Pandora Box 3D SAGA Jailbreak
Now that we know How to add games to the Pandora Box , The team of Pandory Tool It offers us a tool that not only allows us to add games in a simple way to be installed in the internal SD or an external USB stick, but also allows us to Jailbreak the Pandora and fully access the Android system on which it is based.
Some Pandora 3D Saga models that we sell on kiboTEK are “No Nand” models, and the Pandory Tool does not support them. But in this kiboNEW we show you how to Jailbreak Pandory Tool in other ways.
Pandora 3D Nand and No Nand
Normally, Pandora has a 2 or 4 GB on-board Nand storage where the Android operating system and the Pandora application run, and an internal SD storage where the ROMs or games are stored. In the latest Pandora 3D SAGA models, in recent batches it is possible that the manufacturer has moved to No Nand models where both the operating system and the roms must be stored in the internal SD, from which the S812 motherboard boots directly. This could mean a small reduction in disk access performance, but it also has a great advantage as we will see later.
Pandora 3D SAGA Jailbreak
To know if your Pandora 3D SAGA is Nand or No Nand, you can access the recovery mode, as we teach later, and verify the partitions, or you can simply open Pandora's box (uuuuuhh…. 🙂), extract the SD from the motherboard and start the Pandora; If you start the system and your list of games appears empty then you have a Nand model, and if, on the contrary, the system does not start and nothing appears on the screen, then you have a No Nand model.
Before starting to do anything we have two news for you, one good and one bad:
First the bad: if you open the Pandora's box and extract the SD, feeling very sorry, you lose the guarantee.
And now the good news: in the Pandora No Nand, it is impossible to make a “brick” of the console because everything is in the SD. Therefore the most important thing is make an image of your SD first.
To make the SD image, it is only necessary to connect the SD in a PC and use dd in Linux or Win32 Disk Imager on Windows. Once the image is made, you flash it to a different SD with Balena Etcher or own Win32 Disk Imager , and then you test it on Pandora and check that everything starts up correctly.
Only when you have verified that your SD image is correct, can you continue reading….
….sure?…..
……………….really safe?…………….
Ok, so the first thing is to create the USB stick in Windows with the Pandory Jailbreak following the instructions in your Web. Basically " If the USB stick was drive O: - pandory.exe stick jailbreak O: / ”
So now we have two ways to jailbreak.
1. From a Linux PC
Introducing the SD in a PC with Linux the 3 partitions of the same will be recognized automatically and we can operate on the 3.
➜ ~ fdisk /dev/mmcblk0
Welcome to fdisk (util-linux 2.35.1).
The changes will only remain in memory, until you decide to write them.
Be careful before using the write command.
Command (m for help): p
Disk / dev / mmcblk0: 59.49 GiB, 63864569856 bytes, 124735488 sectors
Units: 1 * 512 sectors = 512 bytes
Sector size (logical / physical): 512 bytes / 512 bytes
I / O size (minimum / optimal): 512 bytes / 512 bytes
Disc Label Type: Two
Disk ID: 0x5c693951
Device Start Start End Sectors Size Id Type
/ dev / mmcblk0p1 1122304 2695168 1572865 768M 83 Linux
/ dev / mmcblk0p2 2711552 121634816 118923265 56.7G 83 Linux
/ dev / mmcblk0p3 221184 745472 524289 256M 83 Linux
The partition table entries are not in disk order.
Command (m for help): q
We mount the 3 partitions as root and also connect the USB pin and mount it anyway:
➜ ~ mkdir /mnt/saga
➜ ~ mkdir /mnt/saga/system
➜ ~ mkdir /mnt/saga/data
➜ ~ mkdir /mnt/saga/cache
➜ ~ mount /dev/mmcblk0p1 /mnt/saga/system
➜ ~ mount /dev/mmcblk0p2 /mnt/saga/data
➜ ~ mount /dev/mmcblk0p3 /mnt/saga/cache
➜ ~ mkdir /mnt/pandory
➜ ~ mount /dev/sdb1 /mnt/pandory
FUSE exfat 1.3.0
The mounting devices "mmcblk0" and "sdb1" may change depending on the disk configuration of your PC.
