No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download

0x0 Welcome


We likely have some fun stuff here!

Note on 12/12/2018: (T_T sad news) I have soft-bricked my DPT and based on it's current stage it couldn't recover. Unfortunately, mine is out of warranty and I'm not paying over $400 more for a replacement (talked to S.O.N.Y. about this). I would appreciate some donations so I can afford the cost. But if not, it's okay, as we also get many talented others, and we got the Taobao PKGs. I'll also ask friends to look at bricked device from the hardware side.

Things that would greatly help new comers:

  • Flashsable PKGs without going into diagnosis mode (checkout the example here)
  • A clean system modification over taobao PKGs (as they have validations..)

Thanks for your understanding. Keep up the active discussions in XDA and Issues section here. Meanwhile, please all have a great Christmas!

0x1 Special Thanks

Greatly thank

0x2 What does DPT stand for?

[cough cough] If you don't know what's DPT you won't need this.

0x3 Tools - Automation to gain root, adb, and sudo access

Heads up! Use at your own risk. It has only been fully tested on Macbook Pro.

This is an interative shell commandline tool that wraps processes like updating firmware pkg, obtaining diagnosis access, etc.


To use the tool properly, you need:

  • Python 3.x
    • pip install httpsig pyserial
  • MacOS/Linux with support of xxd command (will remove this requirement soon)
    • Windows may use MinGW, some find it working, but it has not been fully tested

At Normal Boot Up

To validate a successful connection,

python -id <deviceid file path> -k <your key file path> -ip <ip address>

Please refer to janten's dpt-rp1-py on how do you get deviceid and key file path for your device.

Then you will enter the interactive shell mode. Press Ctrl + C to exit, or type exit or quit.

To update firmware from pkg file, type fw and follow the instructions.

To obtain diagnosis access, type root and follow the instructions.

To enter diagnosis mode, type diagnosis and follow the instructions. Or directly use:

python --diagnosis

At Diagnosis Mode

To patch updater bash, just run patch-updater-bash.

To obtain ADB access, we need to flash a modified boot.img (boot- It is confirmed to work on RP1 version and on CP1 version (thanks to mingming1222).

### If your device is not on above versions, do NOT flash
### 1: Backup boot image: via `backup-bootimg`
###    The backup image on device is at `/root/boot.img.bak`
###    It also automatically pulls the backup to local folder
###    It takes about 15-20min. Carefully confirm the MD5 of the pulled file.
###    If not correct, backup AGAIN.
### 2: Apply the new boot image: via `restore-bootimg`
###    Use `python_api/assets/boot-`
###    It takes about 15-20min. Carefully confirm the MD5 of the pushed file.
###    If not correct, do NOT type `yes` to restore it.

It may appear to be unauthorized. Since I did not include a vulnerable adbd, I put a master public key in DPT at /adb_keys. This causes an insecure ADB due to /adb_keys. I will fix this in later updates.

To address unauthorized, on your computer (Mac or Linux),

mv ~/.android/adbkey ~/.android/adbkey_bak
cp python_api/assets/adbkey ~/.android/adbkey
adb kill-server
adb devices

To obtain shell sudo access, type get-su-bin and follow the instructions.

Finally, type reboot & and close the tool by pressing Ctrl +C or type exit or quit.

If everything goes right, it will boot up. And you can run adb devices on your computer to see if your DPT appears.

After then, you can do adb shell and then type su to verify if you have obtained the sudo access. You can now use adb install to install any packages. However, it does appear that all third party apps have super small font.

fw_updater_packer_unpacker - Automation to pack/unpack pkg

Note for developers: Absolutely do NOT exit 1 while your script (in pkg) has errors. This will create an infinite loop of "system start -> update via pkg -> shutdown -> restart -> update -> shutdown -> ...". I learned the hard way and there is no way to fix it (soft bricked).

To flash pkg with unverified signature, you need to modify the updater file at /usr/local/bin/

Check this README for more details.

