QNX

BlackBerry PlayBook uses QNX. The emulator is x86 version, and the real device is armle-v7 version.

Filesystem

BlackBerry PlayBook uses qnx6 powersafe filesystem. Linux doesn't support mounting this filetype yet (partition types used are 0xb1, 0xb2, 0xb3, 0xb4). To mount the BlackBerry simulator, download and Install to VMWare Player: "QNX® Software Development Platform 6.5.0 [Build 201007091524] — QNX Neutrino RTOS Installation and Boot CD. [X86-only for APIC chipsets] " or if you want to have completeverything, download "QNX® Software Development Platform 6.5.0 [Build 201007091524] — Full Installation DVD [All hosts]" from

http://www.qnx.com/download/group.html?programid=20905

Install the QNX OS, add the PlayBook simulator as a second harddrive. Then you can play around with the filesystem (including adding setuid binary to root it). Unfortunately no one has found a way to get Playbook firmware image.

File System Hierarchy

Shared documents are stored in /accounts/shared/
Applications binary and resources are installed in /apps/appname.id/, for example: /apps/sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0. Inside the directory is the extracted bar file
Applications data are stored in /accounts/1000/appname.id/. Inside this there are several directories:
- app which is a symbolic link to the application binary and resource files
- shared which is a symbolic link to shared documents (if the app requested for permission to access shared documents)
- tmp for temporary storage
- logs contains log files (for native, the file name is log, for air the files names are air-log and air-trace)

ARM Binaries

You can ssh to playbook using blackberry-connect and an ssh client. One thing you will notice is that the permission of most binaries is set that it can only be run by root (for example: ps and ifconfig), You can copy arm7le binaries from the momentics SDK (not from RIM website, from QNX website) to the playbook.

Links: playbook