yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] bvoz412:
OK, I unpacked update.img with afptool and I tried to flash it again using guide from archos wiki, extended flash...

But it is the same. Typed 'sudo ./rkflashtool w 0x00004000 0x00004000 <kernel.img' and the message 'rkflashtool: info: writing flash memory at offset 0x00004000' stays forever...

edit : I realized that when this message appears i just need to press reset on the back of the tablet and then it works, but with errors. Example:

[posterminal@POSTerminal rkflashtool-v2]$ sudo ./rkflashtool w 0x8000 0x2000 <boot.img
rkflashtool: info: interface claimed
rkflashtool: info: writing flash memory at offset 0x00008000 [stuck here, press reset]
libusb:warning [do_sync_bulk_transfer] unrecognised status code 1
rkflashtool: info: writing flash memory at offset 0x00008020
libusb:warning [do_sync_bulk_transfer] unrecognised status code 1
libusb:warning [do_sync_bulk_transfer] unrecognised status code 1
libusb:warning [do_sync_bulk_transfer] unrecognised status code 1
rkflashtool: info: writing flash memory at offset 0x00008040
libusb:warning [do_sync_bulk_transfer] unrecognised status code 1
libusb:warning [do_sync_bulk_transfer] unrecognised status code 1
libusb:warning [do_sync_bulk_transfer] unrecognised status code 1
rkflashtool: info: writing flash memory at offset 0x00008060
rkflashtool: info: writing flash memory at offset 0x00008080
rkflashtool: info: writing flash memory at offset 0x000080a0
rkflashtool: info: writing flash memory at offset 0x000080c0
rkflashtool: info: writing flash memory at offset 0x000080e0
rkflashtool: info: writing flash memory at offset 0x00008100
rkflashtool: info: writing flash memory at offset 0x00008120
rkflashtool: info: writing flash memory at offset 0x00008140
rkflashtool: info: writing flash memory at offset 0x00008160
rkflashtool: info: writing flash memory at offset 0x00008180
rkflashtool: info: writing flash memory at offset 0x000081a0
rkflashtool: info: writing flash memory at offset 0x000081c0
rkflashtool: info: writing flash memory at offset 0x000081e0
rkflashtool: info: writing flash memory at offset 0x00008200
rkflashtool: info: writing flash memory at offset 0x00008220
rkflashtool: info: writing flash memory at offset 0x00008240

I think this libusb error appears because it's resetting and cannot react at that moment... Any solutions?
[Android Software/Hacking General [Developers Only]] Ofloo:
i think i've seen those errors before are you sure you are using the proper rkflashtool i depending on the chipset you need v2 or 1 i suppose, are you sure those are the correct offsets, are you sure you're writing a proper image to that device.
[Android Software/Hacking General [Developers Only]] bvoz412:
Yeah, I'm using official Prestigio image file, and this is HWDEF that i unpacked -

BEGIN MACHINE_INFO
magic=0x5041524B
manufacturer=rock-chips
machine_model=PMP3084B
machine_id=1616
END

BEGIN RAM
base_addr=0x60000000
size=128
atag_addr=0x60000800
krnl_addr=0x60008000
END

BEGIN PARTITIONS
# Flash partitions info must be order of offset
# Don't change the partitions name, but you can change the partition offset and size.
# You can Insert new partitions.

mtd_id=rk28xxnand

#Format: part_name offset:size
parameter	0x00000000:0x00002000:fh
misc	0x00002000:0x00002000:f
kernel	0x00004000:0x00004000:f
boot	0x00008000:0x00002000:f
recovery	0x0000A000:0x00004000:f
system	0x0000E000:0x00048000:f
backup	0x00056000:0x00052000:
cache	0x000A8000:0x0003A000:
userdata	0x000E2000:0x00080000:
user	0x00162000:0xFFFFFFFF:
END

i have ran:

sudo ./rkflashtool w 0x4000 0x4000 < kernel.img
sudo ./rkflashtool w 0x8000 0x2000 < boot.img
sudo .rkflashtool w 0xA000 0x4000 < recovery.img
sudo ./rkflashtool w 0xE000 0x48000 < system.img

But it's still not booting, and has these libusb errors... ?
[Android Software/Hacking General [Developers Only]] Ofloo:
does the device get recolonised properly, are you able to read from it?
[Android Software/Hacking General [Developers Only]] bvoz412:
Yes, I am able to read from it. At first it needed to press reset but now it reads without problems...
[Android Software/Hacking General [Developers Only]] Ofloo:
when you write do you reset button it as well?
[Android Software/Hacking General [Developers Only]] bvoz412:
Yes.........
[Android Software/Hacking General [Developers Only]] relsyou:
Hi,

I'm little bit stuck. Some month ago, I succeded flashing my RK2918 tablet but now I just suceeded flashing system image but not boot image :s

In fact, I retrive the boot partition, extract it, modify it and then after flashing it doesn't work but don't know why :s

That's what I did :

$ ./rkflashtool-linux r 0x8000 0x2000 >boot.img
$ ./rkunpack boot.img
$ mkdir boot_temp
$ cd boot_temp
$ sudo gunzip < ../boot.img-raw | sudo cpio -i --make-directories
$ sudo gedit init.rc // Then some modifs
$ cd ..
$ mkcramfs boot_temp boot-temp.img
$ rkcrc boot-temp.img newboot.img

After that my "newboot.img" has a size of 216 KB (because there is no kernel inside)

Now I flash my device, run it (it boots correctly) but there is no change in init.rc. Why ?

