[Android Software/Hacking General [Developers Only]] ivop:
Hi,

Because I don't run Windows nor NetBSD, I rewrote rkflash from scratch with the use of libusb-1.0, so you can now read and write your rk2818-based tablet's flash memory under Linux (also w/o the need to root your tablet). Credit for reverse-engineering the protocol goes to the original author of rkflash (see source).

Small guide

- unzip the file

- compile

Linux (Debian, Ubuntu, ...)

sudo apt-get install libusb-1.0-0-dev
gcc -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall -s

Mac OS X (thanks to surfer63, binary here)

sudo port install libusb
gcc -I/opt/local/include -I/opt/local/include/libusb-1.0 \
-L/opt/local/lib -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall

Preparation

- powerdown your tablet

- disconnect all cables

To get into flash mode differs for many tablets. Google around or use trial and error :)

- insert the USB cable in computer

- hold vol+ (or put on/off/locked-switch in the locked position)

- insert the other end of your cable in the tablet

- wait a few seconds

- release vol+

Now if you run lsusb, the following line should appear:

Bus 001 Device 044: ID 2207:281a (290a for rk2918 based tablets)

Bus and device number may be different. The screen of your tablet stays black.

The USB device must be readable and writable for the user running rkflashtool. If that's not the case, you'll see an error like this:

$ ./rkflashtool b
libusb couldn't open USB device /dev/bus/usb/001/048: Permission denied.
libusb requires write access to USB device nodes.
rkflashtool: fatal: cannot open device

This can be fixed in several ways (chmod, run as root, udev rules) but that's beyond the scope of this posting. For now, chmod 666 the device mentioned in the error message.

Usage of rkflashtool

$ ./rkflashtool
rkflashtool: fatal: usage:
rkflashtool b	reboot device
rkflashtool r offset size >file	read flash
rkflashtool w offset size <file	write flash

offset and size are in units of 512 bytes

On my tablet, the boot partition starts at offset 0x8000 (in blocks of 512 bytes)

Its size is 0x2000 blocks

To backup the partition, issue:

$ ./rkflashtool r 0x8000 0x2000 >boot.img.backup
rkflashtool: info: interface claimed
rkflashtool: info: reading flash memory at offset 0x00008000
rkflashtool: info: reading flash memory at offset 0x00008020
.......
rkflashtool: info: reading flash memory at offset 0x00009fe0

To write a new boot.img or an old backup back to the device:

$ ./rkflashtool w 0x8000 0x2000 <boot.img.backup
rkflashtool: info: interface claimed
rkflashtool: info: writing flash memory at offset 0x00008000
rkflashtool: info: writing flash memory at offset 0x00008020
.......
rkflashtool: info: writing flash memory at offset 0x00009fe0

You can find a list of all partitions of your tablet in the HWDEF file, which is inside the update.img for your tablet. If no such file is available, you can also look at /proc/cmdline on a running device (either through adb or a terminal app running on the device itself). Depending on the tablet, you might need root access to view /proc/cmdline. Another option is dumping the first 0x2000 blocks of nand flash by issuing rkflashtool r 0x0000 0x2000 >parm. View the file with hexedit, xxd, or a similar program. The kernel parameters contain a description of several mtd partitions (sizes and offsets).

After reading and writing at will, you can reboot your tablet by issuing

./rkflashtool b

Note that if your tablet has an on/off/locked-switch and it is still in the locked position, rebooting won't work.

If the file you are writing is smaller than the specified size, the rest is padded with zeroes. If it's bigger, it will be truncated. This is different from rkflash, which will overwrite blocks beyond the partition size.

rkflashtool does not support flashing a new bootloader directly.

If you have a different tablet, please try rkflashtool b and r first before flashing (w) something new.

Standard DISCLAIMER with regard to bricking your tablet applies.

Enjoy! :)

EDIT: better build instructions, clean up text

EDIT2: works on rk2918 tablets too (tested on Arnova 7 G2) if you change the USB product id from 0x281a to 0x290a before compilation

EDIT3: released version 2 of rkflashtool. now supports rk2918 tablets out of the box. if it doesn't find one, it falls back to rk2808/rk2818. also, updated the wording a bit.

EDIT4: new mac osx binary

EDIT5: more ways to find offsets and sizes of partitions on your tablet

EDIT6: small emphasis changes above and...

version 1 is here ONLY for archival purposes or if version 2 does not work on your rk28xx tablet. In all other cases, you need to download rkflashtool-v2.zip