yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] relsyou:
Hi,

Thanks for your thread it's very intersting.

I succeed flashing my boot partition with your tool but I don't success in remount,rw my system partition. It's cramFS and in init.rk28board.rc you can see those line :

# Mount /system rw first to give the filesystem a chance to save a checkpoint
mount cramfs mtd@system /system
mount cramfs mtd@system /system ro remount

I tried everything like replacing ro by rw, deleting the second line but my system stills in ReadOnly, don't understand why. I also tried deleting those lines to test if my flash process works properly and it's worked... So I'm lost. Any idea ?

----

Other thing, if I want to do same as flashing boot partition but with system partition is it possible with the same process ? Unfortunately I don't know the beginning offset of the partition. I don't know where to find HWDEF file. The size of partition is 00038000 (hex) bytes => 229376 (dec) bytes

Here is my /proc/mtd :

dev: size erasesize name
mtd0: 00002000 00000010 "misc"
mtd1: 00004000 00000010 "kernel"
mtd2: 00002000 00000010 "boot"
mtd3: 00004000 00000010 "recovery"
mtd4: 00038000 00000010 "system"
mtd5: 0003a000 00000010 "backup"
mtd6: 0003a000 00000010 "cache"
mtd7: 00080000 00000010 "userdata"
mtd8: 00534000 00000010 "user"
mtd9: 00020000 00000010 "pagecache"
mtd10: 00020000 00000010 "swap"

Thank you for your great job :)
[Android Software/Hacking General [Developers Only]] relsyou:
My problem is solved. I was searching for a while but ivop gave the answer in a previous post

So I did it, after I opened an Hex Editor like GHex on Ubuntu and I can saw this :

0x00002000@0x00002000(misc),
0x00004000@0x00004000(kernel),
0x00002000@0x00008000(boot),
0x00004000@0x0000A000(recovery),
0x00038000@0x0000E000(system),
0x0003A000@0x00046000(backup),
0x0003A000@0x00080000(cache),
0x00080000@0x000BA000(userdata),
-@0x0013A000(user)

So system partition starts at E000 and has a length of 38000 (hex) bytes.

Thanks for your help this thread is now in my bookmarks :)

And really nice job with this flashtool :)
[Android Software/Hacking General [Developers Only]] fun_:
I pushed latest my rkutils to https://github.com/naobsd/rkutils

rkunpack can unpack RKFW image used in RK2918 ROM, RKAF image (update.img), KRNL/PARM image used in some single partition image. unpack will be done recursively.

rkcrc can make KRNL/PARM images with -k/-p.

rkafpack can make RKAF image. (I need to write docs/howtos...)

little off-topic,

latest RK2918 ROMs which is based on "SDK2.0", new format for boot.img/recovery.img is introduced. it's almost same as common boot.img format for android. unpackbootimg/mkbootimg can be used to unpack/repack it with one exception...

there is SHA1 hash value in header of boot.img (offset 0x240 bytes). Rockchip changes it by some unknown way. normal mkbootimg can't generate same hash value as Rockchip, so we can't make custom boot.img with new format :(

fortunately, we can split new boot.img, and we can make separate kernel.img and boot.img(ramdisk) like as pre-SDK2.0 RK2918 ROMs, which is loadable with new bootloader in SDK2.0 ROMs.

--

btw I just found interesting one: https://github.com/jhonxie/rk2918_tools
[Android Software/Hacking General [Developers Only]] ivop:
I'll add that to my first post. Also, you can view /proc/cmdline to see a list of partitions. It's part of the kernel command line.

Note that the lengths are not in bytes but in blocks of 512 bytes. This happens to be the same as the requirements of the rkflashtool btw (length in blocks).

As for having a writable system partition, currently the system partition is cramfs which cannot be written to. Ever. If you want a writable system partition, you need to change it to ext3 for example. That means unpacking fun_'s system.img and recreating it as an ext3 partition.

In short:

Unpack cramfs img with cramfsck -x (as root, so you preserve permissions and uid/gid)

Create an empty file the size of your system partition (dd if=/dev/null of=fubar.img bs=512 count=...... et cetera, do the math)

mkfs.ext3 fubar.img

mount -o loop fubar.img /someplacemountable

copy contents of old image to /someplacemountable (use cp -a to preserve ownership etc)

umount

flash fubar.img to system partition

change init.rk28board.rc to reflect the changes

reflash boot.img

reboot device :)

This is untested, but should work in theory.

