Mobileread
Poking around Android system on RK3368 based Likebook devices; here are my findings
#1  MustardOrMayo 11-25-2019, 01:22 PM
You could view my original note here if you want, as vBulletin used by MobileRead might break certain formatting, and the former would update first before this post.

I've been poking around the software on my Likebook Mimas (but the info here should also apply to any other Boyue device running on the Rockchip RK3368 platform), primarily in order to find a way to root it, but also because I don't like how Boyue seemed to have removed certain features from their Android 6 release, like background support, the entire lock screen (including Google Smart Lock, and in favour of Boyue's lazy-ish passcode lock), as well as screen recording and wireless display support. I can't go further without a full system image to recover from, but wanted to share my findings here on MobileRead, in the event that it could help others get further. If you don't have one of these devices, I could help to provide screenshots and/or shell transcripts from my Mimas, unless it's not with me as I have to send it back to Boyue to get the pen digitizer replaced.

(The original note was about "hacking" the software, but I later felt that wasn't the right word, so the rest of this post may sound strange)

Missing resources:
From what I know, the Likebook firmware, at least for their Android 6 based release, appears to me to be basically a hodgepodge of a few different Android releases. Here are some examples:
Here's what I found:
Shell snippet 1 - Environment variables:
Spoiler Warning below







Code
shell@T103D:/ $ env
_=/system/bin/env
ANDROID_DATA=/data
RK_ADEPT_ACTIVATION_FILE=/mnt/sdcard/.adobe-digital-editions/activation.xml
RK_ADOBE_DE_DOC_FOLDER=/mnt/sdcard/Digital Editions
HOME=/data
RK_ADEPT_DEVICE_TYPE=mobile
RK_ADEPT_DEVICE_SALT_FILE=/mnt/sdcard/.adobe-digital-editions/devicesalt
EBOOK_PAGE_VISIBLE_NUMBER=2ÒÇÇ
USER=shell
ANDROID_ASSETS=/system/app
BOOTCLASSPATH=/system/framework/core-libart.jar:/system/framework/conscrypt.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/ims-common.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/apache-xml.jar:/system/framework/org.apache.http.legacy.boot.jar
ANDROID_SOCKET_adbd=12
RK_ADOBE_DE_MOBILE=1
ANDROID_STORAGE=/storage
MKSH=/system/bin/sh
SYSTEMSERVERCLASSPATH=/system/framework/services.jar:/system/framework/ethernet-service.jar:/system/framework/wifi-service.jar
TERM=xterm
SHELL=/system/bin/sh
ANDROID_BOOTLOGO=1
ADOBE_FONTS_DIR=/system/fonts/adobefonts/
RK_ADEPT_DEVICE_FILE=/mnt/sdcard/.adobe-digital-editions/device.xml
ASEC_MOUNTPOINT=/mnt/asec
HOSTNAME=T103D
TMPDIR=/data/local/tmp
PATH=/sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
ANDROID_PROPERTY_WORKSPACE=10,0
ANDROID_ROOT=/system
EXTERNAL_STORAGE=/sdcard
shell@T103D:/ $
Shell snippet 2 - Root folder listing:
Code
shell@T103D:/ $ ls /
acct
cache
charger
config
d
data
default.prop
dev
drmboot.ko
ebc_waveform.bin
etc
file_contexts
fstab.rk30board
fstab.rk30board.bootmode.emmc
fstab.rk30board.bootmode.unknown
init
init.connectivity.rc
init.environ.rc
init.rc
init.rk30board.bootmode.emmc.rc
init.rk30board.bootmode.unknown.rc
init.rk30board.environment.rc
init.rk30board.rc
init.rk30board.usb.rc
init.rockchip.rc
init.tablet.rc
init.trace.rc
init.usb.configfs.rc
init.usb.rc
init.zygote32.rc
init.zygote64_32.rc
metadata
mnt
oem
proc
property_contexts
res
rk30xxnand_ko.ko
root
sbin
sdcard
seapp_contexts
selinux_version
sepolicy
service_contexts
storage
sys
system
ueventd.rc
ueventd.rk30board.rc
vendor
wacomT103dFw.hex
shell@T103D:/ $


