Jailbreaking RabbitOS (The Hard Way)

David Buchanan (aka retr0id) describes a method for gaining a root shell on the Rabbit R1 without unlocking its bootloader or writing to internal storage. He says the RabbitOS app is an Android 13 AOSP kiosk app that talks to the cloud over JSON websockets, and that he bought an R1 on eBay for £122. Using a USB bootloader mode and a custom Download Agent payload loaded into DRAM, he hooks the boot process so that a custom boot image is substituted for the original after Android Verified Boot checks pass. The method keeps all changes in memory, so a reboot restores the device to its original state.