Another option is to keep the system partition read-only and use unionfs to overlay a writable partition. I'm not sure if this can be a file on your userdata partition mounted with -o loop, but I suppose it can. This depends on your kernel having unionfs and loopback support though.
[Android Software/Hacking General [Developers Only]] ivop:
Nice! I was thinking about creating an rkpack(tool ;)) myself, but I see it's not necessary anymore.
[Android Software/Hacking General [Developers Only]] fun_:
oops, I noticed if I replaced update.img with different size one, I need to modify header ;)

I need to make rkfwpack too ;)
[Android Software/Hacking General [Developers Only]] relsyou:
Thanks ivop, finally I won't remount my system in rw because there is no need. I make my change on my computer and I flash the system image over the RK2818 tablet.

Thanks for your help and the well done job :)
[Android Software/Hacking General [Developers Only]] surfer63:
I compiled unpackbootimg on an Ubuntu system.

copied it to my tablet (as it didn't work on ubuntu), but also on my tablet it doesn't work. Any other clues on how to unpack an RK2918 boot.img?
[Android Software/Hacking General [Developers Only]] surfer63:
SOLVED. First unpacked update.img resulted in a corrupt/damaged/whatever boot.img. Second attempt delivered a correct boot.img.

From _funs/naosb git repo I downloaded the new rkutils and compiled them.

Then

<path_to>/rkunpack boot.img
mkdir boot
cd boot
sudo gunzip < ../boot.img-raw | sudo cpio -i --make-directories

(sudo to preserve all file attributes).

Now I have a folder boot with the unpacked boot.img in it.
[Android Software/Hacking General [Developers Only]] surfer63:
On Mac OS X libusb is built defaultly with high verbosity log info.

It means that when reading or writing you get a lot of extra info. This can be very handy but is in most circumstances completely unwanted (and by now I'm completely sick of it ;) ).

So I built another universal Intel 32bit/64bit 10.4/10.5/10.6/10.7 V2 version without all the debug logging. It only gives the "clean" read/write lines during processing.
[Android Software/Hacking General [Developers Only]] kenshinta:
Hi fun_

Can you also show example for how to pack with rk29xx ROMs?

I tried to follow your example but its always gives an error of missing variable ... I'm guessing the HWDEF line confuses it , since rk29xx dont have that.

Thanks.
[Android Software/Hacking General [Developers Only]] SnakyJake:
Hi there,

first thank you all for your work and testing.

I also experimented some with my PMP5080B (Prestigio, RK29 based) using wendals tools to root my device (the tools just unpack an update.img apart, insert su and superuser and repack)

I encountered a strange behavior while using his tools and while using rkflashtool and mkcramfs with linux (just wanted to inject su into system.img)

On the tablet, when using the terminal emulator, cd /system and doing ls (list contents of /system) the terminal spit out crypted characters and a very messed up directory listing.

The tablet worked alright and everything seemed to be fine, except for the mess doing an ls in /system

After downloading the orig system.img from flash, mounting it, copying contents to another selfmade system-dir and rebuilding the original system.img i encountered slight differences between the original system.img and my selfmade system.img

After having a look in cramfs superblock I located the diffs in the root inode of the filesystem, especially the mode and uid/gid blocks.

After all the error (which also exists in wendals tools) was: I needed to give my self-created system-dir a "chmod 777 system" and a "chown root:root system", repack with "mkcramfs system system-new.img" and the diff was ok.

After that I placed my su into system/bin

chmod 6755 system/bin/su

mkcramfs system system-new.img

rkflashtool w 0xE000 0x80000 <system-new.img

DONE

No messed up "ls /system" anymore :-)

So for all messing around with the images: keep an eye on ownage and mode of root dirs. I don't know how this effects the stability of your device, maybe its not important.
[Android Software/Hacking General [Developers Only]] Ofloo:
can anyone tell me how to flash from unix device like ubuntu, .. using rkflashtool, .. how do i know that i have the correct size and offset?
[Android Software/Hacking General [Developers Only]] SnakyJake:
Ok, I try to explain. I done it with Jolicloud, which is based on some old ubuntu version, but it actually does not matter.

