ADB access on GameStick

I'm on the quest to make PlayJam GameStick micro consoles usable again. Building a replacement server is underway, and collecting game information is nearly finished - but not much progress has been made obtaining the actual .apk files.

37 apks could be downloaded from the PlayJam Amazon AWS S3 bucket, but the rest of them are not accessible although we know the URLs. They are probably only accessible with a temporary access token that the GameStick server once generated.

We contacted a number of developers and asked for the apks, but most don't have them anymore - they are lost. Some developers don't even remember having programmed for the GameStick :) And many don't react on e-mails.

The last resort is to get the .apk files off the GameSticks that have them installed. PlayJam wanted to prevent that, so they locked the GameStick down, preventing access to the Android settings, disabling the adb daemon and even removing the functionality to sideload games (which was available in early firmwares).

Telnet server

Simply starting the Android settings or adbd via the advanced launcher TOFU plugin did not work. I needed to find a way to inspect the GameStick and run applications on them to see what worked. Because adb access was not available, I decided to build my own telnet server that would run as TOFU plugin on the GameStick.

I found a nice Python 2 socket server example and used that as base to build my own server that I could connect to with a telnet client. Development was easy because I could run the server locally. Only at the end I built a TOFU plugin that simply started the telnet server script.

One thing I learned was that the shell (my server) needs to take care of storing the current working directory, and also needs to implement change directory commands - those cannot be delegated to the system. After 2.5 hours I had a telnet server that ran on the GameStick, and I could finally inspect the file system and run programs:

cweiske:~/dev/gamestick/sync/tofu-plugin> telnet gamestick 5023
Trying 192.168.3.41...
Connected to gamestick.
Escape character is '^]'.
/> ls
acct
backup
boot
cache
[...]
/> whoami
u0_a40
/> am start -n com.android.settings/.Settings
[Errno 13] Permission denied

Now I could try to open the Android settings (which still fails) and start adbd - it turned out that running programs on the GameStick is only possible as root:

$ telnet gamestick 5023
Trying 192.168.3.41...
Connected to gamestick.
Escape character is '^]'.
/> su -c start adbd
/> quit
Connection closed by foreign host.
 
cweiske:~/dev/gamestick/sync/tofu-plugin> adb connect gamestick
already connected to gamestick:5555
cweiske:~/dev/gamestick/sync/tofu-plugin> adb shell
root@android:/ # pwd
/
root@android:/ # ls /data
GameStick
GameStickCache

Plugins

The result of this endeavour are two TOFU plugins:

Update 2023-06: An adbd-enabling firmware image is available at codeberg.org/gamestick-fans/firmware-adb-enabler/ - see GameStick: Black screen after OOBE.

Starting a telnet server with a TOFU plugin Starting adbd via TOFU plugin

Written by Christian Weiske.

Comments? Please send an e-mail.