Shell snippet 3 - /dev listing:
Spoiler Warning below







Code
shell@T103D:/ $ ls /dev
__properties__
alarm
ashmem
binder
block
bus
camsys_marvin
console
cpu_dma_latency
cpuctl
cpuset
device-mapper
ebc
fscklogs
full
fuse
graphics
hevc_service
i2c-0
i2c-1
i2c-2
i2c-3
i2c-4
i2c_detect
iep
iio:device0
input
ion
keychord
kmem
kmsg
log
loop-control
mem
memcg
mtp_usb
network_latency
network_throughput
null
opteearmtz00
ppp
ptmx
pts
pvr_sync
pvrsrvkm
random
rfkill
rga
rtc0
rtc_rk808_test
rtc_rk818_test
snd
socket
spi_misc_test
sw_sync
tgt
timerirq
tty
ttyGS0
ttyGS1
ttyGS2
ttyGS3
ttyS0
ttyS2
tun
uhid
uinput
urandom
usb-ffs
usb_accessory
vendor_storage
vflash
vpu_service
watchdog
watchdog1
xt_qtaguid
zero
shell@T103D:/ $


Let me know if you want me to open any file or folder and show you the contents, in either the ADB shell or the free non-root version of Root Explorer. I also have Termux and Termius, and can run commands in the locked-down local terminal, as well as through the ADB shell.

Shell snippet 4 - Android build properties:
Spoiler Warning below







Code
shell@T103D:/ $ cat /system/build.prop
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=MXC89L
ro.build.display.id=BYRead-V1.1.3-2019092718
ro.build.version.incremental=2934
ro.build.version.sdk=23
ro.build.version.preview_sdk=0
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=6.0.1
ro.build.version.security_patch=2016-10-01
ro.build.version.base_os=
ro.build.date=2019Õ╣┤ 09µ£ê 27µùÑ µÿƒµ£ƒõ║ö 18:49:58 CST
ro.build.date.utc=1569581398
ro.build.type=user
ro.build.user=builder
ro.build.host=builder-001
ro.build.tags=release-keys
ro.build.flavor=rk3368_64-user
ro.product.model=Likebook-T103D
ro.product.brand=Boyue
ro.product.name=T103D
ro.product.device=T103D
ro.product.board=rk30sdk
persist.boeye.updatemodel=Likebook-T103D-BYRead
persist.sys.timezone=Asia/Shanghai
UserVolumeLabel=Likebook
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=arm64-v8a
ro.product.cpu.abilist=arm64-v8a,armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=arm64-v8a
ro.product.manufacturer=Boyue
ro.product.locale=zh-CN
ro.wifi.channels=
ro.board.platform=rk3368
# ro.build.product is obsolete; use ro.product.device
ro.build.product=T103D
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=rk3368_64-user 6.0.1 MXC89L 2934 release-keys
ro.build.fingerprint=Android/rk3368_64/rk3368:6.0.1/MXC89L/builder09271849:user/release-keys
ro.rk.screenoff_time=120000
ro.build.characteristics=tablet
ro.adb.secure=1
persist.by.debug=1
ro.has.hw=1
ro.default.epdmode=3
# end build properties
#
# from device/rockchip/rk3368/system.prop
#
#
# system.prop
#
#rild.libpath=/system/lib/libreference-ril.so
#rild.libargs=-d /dev/ttyUSB2
# Default ecclist
ro.ril.ecclist=112,911
ro.opengles.version = 196609
wifi.interface=wlan0
rild.libpath=/system/lib/libril-rk29-dataonly.so
rild.libargs=-d /dev/ttyACM0
persist.tegra.nvmmlite = 1
ro.audio.monitorOrientation=true
#NFC
debug.nfc.fw_download=false
debug.nfc.se=false
#add Rockchip properties here
ro.rk.screenshot_enable=true
ro.rk.def_brightness=0
ro.rk.install_non_market_apps=false
sys.hwc.compose_policy=0
sys.wallpaper.rgb565=0
sf.power.control=8847360
sys.rkadb.root=0
ro.sf.fakerotation=false
ro.sf.hwrotation=270
ro.rk.MassStorage=false
ro.rk.systembar.voiceicon=true
ro.rk.systembar.tabletUI=false
ro.rk.LowBatteryBrightness=true
ro.tether.denied=false
sys.resolution.changed=false
ro.default.size=100
ro.product.usbfactory=rockchip_usb
wifi.supplicant_scan_interval=15
ro.factory.tool=0
#set default lcd density for rk3368-P9 tablet
ro.sf.lcd_density=240
media.stagefright.audio.sink=150
ro.lockscreen.disable.default=true
#boyue properties
ro.boyue.brand = boyue-likebook
#
# ADDITIONAL_BUILD_PROPERTIES
#
wifi.interface=wlan0
ro.opengles.version=196609
dalvik.vm.heapstartsize=16m
dalvik.vm.heapgrowthlimit=192m
dalvik.vm.heapsize=512m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=8m
ro.config.ringtone=Ring_Synth_04.ogg
ro.config.notification_sound=pixiedust.ogg
ro.carrier=unknown
ro.config.alarm_alert=Alarm_Classic.ogg
ro.rksdk.version=RK30_ANDROID6.0.1-SDK-v1.00.00
camera2.portability.force_api=1
persist.sys.strictmode.visual=false
ro.rk.bt_enable=true
ro.factory.hasUMS=false
testing.mediascanner.skiplist=/mnt/shell/emulated/Android/
persist.sys.usb.config=mtp
ro.factory.hasGPS=false
ro.rk.ethernet_enable=false
ro.factory.storage_suppntfs=true
ro.factory.without_battery=false
ro.com.google.gmsversion=6.0_r9
ro.product.first_api_level=23
keyguard.no_require_sim=true
ro.com.android.dataroaming=true
ril.function.dataonly=1
ro.config.enable.remotecontrol=false
ro.udisk.visible=true
ro.safemode.disabled=true
persist.sys.dalvik.vm.lib.2=libart
dalvik.vm.isa.arm64.variant=cortex-a53
dalvik.vm.isa.arm64.features=default
dalvik.vm.isa.arm.variant=cortex-a53
dalvik.vm.isa.arm.features=default
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.expect.recovery_id=0xf3b28aa1f9d1394f89ff451343419b31409a4b8a000000000000000000000000
shell@T103D:/ $


