Skip to content

USB gadget and ADB expectations

Stock S89 sequence

The pre-jailbreak /rom/etc/init.d/S89usbgadget.sh creates configfs gadget amlogic:

Property Value
VID:PID 18d1:4e26
Manufacturer amlogic
Product p212
Serial devinfo --serial, with fallback 0123456789ABCDEF
Configuration initially rndis, then changed to adb
MaxPower 500
Functions rndis.rndis and ffs.adb
UDC ff400000.dwc2_a

It mounts FunctionFS at /dev/usb-ffs/adb, links ffs.adb into the configuration, and attempts to start /usr/bin/adbd and /usr/bin/usb_monitor.

The stock helper also contains an unused usb_net_ipconfig function that would assign 192.168.5.1 to usb0; the call is commented out.

Important firmware reality

Observed in both live and pre-jailbreak rootfs inventories: neither /usr/bin/adbd nor /usr/bin/usb_monitor exists in this 44.90 userspace dump. The script retains Android gadget machinery, but the expected daemon is absent. A FunctionFS mount point alone is not an ADB service.

Live state confirms:

  • gadget directory amlogic exists;
  • FunctionFS adb is mounted;
  • configuration string is adb;
  • serial matches the device;
  • UDC is empty in the captured state, so the gadget was not bound at that moment.

This explains why generic ADB instructions fail on this unit. The useful acquisition channel on the modified unit is the third-party SSH service, not stock adbd.

Live overlay hook

The live S89 is a live-only jailbreak replacement. It starts /usr/lib/capsula-root/service, records diagnostics under /data/.capsula-root-state, and then sources /rom/etc/init.d/S89usbgadget.sh. It does not supply the missing stock adbd.

The separate userspace-jailbreak project can install adbd in other images; that must not be retroactively treated as stock behavior for this device dump.

Host-side implications

  • VID 18d1 identifies an Android-style gadget, not the Amlogic burning protocol.
  • U-Boot burning mode is a different, temporary 1b8e:c003 persona available during cold boot.
  • RNDIS and ADB descriptors do not imply that IP forwarding, ADB authentication, or a functional ADB endpoint is available.
  • Do not use fastboot: this stock path has no fastboot function, and earlier hardware testing found partial DATA-phase handling can wedge the gadget.

Runtime UDC state and monitor logic

voice-agent:0x1233f0 contains the userspace monitor that /usr/bin/usb_monitor would otherwise provide. It checks /sys/class/android_usb/android0/state for DISCONNECTED and, when /sys/kernel/config/usb_gadget/amlogic/UDC does not already contain ff400000.dwc2_a, writes that controller name.

The live read-only capture showed DISCONNECTED, an empty UDC file, and no adbd/usb_monitor binaries. Syslog had no UDC/adbd errors. Therefore the stock monitor/write condition was met, but the write was not active or did not persist. Static evidence does not prove which asynchronous path suppressed it; the meaningful result is that ADB is unavailable, not that the gadget works intermittently.