And now we start to launch the "update.sh" commands manually and adapting them to our partition mounts:
➜ ~ mv -n /mnt/saga/system/bin/dig /mnt/saga/system/bin/_dig
➜ ~ cp /mnt/pandory/pandory/autoexec.sh /mnt/saga/data/data/autoexec.sh
➜ ~ cp /mnt/pandory/pandory/network.sh /mnt/saga/data/data/network.sh
➜ ~ cp /mnt/pandory/pandory/dig /mnt/saga/system/bin/dig
➜ ~ cp /mnt/pandory/pandory/meta.bin /mnt/saga/data/data/meta.bin
➜ ~ cp /mnt/pandory/pandory/res.bin /mnt/saga/data/data/res.bin
➜ ~ cp /mnt/pandory/pandory/pandory.sh /mnt/saga/system/bin/pandory.sh
➜ ~ cp /mnt/pandory/pandory/pandorykey /mnt/saga/system/bin/pandorykey
➜ ~ mv -n /mnt/saga/system/etc/bootvideo /mnt/saga/system/etc/_bootvideo
➜ ~ cp /mnt/pandory/pandory/bootvideo /mnt/saga/system/etc/bootvideo
➜ ~ chown root:2000 /mnt/saga/system/bin/dig
➜ ~ chown root:2000 /mnt/saga/system/bin/pandory.sh
➜ ~ chown root:2000 /mnt/saga/system/bin/pandorykey
➜ ~ chmod 755 /mnt/saga/system/bin/dig
➜ ~ chmod 755 /mnt/saga/system/bin/pandory.sh
➜ ~ chmod 755 /mnt/saga/system/bin/pandorykey
➜ ~ umount /mnt/saga/system
➜ ~ umount /mnt/saga/data
➜ ~ umount /mnt/saga/cache
➜ ~ umount /mnt/pandory
➜ ~
And that's it, you just have to put the SD in the Pandora again, boot up and you will see the Pandory startup video
To confirm that the Jailbreak has been successful, press the Start button of the second player 5 times in a row, rather quickly.
2. From a Windows PC, ADB and the Pandora Recovery
It is possible to access Pandora Recovery in a simple way: with Pandora turned off and the internal SD inserted, we press the physical “Settings” button and turn on Pandora. Once the image with the Pandora logo appears, we can release the physical "Settings" button, and in about 10-15 seconds the Recovery will appear with the typical gutted android:
On the Windows PC we connect the USB stick with Pandory and modify the update.sh file to the following:
#!/bin/ash
busybox mount /dev/block/mmcblk0p1 /system;
busybox mount /dev/block/mmcblk0p2 /data;
##busybox dd if=/dev/block/mtdblock0 of=/data/mtdblock0.img;
##busybox dd if=/dev/block/mtdblock1 of=/data/mtdblock1.img;
##busybox mount /dev/block/mmcblk0p1 /sdcard/;
busybox mv -n /system/bin/dig /system/bin/_dig;
busybox cp /udisk/pandory/autoexec.sh /data/data/autoexec.sh;
busybox cp /udisk/pandory/network.sh /data/data/network.sh;
busybox cp /udisk/pandory/dig /system/bin/dig;
busybox cp /udisk/pandory/meta.bin /data/data/meta.bin;
busybox cp /udisk/pandory/res.bin /data/data/res.bin;
busybox cp /udisk/pandory/pandorykey /system/bin/pandorykey;
busybox cp /udisk/pandory/pandory.sh /system/bin/pandory.sh;
busybox mv -n /system/etc/bootvideo /system/etc/_bootvideo;
busybox cp /udisk/pandory/bootvideo /system/etc/bootvideo;
busybox chown root:shell /system/bin/dig;
busybox chown root:shell /system/bin/pandory.sh;
busybox chown root:shell /system/bin/pandorykey;
busybox chmod 755 /system/bin/dig;
busybox chmod 755 /system/bin/pandorykey;
busybox chmod 755 /system/bin/pandory.sh;
##busybox rm -rf /sdcard/skin;
##busybox cp -R /udisk/pandory/skin/ /sdcard/;
busybox rm -rf /udisk/pandory*;
busybox touch /system/pandory_was_here;
busybox umount /system;
busybox umount /data;
##busybox umount /sdcard;
busybox rm -rf /udisk/update.sh;
busybox sleep 5;
busybox reboot;
If you compare with the original update.sh you can see that we simply change the mount points and comment on some lines that will not work in a Pandora 3D Saga No Nand.
We extract the Pandory USB stick from the PC and connect it to the lower USB port of the Pandora in Recovery mode.
At the same time we connect the male-male blue usb cable that comes with the Pandora, one end in the upper USB port of the Pandora and the other end to the Windows PC.
Pandora Recovery has ADB activated by default, so we can connect directly from the PC (we assume that ADB is already installed on the Windows PC):
➜ ~ adb devices
List of devices attached
12345678900 recovery
➜ ~ adb shell
# / sbin / busybox mount
rootfs on / type rootfs (rw)
tmpfs on / dev type tmpfs (rw, nosuid, relatime, mode = 755)
devpts on / dev / pts type devpts (rw, relatime, mode = 600, ptmxmode = 000)
proc on / proc type proc (rw, relatime)
sysfs on / sys type sysfs (rw, relatime)
adb on / dev / usb-ffs / adb type functionfs (rw, relatime)
# / sbin / busybox cat / proc / partitions
major minor #blocks name
179 0 62521344 mmcblk0
179 1 786432 mmcblk0p1
179 2 59461632 mmcblk0p2
179 3 262144 mmcblk0p3
8 0 15564800 sda
8 1 15563776 sda1
#
Now we mount the USB skewer:
# /sbin/busybox mount /dev/block/sda1 /udisk
# cd /udisk/
# /sbin/busybox ls
README.md _update.sh pandory update.sh update.zip
#
And finally we make the modified uptade.sh run:
# /sbin/busybox ash /udisk/update.sh
Done
# %
The Pandora will restart and at that moment you disconnect the USB plug and the blue male-male USB cable.