Shell snippet 5 - Rockchip AndroidTool v2.69 stuff:
Spoiler Warning below







Code
Get FlashID Start
CS0: 45 4D 4D 43 20
Get FlashID Success
Get FlashInfo Start
Manufacturer: SAMSUNG
Flash Size: 14910MB
Total Sector: 0x1d1f000
Block Size: 512KB
Page Size: 2KB
ECC Bits: 0
Access Time: 40
Flash CS: 0
Get FlashInfo Success
Get ChipInfo Start
Chip Tag: 33 33 30 41
Image Chip Flag: -RK330A
Get ChipInfo Success
Get Capability Start
Get Capability Fail


What I plan to do next is to try and see if I can try and trace to get some kind of OTA image, by doing packet capture. However, most likely, OTA update images won't be as complete as the full factory images would be.
Reply 

#2  MustardOrMayo 11-25-2019, 01:23 PM
(XDA style "reserved" here, unless it's not permitted here)
Reply 

#3  rvcjew 12-03-2019, 07:58 PM
This can get interesting indeed. I'd like to see what you think when they release the 8.0 updates.
Reply 

#4  MustardOrMayo 01-04-2020, 01:24 PM
Quote rvcjew
This can get interesting indeed. I'd like to see what you think when they release the 8.0 updates.
Well, I already had this to say.

Quote MustardOrMayo
... I'm hoping Boyue offers at least 8.1, as there's a bug in 8.0 that breaks Twitter emoji in the Twitter app. I'm also hoping Boyue updates system fonts as part of their frequent UX updates, and I'd like if they could provide 8.1 9.0, but most likely not 10.0 as that's very new and Android doesn't officially support e-paper as far as I know,
However, since then, I've had to send my Mimas out for service back in December. They told me they had to replace the entire display assembly (I told them I had issues with the top half of pen input not working, but didn't tell them about some touch issues I was having). Turns out, I could only send it out on 23 December as they in the process of moving to a different office building, and had to wait a few days before they could start accepting mail at the new location and I would send it to them there. I know it's currently with them at their facility based on their replies.

I was hoping to get it back in time for a trip, but it seemed that the bezel is part of the display assembly despite this being a Mimas and not the later Alita, and they had encountered a long lead time on that. Bezel, front lighting, touch digitiser, display panel, and pen digitiser. 5 layers. I contacted them last Thursday, and they mentioned something along the lines of not being able to source it with the white bezel, so I'm hoping that if they still can't get it in white, that they can just get it in black and replace the back cover accordingly.

EDIT: I checked with them again on Monday and they clarified that the white parts are no longer being manufactured, and they're instead waiting on the black parts. Their estimate is now the end of January, which means I'll have to read on my tablet and not be able to take notes during the trip. Now back to the original post.