To-Do List

Development Roadmap

Now we can enter diagnosis mode thanks to shankerzhiwu and his/her friend, we can explore more things! The things I am interested in:

  • Enabling ADB in normal Android mode
  • Allowing self-signed pkg (fw package) to flash
  • System language
  • Launcher modification (commandline figured)
  • Third-party app font size issue fix


  • Web interface hack
  • USB interface hack (shankerzhiwu and his/her friend at XDA did this! Great work!)
  • Build update package and flash (fails as we cannot bypass pkg validation)
  • Web interface testmode (fails as we do not have auth nonce and required private key K_PRIV_DT)
  • Official app (fails as the firmware updates purely rely on web interface API)

0x4 Other tips

Open settings via commandline

adb shell am start -a android.settings.SETTINGS

Switch language

Only three are supported: Chinese, English, and Japanese

adb shell am start -a android.settings.LOCALE_SETTINGS

Switch input method

adb shell am start -a android.settings.INPUT_METHOD_SETTINGS

If you saw error dialog Unfortunately, the iWnn IME keyboard has stopped, this is (potentially) due to the language switch that enables an extra input method. Just go in the Keyboard & input methods and only enable iWnnkbd IME.

Launcher app

DPT Launcher is funny. It uses ExtensionManagerService that scans through /etc/dp_extensions. Ideally we shall have an automated tool to add/remove icons (not a plan), but for now, a commandline approach is the following:

Re-mount your system to be writable (requiring sudo), and then use NoteCreator as a template:

> adb shell
$ su
# mount -o rw,remount /system
# cd /etc/dp_extensions
# cp -R NoteCreator MyTemplate
# cd MyTemplate

Then we need to change the filenames:

mv NoteCreator_extension.xml MyTemplate_extension.xml
mv NoteCreator_strings-en.xml MyTemplate_strings-en.xml
mv NoteCreator_strings-ja.xml MyTemplate_strings-ja.xml
mv NoteCreator_strings-zh_CN.xml MyTemplate_strings-zh_CN.xml
mv ic_homemenu_createnote.png ic_homemenu_mytemplate.png

Finally, we need to edit each file (use busybox vi file/path/filename):

  1. For MyTemplate_extension.xml (**** is the Android app intent name, e.g.,
<?xml version="1.0" encoding="utf-8"?>

<Application name="MyTemplate" type="System" version="1">
    <LauncherEntry name="MyTemplate" category="Launcher" uri="intent:#Intent;launchFlags=0x10000000;component=****;end" string="STR_ICONMENU_9999" icon="ic_homemenu_mytemplate.png" order="999"/>
  1. For each ****_strings-****.xml:
<?xml version="1.0" encoding="utf-8"?>
<resources xmlns:xsi="" xmlns:xsd="">
  <string name="STR_ICONMENU_9999">MyTemplate</string>
  1. You can upload a different png for icon ic_homemenu_mytemplate.png (must be 220x120 size)
  2. Make sure the files under MyTemplate are all permission 0644 (ls -la /etc/dp_extensions/MyTemplate/* and chmod 0644 /etc/dp_extensions/MyTemplate/*).
  3. Remove the database (cache) from the Extension Manager and allow it to rebuid the database:
cd /data/system
mv ExtMgr.db ExtMgr.db_bak
mv ExtMgr.db-journal ExtMgr.db-journal_bak
  1. Reboot

Guide to use Taobao PKG

(FYI, I personally prefer a clean system with changes I know, over using their PKGs with unknown changes.)

Still an ongoing disucssions at #24. Feel free to contribute if you have figured this out.

0xF Mission Impossible

Well, to bypass pkg validation, you can also try to decrypt the RSA key and generate corresponding private key, when we actually have enough computation resources and time to do it lol:

> openssl rsa -pubin -in -modulus -text

Public-Key: (2048 bit)
Exponent: 65537 (0x10001)