First make sure you have connected the pad and put it into flashmode (like I had to press [volume down] while connecting usb cable)

Best check with lsusb on command line.

Try to read the flash header like:

rkflashtool r 0x0000 0x2000 >header

Have a look at this file with some hex tool (xxd) or just open it in a text editor (nano, vi). Quite at the beginning there should be something like

CMDLINE: console=...

Follow this text until you see some memory sizes and regions like 0x00002000 0x00002000(misc) and so on. Those are your offsets and sizes. Search for the (system) one. On my pad its 0x00080000 0x0000E000, where 0x00080000 is the size (256MB) and 0x0000E000 is the offset.

Read system.img:

rkflashtool r 0xE000 0x80000 >system.img

Mount system.img to e.g. /mnt/system:

mount -t cramfs -o loop system.img /mnt/system

Copy contents to another dir

mkdir /home/user/mysystem

cp -rf /mnt/system/* /home/user/mysystem

[EDIT]

thanks to ivops follow-up post, you better use the -a option like this:

cp -a /mnt/system/* /home/user/mysystem

[/EDIT]

chown and chmod mysystem

chown root:root /home/user/mysystem

chmod 777 /home/usr/mysystem

do whatever you want to change in your system-dir (direct changes in cramfs are not possible, thats why you have to copy stuff in another dir!)

Things you might want to change are:

cp su /home/user/mysystem/bin

chmod 6755 /home/user/mysystem/bin/su

(roots your device :-), make sure to have a proper su binary)

then repack all the stuff:

mkcramfs /home/user/mysystem newsystem.img

and flash it back:

rkflashtool w 0xE000 0x80000 <newsystem.img

BE CAREFUL WITH TYPOS!

Do not bother if the new system.img is much smaller than the one you read from flash. When reading from flash you read the whole 256MB, even if only 130MB are used. rkflashttool will take care of it and fill the rest up with ones or zeros :-)

Good luck.

BTW: If you do something wrong, you always can reflash with an original update.img from your vendor.

Questions?
[Android Software/Hacking General [Developers Only]] ivop:
SnakyJake, thanks for all the help you supplied.

I'd like to add, instead of using cp -rf and (trying to) fix all the permissions and ownership in a crude way, you'd better use cp -a (as root) which preserves all ownership and permissions (see man cp).

To others, keep on posting your adventures with your rk2[89]xx tablets. It can always help others. And if you encounter plain errors with the tool, pm me. I suppose I'll get mail when i'm pm'ed.
[Android Software/Hacking General [Developers Only]] SnakyJake:
Thanks for the important hint.

I never used -a and everything worked out ok, but you never know what permissions and stuff are set in the original image - so all of you please use -a (archive) instead of -rf (recursive and force overwrite)
[Android Software/Hacking General [Developers Only]] Ofloo:
very nice explanation,.. so if i backup those i can always flash them back even if the tablet is frozen? For some apparent reason the original supplier doesn't supply the update.img, .. it's a lenco tab-1011 rockchip RK2918 CPU based, which is basically a arnova 10 g2, .. however the arnova update image isn't recognized, and the tabs firmware just planly sucks appslib doesn't work, arctools don't work, nothing works on the tab aside from what is installed manually. So i found a full root image (for arnova 10 g2) and i was planning on backing up the current images, .. and testing those images, ..

PARM_^B^@^@FIRMWARE_VER:0.2.3
MACHINE_MODEL:AN10G2-LN
MACHINE_ID:007
MANUFACTURER:RK29SDK
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 2929
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
COMBINATION_KEY: F,0,1
CMDLINE: console=ttyS1,115200n8n androidboot.console=ttyS1 init=/init initrd=0x62000000,0x500000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00004000@0x00004000(kernel),0x00002000@0x00008000(boot),0x00004000@0x0000A000(recovery),0x00080000@0x0000E000(system),0x00082000@0x0008E000(backup),0x0003a000@0x00110000(cache),0x00080000@0x0014a000(userdata),0x00002000@0x001ca000(kpanic),-@0x001cc000(user)

so i should basicly interpret this as <offset>@<size> 0x00080000@0x0000E000(system)

so for in order to install new image i need to update all the images, .. or just leave recovery for the time being just to be safe? also i've noticed -@0x001cc000 what's am i supposed to put instead of the -?
[Android Software/Hacking General [Developers Only]] ivop:
It's the other way around, i.e. size@offset(name)

The last entry, at offset 0x001cc000, runs until the end of the nand flash memory.

