Thread by @thel3l

We reversed the Rabbit R1 🐇 and got it to run on our phones!

This gives us future OTA updates, access to new features without a device + works perfectly without root/system perms!

(Blog post below)

Here's how we did it (article by @MishaalRahman):

androidauthority.com/rabbit-r1-besp…

First off, the R1 is absolutely an Android app. It is actually three applications sitting atop the Android Board Support Package from MediaTek:
- RabbitIme.apk
- R1SystemUpdater.apk
- RabbitLauncher.apk

There are no system level modifications, and it even ships with stock apps.

The reason it was trivial to get the app running on any android device was because Rabbit didn't initially bother checking the headers being sent from the device.

It appears that the first batch devices were shipped from the factory with ADB enabled.

We were able to dump and analyze the firmware. Because of their implementation, the only way for an old device to communicate with the server is to do an OTA.

Patching the existing tools to apply a delta OTA to a base image was the hardest part of the project.

We had issues with applying a delta payload to the image, b one of the gang actually ported go-payload-dumper to work with delta updates!



Once that was done, it was just a matter of applying the update, and pulling the new launcher app.github.com/EmilyShepherd/…

Also, just for kicks, I turned it into a easy to run script for future OTAs:

And finally something for the future:
94f835a8f06f59ec4477325b3a5d915200ec7999df3c2bf249c3e00d2a0d4bda

Greetz to these amazing people: @EmilyLShepherd @ChromMob @uwukko @schlizzawg @MarcelD505, has been a fun week :D

More details on some of the things we had to deal with:

https://twitter.com/MarcelD505/status/1786713791159320636