My main concern is with my user data, as I didn't want to do a complete reset, based on previous experiences with Android 6 in general. However, I did put it into flight mode and enabled a passcode (I gave them that) before sending it out.

I'll try to contact them somewhere around next Monday to Thursday to see if they have the part in stock, unless they reply to me.

What I can mention, is that they seem to be running their side of the chat through machine translations.

It's been 2 weeks and i already miss it!!

I really hope I can get it back before I have to leave, but it'll most likely not be the case.
Reply 

#5  guest 01-05-2020, 05:36 PM
Quote MustardOrMayo
I can't go further without a full system image to recover from
You already have the images on your device.
Code
rkflashtool p
will show you addresses. For example on my ares:
Code
CMDLINE: console=ttyS2 androidboot.baseband=N/A androidboot.selinux=permissive androidboot.hardware=rk30board androidboot.console=ttyS2 init=/init mtdparts=rk29xxnand:0x00002000@0x00002000(uboot),0x00002000@0x00004000(trust),0x00002000@0x00006000(wbf),0x00002000@0x00008000(misc),0x00008000@0x0000a000(resource),0x0000a000@0x00012000(kernel),0x00010000@0x0001c000(boot),0x00010000@0x0002c000(recovery),0x00038000@0x0003c000(backup),0x00040000@0x00074000(cache),0x00002000@0x000B4000(kpanic),0x00333000@0x000B6000(system),0x00008000@0x003E9000(metadata),0x00002000@0x003F1000(baseparamer),0x00020000@0x003F3000(radical_update),-@0x00413000(userdata)
With these addresses you can backup your whole system (there's no point downloading userdata using rkflashtool):
Code
rkflashtool r 0x00002000 0x00002000 > uboot.img
rkflashtool r 0x00004000 0x00002000 > trust.img
rkflashtool r 0x00006000 0x00002000 > wbf.img
rkflashtool r 0x00008000 0x00002000 > misc.img
rkflashtool r 0x0000a000 0x00008000 > resource.img
rkflashtool r 0x00012000 0x0000a000 > kernel.img
rkflashtool r 0x0001c000 0x00010000 > boot.img
rkflashtool r 0x0002c000 0x00010000 > recovery.img
rkflashtool r 0x0003c000 0x00038000 > backup.img
rkflashtool r 0x00074000 0x00040000 > cache.img
rkflashtool r 0x000B4000 0x00002000 > kpanic.img
rkflashtool r 0x000B6000 0x00333000 > system.img
rkflashtool r 0x003E9000 0x00008000 > metadata.img
rkflashtool r 0x003F1000 0x00002000 > baseparamer.img
rkflashtool r 0x003F3000 0x00020000 > radical_update.img
Reply 

#6  MustardOrMayo 01-06-2020, 12:40 AM
Thanks!

Edit: I could've used that to back up user data before sending it in for service...
Reply 

#7  bejobo 01-13-2020, 10:11 AM
Hi
Reading your post /exchange as I just got myself a LikeBook Ares Note and I am looking forward to rooting it eventually...
The model is referenced as K78W, it is an octa-core 1.5Ghz chip so I assume it is RK3368.

Could you share the stock image there / in a dedicated thread?

Thanks

Are you aware of this thread at XDA?
Reply 

#8  nowell29 01-13-2020, 03:02 PM
Is there anything I can help contribute? I have a Mars. I was just fiddling with it this morning. I too can boot to fastboot and/or bootloader, but there is nothing useful on the screen (used ADB).

I'd like root, but mostly I'd like to figure out how to get the navigation/notification bar to the bottom of the screen rather than the top.
Reply 

#9  MustardOrMayo 03-24-2020, 06:19 PM
So here's an update. I had been checking with Boyue's support representative roughly every 2 weeks about the status of my repair request, and they mentioned that (after cleaning up their translated chat) their OEM hasn't yet got to making the replacement parts needed.

