www.cmw.me

*Update 2/25/2013*

- I wrote a cleaner patch for this. You can obtain here http://pastie.org/private/ytfazol0k6nkgzo6zcjb0g and it works on all version of the simulator.

After working on iEmu all day I decided to take a quick break and root the Playbook simulator. I figured this would at least give me some knowledge of the device. It also helps that the simulated version is actually an x86 emulated version of qnx6. After booting it a few times and playing around I was able to login via ssh to the devuser account which is allowed by default but requires some effort.

To access the dev user account you will need the following:
- Blackberry Playbook Simulator (comes in the playbook air sdk)
- Use ssh-keygen to generate a 4096 bit key pair.
- If your using putty you will need to convert the private key to putty's format to use it.

Open a command prompt and run :
blackberry-connect IP_FOR_SIMULATOR -password playbook
If you did it right it should look like the following picture

Now you can connect to the simulator IP using putty and supplying your generated private key. Once you have logged in create a file called r.sh in the devuser home directory. It should contain the following:
#!/bin/sh
cp /usr/bin/setuidgid /tmp
chmod 6755 /tmp/setuidgid

Once you have created this file make sure to set it executable by typing chmod 755 r.sh then you can shut down the VM and proceed with patching the vmdk. Download the patch from here and extract it in the playbook simulator directory and run ./root.bat which will patch the vmdk file to run r.sh. It will look like the following:

Now startup the simulator again and if everything was done correctly you should be able to gain root by typing /tmp/setuidgid root /bin/sh

Now any time you need root just run setuidgid command and your good. First thing you can do is open up the file /pps/services/navigator/wallpaper and change the path for the background to your own custom image... like this!

- Cmw