You can also verify that for each partition, the current offset is equal to the offset of the previous partition plus its size (that's all in 512-byte locks btw).

Best is to backup everything up to and including the backup partition. The rest is not really necessary, although you can backup everything of course and be able to restore to how your tablet is at this moment exactly.
[Android Software/Hacking General [Developers Only]] Ofloo:
yeah sorry i input it right but i wrote it wrong on the forum :p

sudo rkflashtool w 0x0000E000 0x00080000<system.img
sudo rkflashtool w 0x0000A000 0x00004000<recovery.img
sudo rkflashtool w 0x00004000 0x00004000<kernel.img
sudo rkflashtool w 0x00008000 0x00002000<boot.img
sudo rkflashtool w 0x00002000 0x00002000<misc.img

for my lenco arnova 10 g2 tab, .. and it worked fine.
[Android Software/Hacking General [Developers Only]] Ofloo:
i was thinking of downloading the image, then downloading the userdata image, mounting both images, .. and copying all the current data from one image to the other, .. or something like that,.. cause i notice you seem to use the clear nandflash or whatever to format the image, .. so maybe put the userdata on it afterwards, ..

now the end of the dirve is - how could i make sure i got the whole drive i think it's 256mb, .. i'm pretty sure of it, but pretty sure never cuts it, with these things you need to be 300% sure, .. one could probably calculate the end, .. however how would you tell from data you pull from the device does anyone know. I calculated the end would be 0x00080000

edit:

is this what you where looking for ?

$ adb pull /sdcard/newuserdata
4131 KB/s (536870912 bytes in 126.898s)
$ pwd
/tmp
$ ls -lh newuserdata
-rw-r--r-- 1 ofloo ofloo 512M 2011-12-31 22:21 newuserdata
$ sudo mount -o loop /tmp/newuserdata /tmp/blah
$ mount | grep -i loop
/dev/loop0 on /tmp/blah type ext2 (rw)
$ ls /tmp/blah
lost+found

btw happy new year :p
[Android Software/Hacking General [Developers Only]] psypreacher:
hello,

im a linux noob :rolleyes:

how to install/compile rkunpack.c? i create a textfile with gedit, copy&paste the content of rkunpack.c following your link, saved the file as rkunpack.c and made it executable.?

and now? any help would be nice so i can learn ,-)

thanx in advance

psypreacher
[Android Software/Hacking General [Developers Only]] kenshinta:
Reading thru this thread, we now have some concrete ideas on how to:

* re-size partitions (at least data);

* pack/ repack system, boot partitons;

* flash using unix rkflashtool (excellent tool);

Can someone please do a concrete howto on:

* convert system to ext3/4 from cramfs;

* bake Chainfire3D into system assuming it is still cramfs;

or if these arent feasible explain why not for further learning ...

Thanks!
[Android Software/Hacking General [Developers Only]] cheesebread:
write no possible at 0x610000 and above

Hi,

1st thanks for this nice tool.

I use RK2918 based Odys Xpress tablet.

My problem is that the table seems to be always in "flash mode". So I don't have to press the menu button when doing reset (the normal way to enter flash mode) and the table does not start up anymore. I am able to write the flash below offset 0x610000 (about 3 GB). To the area 0x610000 and above the rkflashtool seems to be not able to write. When I read this "high" area I get repeatedly similar looking data containing the string "USB".

Does anyone know where the loader is located in the flash ? It seems to be a special area (in the normal flash ?) because with the windows tool RKAndroidTool.exe no offset has to be entered for the loader.

CB
[Android Software/Hacking General [Developers Only]] bouldou:
unpack kernel.img

Hello guys,

I've been tweaking rk29 device since a little time, and I followed your steps to unpack my U9GT2 firmware, but I have one question :

How to unpack/repack the "kernel.img' file ? I've been trying hard, but rkunpack seems not to work with this file.