The display assembly on the Mimas not only includes the pen digitiser, EPD panel, front lighting, and touch digitiser, but it also includes the bezel and front buttons. Yeah, it includes the bezel. As they didn't have parts in stock and had to order them, that means my limited edition white model will become a regular black model, but if they do it correctly, they'll transplant the mainboard over, but then all my data would be 4-5 months out of date by the time I get it back in April! (according to the estimate they provided me)

Spoiler Warning below






In the meanwhile, back in January, I bought a used Kobo Aura to use as a temporary e-reader, as one of my two current reads had been purchased on my Kobo account. Later, I ended up with a cheap broken Kindle Paperwhite 3 of which I bypassed the issue it has, and is usable aside from it no longer being able to respond to the cover (also I jailbroke it), and just this month, Kobo had a sale on their Singaporean device store, so I now have a new Kobo Clara HD, and plan to sell the Aura after doing some YouTube videos about it, following a subscriber update video I haven't yet recorded. Either that, or I might keep all 3 for my separate book research project, depending on how I feel at the time. However, I can confirm that Kobo's OverDrive integration seems to support "OverDrive Read" titles, on-device borrowing is limited to titles on Kobo Store, so other titles can be borrowed using the Libby app, OD app, or the OD Web interface. I plan to do a YT video about that.

Quote bejobo
Hi
Reading your post /exchange as I just got myself a LikeBook Ares Note and I am looking forward to rooting it eventually...
The model is referenced as K78W, it is an octa-core 1.5Ghz chip so I assume it is RK3368.

Could you share the stock image there / in a dedicated thread?

Thanks
I'll try to remember to do so. Thanks for the advice.

Quote bejobo
Are you aware of this thread at XDA?
No, I didn't

Quote nowell29
Is there anything I can help contribute? I have a Mars. I was just fiddling with it this morning. I too can boot to fastboot and/or bootloader, but there is nothing useful on the screen (used ADB).

I'd like root, but mostly I'd like to figure out how to get the navigation/notification bar to the bottom of the screen rather than the top.
I'm not too sure. What I can mention is that the navigation bar had been integrated into the status bar as a custom Boyue implementation rather than using the actual Android navigation bar, which I believe is why holding down the home button to bring up the Android user-defined device assistance app doesn't work.
Reply 

#10  MustardOrMayo 04-05-2020, 01:42 PM
Following from my previous post, what I can mention is that I'm still waiting for them to get the parts needed to complete my repair request. I'm hoping they'll get back to me this week!

However, while they offered to upgrade me to an Alita if I paid some amount of money (they didn't tell me), I declined and resisted, for several reasons:
  1. No page keys, so I'd have to run an overlay app in order to take screenshots. (EDIT 2: It turns out that they placed a "screenshot" toggle in the notification shade, but only in the 2.x firmware)
  2. I don't like the default case included with the Alita, however, i do believe I can use cases intended for stuff like the reMarkable 1st generation and Boox Note series, as long as it's a case with a sticky pad rather than a moulded holder
  3. I'd rather get a Boox Note2 rather than a Likebook Alita, as I don't see much of a difference between the two, though I still wish Onyx at least included memory card slots on their Boox devices. I could get one of the former, but the problem for me is that it'd blow a massive hole in my savings. As for the Boox Note Pro, that lacks USB hosting support which I'd want for my research project, while the Note2 runs on Onyx's newer hardware platform that I think uses rejected Qualcomm Snapdragon 625 chips (I can't confirm for obvious reasons) where the cellular and/or camera components had failed factory tests, and so Onyx disabled those in their Android software. I would've liked Onyx to make more use of the SoCs they put in their devices, and I'm hoping they do so with a possible "Boox Note2 Pro" that could have a colour display with a greyscale mode, which in turn would really benefit me as someone who primarily reads comics, oh yeah, a memory card slot and a few other features I wish for.

Today is also the beginning of a "circuit breaker" lockdown period in Singapore, where I live, that sounds comparable to similar things in the UK, US, and Italy, based on what I heard on Twitter. As part of that, I decided to stick to what I currently have and just read on those. More info here.

At least I have a Kobo e-reader that's new enough to have OverDrive integration, and the way I've been using mine is to borrow on Libby, then sync on Kobo. However. I do prefer to read comics at close to print size, so it's a little hard for me to do so with the 6" display of the Kobo Clara HD (I mainly bought it to use as part of my book research), but it can be done as the 300ppi display it has makes text readable, but I would've had to zoom in on the older 212ppi and 167ppi displays. Additionally, my tablet has a cracked screen protector (I haven't posted a photo of that yet), which may impede reading, but it's what I'll have to live with as I generate a lot of dust that would affect me installing screen protectors.

EDIT: I forgot to mention that someone dumped a firmware image here, and it looks like it could be modified to slip in Magisk and subsequently gain root access, but I feel a possible hurdle could be the stock recovery.
Reply 

  Next »  Last »  (1/2)
Today's Posts | Search this Thread | Login | Register