3 ms·
> I examined a cheap Android tablet's ROM dump Can I ask how you did this? Did you have to physically remove the ROM from the board and read it with some sort
by non-entity 7y ago
> I examined a cheap Android tablet's ROM dump
Can I ask how you did this? Did you have to physically remove the ROM from the board and read it with some sort of chip reader? Or is there an interface to read the ROM into a dump without any damage to the board
- h4waii 7y agoHonestly, the easiest way is to simply download the ROM or a full non-delta update from manufacturer, unpack it, and start decompiling. Another option if you are able to unlock the bootloader is, using a custom recovery, to create a tarball of each partition and unpack and start decompiling.
- codedokode 7y agoI found suspicious application (with name like ePlayService or eVideoService, don't remember exactly) in app list, then connected using ADB and examined the filesystem, and decompiled suspicious packages. Then I downloaded ROM from manufacturer's site to make sure that the backdoor was there too. Also I checked signatures on applications to exclude unmodified third party apps like Youtube and check only those with unknown signatures. This is where I found that the manufacturer signed their system applications using publicly available Android test key (which means device is vulnerable because anyone can make an app signed with that test key and gain high privileges on device). Also, some chipsets (like MediaTek) allow downloading storage contents to PC using proprietary Windows application.
- non-entity 7y agoHuh, I'm surprised that manufacturers of cheap android even bother providing downloadable firmware,I might pick up a cheapo android and play around with it.