PDN01E-00700EEN

8 GB

BlueTooth 2.1+EDR

United Kingdom

113

PDN01E-00400QHU

16 GB

UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

Hungary

114

PDN01E-00900GFR

16 GB

France

116

PDN01E-00L00URU

32 GB

BlueTooth 2.1+EDR
UMTS (HSDPA 7.2Mbps / HSUPA 2Mbps)

Russia

117

PDN01E-00K00URU

8 GB

BlueTooth 2.1+EDR

Russia

111

PDN01E-00600WS4

32 GB

BlueTooth 2.1+EDR

Switzerland

Battery Upgrades

Stefem — Sun, 20 Mar 2011 18:33:26 CDT

There is no abstract available for this page revision.

HOWTO Experimental

gildean — Fri, 18 Mar 2011 10:58:34 CDT

Installing phh's latest ubuntu with nilfs2 rootfs on an sd-card

Get nilfs-tools for your linux laptop/desktop ( for example sudo apt-get install nilfs-tools )

Get the latest boot.img, modules, ubuntu tarball from phh and tools from nvidia

Stick your sd-card to the linux machine and don't let it automount.

Create a single partition to the sd-card and format it to nilfs2 ( for example sudo mkfs -t nilfs2 /dev/mmcblkXp1 )

Mount the newly created nilfs2 partition to /mnt ( sudo mount -t nilfs2 /dev/mmcblkXp1 /mnt )

Unpack the ubuntu base and modules to /mnt ( with sudo tar xavf Ubuntu5.tar.lzma --numeric-owner -C /mnt and sudo tar xavf modules-4dd097f.tbz2 --numeric-owner -C /mnt )

Umount the sd-card and set it aside for a while

Power off your ac100, connect an usb cable from ac100 to your linux machine and power on the ac100 while pressing crtl+esc. The screen on the ac100 should remain off and the power led should light up.

Surf to the folder where you unpacked the .run file from nvidia and take backup at least of the partition you're going to flash ( with sudo LD_LIBRARY_PATH=./nvflash/ ./nvflash/nvflash --bl ./prebuilt/fastboot.stock.bin --read 5 tegra_partition_5.bin --go )

Power down the ac100 first and then power on again with ctrl+esc.

You can flash either part 5 or part 6 with the boot.img. The Following command flashes part 5. Flashing part 6 makes the ac100 boot straight into ubuntu, but destroys android ( sudo LD_LIBRARY_PATH=./nvflash/ ./nvflash/nvflash --wait --bl ./prebuilt/fastboot.stock.bin --download 5 /the/path/to/boot.img --go )

Nvflash should say that the flashing was succesfull and you can power off the ac100 by pressing the power button for a few seconds.

Stick the sd-card to the ac100 and power on while pressing home and select 1 (if you flashed part 6, you won't have to press home)

You should soon get in front of the typical ubuntu setup assistant, which will ask you your name, where you live etc.

Final setup

Edit /L4T/etc/X11/xorg.conf, so your alt+gr key gets recognized properly ( add Option "XkbModel" "pc105" and Option "XkbLayout" "fi" the last argument is the countrycode )

fetch the lid-switch-daemon, install it in /usr/sbin, and edit /etc/rc.local so it is launched with "-b" or "-s" -- it will put the box to sleep when you close the lid

while you're editing /etc/rc.local, replace /button by /usr/sbin/button

Wifi works by first entering echo 1 > /proc/test_program/wifi3g and then sudo ifconfig ra0 down and sudo ifconfig ra0 up.

Now do sudo apt-get update && sudo apt-get dist-upgrade and get nilfs-tools (you should also read about maintaining nilfs).

Reboot.

Internal setup Installing on the internal emmc works the same way.
Just use usb and androids usb-file sharing to connect the ac100 partition 14 to your linux-machine and don't create a new partition, just format it and follow instructions above.
If you have problems, come to IRC
Please fix problems on this guide if you spot them -gildean