Anyone knows ? Thanks a lot !
[Android Software/Hacking General [Developers Only]] Ofloo:
Mount the image as a file system ?

sudo mount -o loop kernel.img /path/to/dir
[Android Software/Hacking General [Developers Only]] bouldou:
Nope, already tried, does not work :(
[Android Software/Hacking General [Developers Only]] vest:
make this

$file kernel.img

and post result there
[Android Software/Hacking General [Developers Only]] spawn13a:
kernel.img: data
[Android Software/Hacking General [Developers Only]] vest:
yes this is not a disk image can not be mounted

this is linux kernel how you want to unpack?

maybe you want unpack boot.img? in RockChip SDK2.0 boot.img contains the linux kernel and boot.img ramdisk
[Android Software/Hacking General [Developers Only]] spawn13a:
after decompression update.img, 5 files boot.img kernel.img misc.img recovery.img system.img . kernel in the file kernel.img
[Android Software/Hacking General [Developers Only]] Ofloo:
Well i was intreged by the idea, cause i wanted to recompile my own kernel, cause there's a few things missing in the current kernel cifs, usbserial, bleutooth, .. i would want to be able to insert an bt usb stick and have bluetooth on my device, or use it as console diagnostic tool using usb2serial and use nfs storage to store files on, ... so could anyone put me into the right direction about the kernel where to get it and where i can find howto cross compile it, ..
[Android Software/Hacking General [Developers Only]] surfer63:
I wrote a wiki article for those happy people among us without Windows:

Unbrick your RK2818 tablet using Mac OS X, Linux or BSD, off course by using rkflashtool.
[Android Software/Hacking General [Developers Only]] Ofloo:
Well, looks good only you don't tell how you got the hardware layout.

like mentioned in this thread "rkflashtool r 0x0000 0x2000 >header"
[Android Software/Hacking General [Developers Only]] surfer63:
It's mentioned in the article in the The flash memory address ranges of our RK2818 tablet section.
[Android Software/Hacking General [Developers Only]] bouldou:
Hello Ofloo : did you manage to modifiy the kernel, as you wanted to do ? I'd be very interested in having some news. Thank you !
[Android Software/Hacking General [Developers Only]] lamego.pinto:
There are kernel sources for different rk2918 based tables, google for "rk2918tools kernel".

However the driver for your specific model touchscreen and other components maybe missing.
[Android Software/Hacking General [Developers Only]] kenshinta:
Finally, I got the hang of resizing the user data space for my tablet.

My next quest then was: once I compile an update.img (or the unpacked version), how do i flash it under linux? The heavy lifting for this one is answered here:

http://www.arctablet.com/wiki/index.php/Update_tablet_using_Linux

Major component here is the rkflashtool. With that script I was able to work out how the parameter file works and increase /data to 2GB yay.

However as of jan 25 one major step remains: how to flash the bootloader within the flashing script? (as noted in the Rksp flash tablet.pl page).

Anyone suggest how? The script ATM is works well, but the flashed tablet doesnt proceed to booting (stays at boot logo) since I guess the booloader isnt flashed to the unit. I had to revert to using the RKAndroidtool app under windows to restore my tablet with the same ROM.
[Android Software/Hacking General [Developers Only]] turbocheke:
great job, now i dont need reset mi computer for try new roms
[Android Software/Hacking General [Developers Only]] bvoz412:
I have RK2818 tablet, PMP3084B, and I have completely screwed it up. I have been running 'rkflashtool w 0x8000 0x2000 <update.img' and at first it was updating (but did not work) and then it was freezing when i wanted to update, now, it is not showing itself at all under lsusb (I've been getting errors 'fatal: cannot open device' etc.), on Windows it is not recognized anymore. So, what can I do?

edit : I managed to get it recognized again by pressing 'reset' button on it. But when i use rkflashtool it just sits there showing 'interface claimed' message ??
[Android Software/Hacking General [Developers Only]] Ofloo:
It's because you're supposed to unpack the update.img ! before you write every image inside it to the device individually.

edit

update image contains a bunch of crap including images it's those images you're supposed to write to the correct space on the flash, .. not just write update.img to it ! When doing the things you do you're supposed to actually read the documentation provided, .. just read this thread, .. maybe it makes sense, ..

I beleve it was

afptool -unpack update.img

read the header where you're supposed to write those images instead, .. read before you **** it up even more !