hacking – DinoDevs

Back in 2019, I bought a cheap Windows 10 tablet, the Chuwi Hi10 Air. Although Windows in tablet mode offers a very nice touchscreen experience, the low specification of the Hi10 Air makes it quite slow by today’s standards. For this reason, I started searching for alternative operating systems to improve the performance. After successfully testing several Linux versions, I found a guide about installing Android and I thought to give it a go, thus I got the suggested bios file and flashed it on my Chuwi, and then… nothing…

I searched on the Chuwi forum and found a little information on what to use to flash new bios to unbrick my device. Since the bios chip was on the motherboard, I planned to use the CAMP bios flash method. The first thing to do was to buy a USB programmer for the bios chip. I found an “EEPROM BIOS USB Programmer CH341A + SOIC8 Clip + 1.8V Adapter + SOIC8 Adapter Kit” on eBay for $12 with free shipping which seemed exactly what I needed. I bought one and waited for it to arrive. Additionally, I found the appropriate Chuwi Hi10 Air BIOS for my model number (found at the back of the device) at the Chuwi forum and saved it.

*You shall now be called the “Jenga BIOS programmer*“!
The CH341A programmer with the needed adapters is attached.

A few months later (it takes 1-2 months for me to get my orders from China) I received the programmer, I assembled it based on some images I found on a Chuwi flash guide and I was ready. Since the proposed guides used some questionable untrusted signed programs on Windows, I thought to give myself a break and just use Linux instead. I booted by Ubuntu and installed `flashrom`:

sudo apt install flashrom

Based on the guide I saw the BIOS flashing steps were simple:

Buy an appropriate chip programmer
Download the appropriate BIOS file
Disassemble the tablet (be careful not to break the screen)
Unplug the battery from the motherboard
Clamp programmer on the BIOS chip
Program the BIOS chip
Detach the programmer & connect the battery cable back to the motherboard
(optionally) Try to power on the tablet and see if it boots up
Assemble the tablet
Install the OS of your preference

I disassembled the tablet and unplugged the battery cable. Now it was time to connect the programmer on the chip. Be sure to clamp it correctly, it may take some tries.

*Clamp dat chip!*
The CH341A programmer attached to the Chuwi’s BIOS chip.

To be sure that the clamp is attached correctly, first try to read the BIOS already flashed on the chip. Here is an example of an incorrect connection that is not able to read from the chip:

bannana@thanos:~/$ sudo flashrom --programmer ch341a_spi
flashrom v0.9.9-r1954 on Linux 4.15.0-130-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop… OK.
No EEPROM/flash device found.
Note: flashrom can never write if the flash chip isn't found automatically.
bannana@thanos:~/$

Clamp correctly the programmer and try again. After a successful connection, it’s time to flash the correct BIOS for my device that I got from an official source on the forum. My BIOS file was `BIOS_1906.BIN`, thus I called once again the `flashrom` with the BIOS file to flash:

bannana@thanos:~/$ sudo flashrom --programmer ch341a_spi -w BIOS_1906.BIN 
flashrom v0.9.9-r1954 on Linux 4.15.0-130-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
Found GigaDevice flash chip "GD25LQ64(B)" (8192 kB, SPI) on ch341a_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.
bannana@thanos:~/$

Success! Now my stupidly slow tablet boots!

Please be careful when closing the tablet. If during the disassembly one of the magnets is unseated, be sure to place them with the correct polarity (to match the polarity of the magnetic keyboard). Additionally, do not forget to place the power and volume buttons at their respective place.

Conclusion

Flashing the bios on the Chuwi was relatively easy assuming that you have the correct tools. Acquiring the appropriate tools and software though, requires research and thus time.

What is monitor mode?

Putting your network card in monitor mode allows you to capture all the wireless traffic in the surrounding area. Monitor mode can be used to detect nearby devices, where they are connected, capture their MAC addresses (which can be used to identify the device), or even monitor network traffic of unprotected networks. Thus, monitor mode is essential for wireless network hacking.

The TL-WN722N

TL-WN722N is a nice, easy-to-use, and relatively cheap wireless USB adapter that can be used to monitor wireless channels. But there is one problem, for the v2 and v3, the default driver on Debian-based systems (like Ubuntu or Kali Linux) does not work as intended. Let’s fix it!

Fixing TL-WN722N v2 & v3 monitor mode on Debian-based systems

Prepare your system

The first thing to do is make sure our apt is updated and also that the required programs are installed:

sudo apt update
sudo apt install bc
sudo apt install linux-headers-$(uname -r)
sudo apt install build-essential git dkms -y

Get and build the right driver

A working driver for your TL-WN722N v2 or v3 exists on Aircrack-ng’s Github. You can download the driver and compile it.

cd ~/Downloads
git clone https://github.com/aircrack-ng/rtl8188eus
cd rtl8188eus
make

Alternatively, you may also use a driver from lwfinger’s Github.

Blacklist current driver

To disable the current not working driver from loading after reboot, blacklist it.

sudo sh -c "echo 'blacklist r8188eu' >> /etc/modprobe.d/realtek-wn722n-fix.conf"

Permanently install the working driver

Now the only thing left to do is install the driver we compiled:

cd ~/Downloads/rtl8188eus
sudo make install
sudo modprobe 8188eu

Then reboot the system and check if the monitor mode works.

Reverting back to the old driver

If you for any reason want to enable back the old not working driver, just remove the black list file.

sudo rm /etc/modprobe.d/realtek-wn722n-fix.conf

Tag: hacking

BIOS Flashing on Chuwi Hi10 Air