NEONWIRE OS
A self-built cyberpunk operating system, hand-brought-up on an undocumented $40 white-label Android tablet — from raw eMMC to a touch UI that boots from its own neon splash, joins Wi-Fi, and synthesizes a full soundtrack in real time on its own CPU.
What this is
The DigiLand DL7006-KB is a throwaway 7‑inch tablet built around a MediaTek MT8127. No source, no support, locked into a stale Android 7. Its one weakness: an unprotected bootloader. That crack was enough to take the whole device — dump it, boot our own Linux on it, give it a face, and keep going until it did things the vendor never shipped. The result, NEONWIRE OS, is a neon framebuffer UI drawn straight to the panel by a single static Rust binary — no X, no Android, no toolkit — that now runs Wi-Fi, SSH over Tailscale, a live camera pipeline, and an on-device music engine.
The hardware
How it was taken — seven phases
Own the flash
DoneAttached the unprotected preloader with mtkclient and dumped the full 7.1‑GiB eMMC — a complete, hash-verified backup and a guaranteed way back from any mistake. Nothing after this is irreversible.
Own the boot
DoneUnpacked the MTK boot / recovery / LK images, mapped every partition offset, and built custom boot images — ADB-unlocked, setup-wizard removed. We now controlled what ran at startup.
Self-built Linux
DoneWrapped the stock 3.18.35 kernel around our own busybox initramfs and a USB‑ACM gadget — a real root shell over serial, eMMC + SD mounts, and a writable framebuffer. A minimal Linux we own, top to bottom.
Give it a face
DoneA from-scratch framebuffer engine with a baked JetBrains‑Mono bitmap font, neon glow, panels and CRT scanlines — later rewritten in Rust (neonwire) as a single static ARM binary. It reverse-engineers the command-mode panel and a type-A touch driver to put a real touch UI on glass, streamed to the SD in ~2 seconds per iteration. No reflash to iterate.
Make it the OS
DoneEmbedded the UI in the initramfs so init launches it at boot — the device comes up straight into NEONWIRE, with a crash-loop guard that falls back to a recovery UI. Then reverse-engineered the MTK logo.bin format and flashed a neon boot splash over the vendor's. The entire boot chain, first frame to live OS, is ours.
Bring it to life
DoneThe wall came down. Reverse-engineered the on-die CONSYS radio into working Wi-Fi + SSH + Tailscale — reachable from anywhere. Then a camera pipeline off a raw MIPI sensor, power management, and — the showpiece — a full audio + music stack: the tablet now computes its own soundtrack in real time. The throwaway tablet does things its vendor never shipped.
Give it a mind
DoneCross-compiled a whole agent runtime — zeroclaw, 28 MB static armv7-musl — and ran it on the tablet, behind a local HTTP gateway the shell talks to. There's a touch app with a wake word and speech-to-text, and, running unattended, a heartbeat that reads the device's own logs every 30 minutes and writes up what it finds. The tablet stopped being only a thing we operate. It started reporting on itself.
Sound — the tablet computes its own music
The DL7006 has no audio framework — just a bare ALSA device on an MT6323 codec, no libasound, no mixer tools. NEONWIRE drives it directly: a hand-rolled raw-ioctl PCM writer on hw:0,5, and native controlC0 mixer calls to power the speaker amp. On top of that sits a port of a Strudel pattern engine — so the tablet doesn't play files, it synthesizes them: it evaluates the code of a song and renders every voice, live, on one Cortex-A7 core.
Mind — the tablet audits itself
The last thing a 2017 bargain tablet is supposed to run is an AI agent. The stock ARM builds are glibc, so this one was cross-compiled from source for armv7-musl with a lean feature set — a 28 MB static binary, built in seven minutes, that runs natively next to the shell and answers on 127.0.0.1:42617. NEONWIRE's ASSISTANT app is its face: a wake word, push-to-talk, speech-to-text, and a keyboard. But the interesting part isn't the chat — it's what runs when nobody's watching.
It earns its keep. In its first unattended runs it worked out that Tailscale's router integration is broken because iptables doesn't exist on this image and a 3.18 kernel can't do what the modern client asks; it correlated a network blip against one it had filed hours earlier and concluded the pattern was upstream resets rather than a stuck daemon; and it flagged wmt_loader's exit 255 as noise that would mask a real loader failure — a fair critique of our own boot script.
Then it caught us. It reported neonwire exited rc=143 after 16010s, explicitly separated it from the intentional restart it had already catalogued, and asked who sent the SIGTERM. That was us, hot-swapping the binary over SSH. The watchdog noticed the operator.
It runs deliberately declawed: supervised, thirteen read-only commands, no delegation, filesystem access limited to the log directory and its own workspace. The assistant you talk to has full privileges; the thing that wakes at 3 AM does not.
Hardware ghosts we exorcised
Taps registered internally but nothing moved. The panel is a type-A multitouch device reporting ABS_MT_POSITION frames — the release-latch stuck after the first touch. Fix: fire on the BTN_TOUCH press edge, commit on the next SYN_REPORT.
The UI updated in memory but the screen sat still. The LCM is a command-mode MIPI panel — it only pushes a frame on a pan/flip, never on a plain memcpy. Fix: cycle three hardware buffers and FBIOPAN_DISPLAY every frame.
Music played but no sound came out. The speaker amp is a mixer control the old code toggled through a chroot's amixer — gone after a reboot. Fix: set it natively via controlC0 ioctls, decoding this kernel's 712-byte ALSA ABI struct by hand (arm32 aligns it differently than x86).
The agent gateway refused to start with a bare Address not available. Nothing on this device had ever needed lo — every packet went out over wlan0 — so the minimal init never brought loopback up, and binding 127.0.0.1 simply failed. Fix: ifconfig lo up, now step 0 of the boot script.
The log-triage heartbeat ran for hours, then a reboot quietly killed it. The worker only exists inside the agent's daemon command; the boot script launched gateway start, which serves requests but never ticks. The fix existed — in the git repo, never copied to the device. Every surface still looked green. Fix: deploy the script, and add a liveness line that reads the daemon's own state file, because a watchdog that stops produces no logs to notice it by.
The wall we broke
Wi-Fi. For a long time the integrated CONSYS block was the one thing that beat us — chip ID read zero, its rails and bus clock never came up, and the stock kernel ships with no way to load a driver. The break came from reverse-engineering the exact firmware-download and power-on handshake the vendor's userland performs, and replaying it from our own tools. NEONWIRE now brings the radio up on boot, joins a saved network, and runs dropbear SSH over Tailscale — the device is reachable from anywhere on Earth. wlan0 online