What is SSH: SSH is an encrypted across the wire method of opening a console on a remote host over a network. Actually that’s one of many things that SSH can do. Basically if you ssh to a host, you have a CLI console for that host.
SSHelper is one “ssh server” that you can run on your FAW. It may have challenges on Android 10+ but is working on my Android 10.
Interested:
Somehow find and install SSHelper. (Play, it’s main website SSHelper)
Connect your FAW to your common network (wifi) that your PC/Mac is connected to.
Use advanced settings on FAW to find the FAW’s IP address.
From your Linux host run “ssh -p 2222 ”. When prompted, the default password is “admin”. Mac’s have their own ssh client (connecting from), and a common Windows ssh client is “putty”.
(All TCP servers including ssh listen on a port. SSHelper listens on a non-standard port 2222 hence the -p bit.)
Great, you’re connected…now what can you do?
1st - open several different connections to the same FAW…handy.
Here’s a stream of a connection of mine that I thought would show some powerful things:
b???r@cerberus:~$ ssh -p 2222 192.168.11.195
SSHelper Version 13.2 Copyright 2018, P. Lutus
Default password is “admin” (recommend: change it)
b???r@192.168.11.195’s password:
APPLLP_9:4.9.188+
$ uname -a
Linux localhost 4.9.188+ #1 SMP PREEMPT Sat Oct 8 19:54:25 CST 2022 armv7l Android
$ free -g
total used free shared buff/cache available
Mem: 1 0 0 0 0 0
Swap: 0 0 0
$ pm list packages
package:com.mediatek.gba
package:com.mediatek.ims
…
package:com.wapi.wapicertmanager
package:com.wiite.dbf.wiitedesktopsettings
$ getprop ro.build.version.release
10
$ cat /proc/cpuinfo
processor : 0
Processor : ARMv7 Processor rev 4 (v7l)
model name : ARMv7 Processor rev 4 (v7l)
BogoMIPS : 40.62
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
processor : 1
Processor : ARMv7 Processor rev 4 (v7l)
model name : ARMv7 Processor rev 4 (v7l)
BogoMIPS : 26.08
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
Hardware : MT6737
Revision : 0000
Serial : 0000000000000000
Odd, the above looks like DUAL CORE having just cpu 0 and 1
#odd way to find how many “disks” this device has
$ ls /dev/block/|grep mmc|cut -c -7|sort -u
mmcblk0
#lets see if we can write anywhere
$ cd SDCard/Download/
$ touch hello
$ ls -l
total 31564
-rw-rw---- 1 root everybod 8881348 Jan 14 18:17
F-Droid.apk
-rw-rw---- 1 root everybod 23400514 Jan 15 14:49
SSHelper.apk
-rw-rw---- 1 root everybod 0 Jan 15 15:39
hello
#Android locks down different directories.
#I am not sure what ones are open.
#I can see the browser and I wrote to the above and I installed those APKs.
#So I think this is one way to sideload APKs.
#here’s some more…I have tested writing to Music, more below.
0_a85@localhost:~$ ls
SDCard
u0_a85@localhost:~$ cd SDCard
u0_a85@localhost:SDCard$ ls
Alarms Download Notifications Ringtones
Android Movies Pictures clockskin
DCIM Music Podcasts
#note !/SDcard and /sdcard lead to the same place where perhaps its all
#writeable?
$ cd /sdcard
u0_a85@localhost:sdcard$ ls
Alarms Download Notifications Ringtones
Android Movies Pictures clockskin
DCIM Music Podcasts
#exit the ssh session
$ exit