Category: phone

Using U-Boot to extract Boot Image from Pritom P7

This is a guide to extract the boot image from a cheap Android tablet based on Allwinner A133 using U-Boot (accessed via UART). The original firmware was not found on the internet. With the boot image and Magisk, you can root your Android tablet to make it more useful.

Pritom P7 is a very cheap Android tablet. I bought it for 33 USD from AliExpress, but it can be found for as low as 27 USD. This is a Google GMS-certified device (it passes Play Integrity, no malware was found when I received it), and it uses 32-bit Android Go. I am only using this to test some 32-bit Android app compatibility.

I bought it for 32.75 USD

They may have several variants of this model with different specifications. Mine is: Alwinner A133, 1.5GB RAM (advertised as 2GB, and shown as 2GB in the Android info), 32 GB ROM, only 2.4 GHz WIFI, no GPS.

Unlockable Bootloader

Luckily, we are allowed to unlock the bootloader of this device using the developer menu, adb reboot bootloader then using fastboot oem unlock. Some cheap Android devices don’t allow unlocking (for example, the ones that are based on recent Unisoc SOC).

I can allow bootloader unlock using the OEM Unlocking option

The product ID of my tablet is P7_EEA (Android 11) with kernel version Linux localhost 5.4.180-svn33409-ab20220924-092422 #28 SMP PREEMPT Sun Aug 20 19:13:45 CST 2023 armv8l. The build number is PRITOM_P7_EEA_20230820.

I did not find any Android exploit for this device, and I also didn’t find any backdoors. From my experience, some of these cheap Android devices have hidden su backdoors. Unable to find an exploit, I gave up trying to extract boot image from user space.

With some SOC, you can easily read/dump/extract the flash using PC software. I didn’t find any software for this Allwinner chip. An example of a SOC that allows flash reading is Unisoc (formerly Spreadtrum), but on the other hand, the bootloader on phones and tablets with the latest SOCs from Unisoc (that I know of) is not unlockable.

UART

Fortunately, this device is easy to open, and a UART pin is on the top left near the camera.

UART + FEL pad on top, near the camera
Continue reading “Using U-Boot to extract Boot Image from Pritom P7”

P990i Stylus Stuck

Sony Ericsson P990 Stylus It had been several months since my Sony Ericsson P990 stylus got stuck inside the casing. I was a little bit annoyed, since I can’t put a new stylus in it, but didn’t care too much because most of the time I just use my hand to select the menu, and use the keyboard to enter text.

When I bought a Torx T6 screw driver to replace MacBook Pro’s hard drive, I realized that the same screwdriver can be used to open P990i casing. So, I opened the casing, and I can pull out the old stylus. The stylus was stuck in a spring mechanism which I guess used to prevent the stylus from falling to easily.

You can look the disassembly pictures at
my photo album.

One thing that may not be clear from the instructions on the Internet is this: To open the part that covers the front camera: pull it upward (that is toward the upper side of the phone).