And this is to, that is to, and that is all folks!
Now what can we do?
We can access the full Android, the applications
If the Pandora is the Wifi model
the jailbreak allows us to connect from our PC by ADB or by telnet on port 4444 through the network:
➜ ~ telnet 192.168.1.135 4444
Trying 192.168.1.135…
Connected to 192.168.1.135.
Escape character is ‘^]’.
~ # exit
Connection closed by foreign host.
➜ ~ adb connect 192.168.1.135
already connected to 192.168.1.135:5555
➜ ~ adb shell
root @ n200: / # df
Filesystem Size Used Free Blksize
/ dev 397.9M 164.0K 397.8M 4096
/ mnt / asec 397.9M 0.0K 397.9M 4096
/ mnt / obb 397.9M 0.0K 397.9M 4096
/ storage / external_storage 397.9M 0.0K 397.9M 4096
/ system 743.9M 646.9M 97.0M 4096
/ data 55.7G 54.9G 847.3M 4096
/ cache 248.0M 264.0K 247.7M 4096
/ mnt / shell / emulated 55.7G 54.9G 847.3M 4096
/ swap_zram0 484.3M 20.0K 484.3M 4096
/ data / lib 743.9M 646.9M 97.0M 4096
/ data / vendor 55.7G 54.9G 847.3M 4096
root @ n200: / # cat / proc / partitions
major minor #blocks name
253 0 512000 zram0
179 0 62521344 mmcblk0
179 1 786432 mmcblk0p1
179 2 59461632 mmcblk0p2
179 3 262144 mmcblk0p3
root @ n200: / # mount
rootfs / rootfs ro, relatime 0 0
tmpfs / dev tmpfs rw, nosuid, relatime, mode = 755 0 0
devpts / dev / pts devpts rw, relatime, mode = 600, ptmxmode = 000 0 0
proc / proc proc rw, relatime 0 0
sysfs / sys sysfs rw, relatime 0 0
debugfs / sys / kernel / debug debugfs rw, relatime 0 0
tmpfs / mnt / asec tmpfs rw, relatime, mode = 755, gid = 1000 0 0
tmpfs / mnt / obb tmpfs rw, relatime, mode = 755, gid = 1000 0 0
tmpfs / storage / external_storage tmpfs rw, relatime, mode = 775, uid = 1000, gid = 1023 0 0
adb / dev / usb-ffs / adb functionfs rw, relatime 0 0
/ dev / block / mmcblk0p1 / system ext4 ro, noatime, nodiratime, noauto_da_alloc, data = ordered 0 0
/ dev / block / mmcblk0p2 / data ext4 rw, nosuid, nodev, noatime, nodiratime, noauto_da_alloc, data = ordered 0 0
/ dev / block / mmcblk0p3 / cache ext4 rw, nosuid, nodev, noatime, nodiratime, noauto_da_alloc, data = ordered 0 0
/ dev / fuse / mnt / shell / emulated fuse rw, nosuid, nodev, relatime, user_id = 1023, group_id = 1023, default_permissions, allow_other 0 0
/ dev / block / zram0 / swap_zram0 ext2 rw, relatime, errors = continue 0 0
/ system / usr / lib / data / lib ecryptfs ro, relatime, ecryptfs_fnek_sig = 0f39bfb24d76525f, ecryptfs_sig = 01ca0c2b29e731af, ecryptfs_cipher = aes, ecryptfs_key_bytes = 32 0 0
/ data / edata // games / data / data / vendor ecryptfs rw, relatime, ecryptfs_sig = f8fc24735d97e538, ecryptfs_cipher = aes, ecryptfs_key_bytes = 32 0 0
root @ n200: / # exit
➜ ~
Now we can install APKs from our PC using ADB:
➜ ~ adb install F-Droid.apk
Performing Push Install
F-Droid.apk: 1 file pushed, 0 skipped. 0.2 MB/s (7640532 bytes in 48.462s)
pkg: /data/local/tmp/F-Droid.apk
Success
➜ ~ adb install netflix-4.16-200217-release.apk
Performing Push Install
netflix-4.16-200217-release.apk: 1 file pushed, 0 skipped. 0.2 MB/s (26706917 bytes in 151.216s)
pkg: /data/local/tmp/netflix-4.16-200217-release.apk
Success
Taking into account that the Android of the Pandora is a kit kat 4.4.2, perhaps we should look for somewhat older APKs. For example, for Netflix download it from Here .
We can now watch Netflix from our Pandora!
And enjoy! And thanks once again to the team of Pandory Tool they well deserve a Coffee