I really don't understand :s

Thanks for your help :)
[Android Software/Hacking General [Developers Only]] db260179:
Hi Snaky,

Can you help me understand this?

I want to increase the system partition size from 256mb to 270mb

How to I rearrange the proceeding partitions to allow this change?

How is it calculated?
[Android Software/Hacking General [Developers Only]] relsyou:
I'm still searching, anyone can help me please ?
[Android Software/Hacking General [Developers Only]] relsyou:
I'm sorry but I'm still searching and I really need help at this point.
[Android Software/Hacking General [Developers Only]] surfer63:
Quite simple. The rkflashtool version 2 first tries to auto-connect to an RK2918 tablet. If it can't find the RK2918 device, spitting out some errors, it will search for an RK2818 device, what is what you have, and continue happily. Nothing to worry about.

---------- Post added at 10:26 PM ---------- Previous post was at 10:21 PM ----------

Please mention what you changed and what you expect to happen. It could very well be that your boot.img is OK, but the command (or whatever) you changed is incorrect, and therefore not executed.

---------- Post added at 10:32 PM ---------- Previous post was at 10:26 PM ----------

Use a calculator that can do HEX calculations. Simply convert the decimal values (256MB and 270MB) to hex values. Check your outcome and follow snaky's guide further. I will not do the calculations for you as you need to understand what you do.

He already gives the hint of:

Please try to understand what the figures mean and do some "check" calculations to be sure.
[Android Software/Hacking General [Developers Only]] relsyou:
Hi surfer63,

I only added a service boot line but after flashing when I cat the init file, it's not inside.

Thanks.
[Android Software/Hacking General [Developers Only]] DJNoXD:
Hello

Has someone of you compiled a kernel for rk2918 board from source?

Is there anything important that I have to take care of if I want to include my own kernel into boot.img?
[Android Software/Hacking General [Developers Only]] SnakyJake:
Not done yet. Actually there should be not much special.

You have two flash partitions: kernel and boot, where kernel takes your compiled kernel, and boot actually takes your initrd.

So probably you might just flash it to the kernel partition so it gets fired up by the default bootloader.

I don't know much about the loader, though.
[Android Software/Hacking General [Developers Only]] onk:
Hi

Can anybody answer to my questions?

1. Address for write RK29xxloader.bin?

2. Address for recover-script and update-script?

3. How firmware detect first start (when run recover-script for make and format /cache /data /mnt/sdcard)

Thanks

ans:

2. fw work start without scripts

3. misc contain commands (offset 0x4000). after first start misc filled by 00
[Android Software/Hacking General [Developers Only]] klaxa:
I have been following this thread, since I own a tablet with the Rockchip, too.

I can confirm rkflashtool to work with the Easypix Easypad 710 (RK29), I haven't dared to write things until now though. I'm currently making a full backup of the NAND, so I should be fine, right? :)
[Android Software/Hacking General [Developers Only]] Commifreak:
Hi :)

I own a Archos tablet with an RK2808. Maybe someone can help mw with my following issue, I tried everything, but it doesnt helped anyway :(

I've bought this tablet with a custom rom inside, I wanted to flash it with its own procedure (update.img to sd-card and let it upgrade itself). That worked fine, but since this action the sd-card is never inserted (but its there) and the internal memory is 0 (no downloads possible).

I've tried the windows rkandroid flash-tool and tried to flash with rkflash, the flash completes successfully, but it doesnt recognize the sd-card / internal memory.

Whats wrong? Can someone guide me?

Thanks ;)
[Android Software/Hacking General [Developers Only]] frankjt:
Hello,

there are good news, updated with ProductID 0x300a like this:

. . .

if (!(h = libusb_open_device_with_vid_pid(c, 0x2207, 0x300a)))

. . .

rkflashtool works on Cube's rk3066 tablets too (all functions: r, w, b).

Thanks to Ivop's excellent tool my Cube U30GT-H (firmware 1.02) is rooted now.
[Android Software/Hacking General [Developers Only]] SpaceCaker:
Hey guys i used this long time ago but instead of install i used update i used correct firmware and everything but my archos 7 home tablet is now dead when i turn on i get all kind of diffrent colors flashong over screen and doesnt react even with adb and the tool i cant get any connection

Anyone knows how to fix?
[Android Software/Hacking General [Developers Only]] absynth.c.shell:
rkflashtools

This really is an excellent piece of C coding, what I am wandering is how did you find out the USB command functions for reading and writing to the device..? Was it by reverse engineering some software, or is there a list/documentation on how these commands work...? If there is, the rkflash tool could be expanded to work for other non-rk devices...? Food for thought at least...

Regards, A.
[Android Software/Hacking General [Developers Only]] spiderio:
help// i'm unpacking boot.img

but when i repack, and flash, it got stuck on splash screen...

how is the right way to repack rk29 boot.img

please help
[Android Software/Hacking General [Developers Only]] soheilbalini:
RK3066 (CUBE MINI) boot problem

hi. I have RK3066 cube mini tablet. during last update (using windows 8) it failed & now it's never get to flash mode. After holding pwr and V+ it start the tablet in recovery mode. actually i can not recover anything. so is there anyway i could repair the boot section of my tablet using this method? actually without getting into flash mode. tanx a lot
[Android Software/Hacking General [Developers Only]] 900supersport:
I think I'm following you round the forums. You need to get into flash mode.

Confirm flash mode by using lsusb from a terminal and look for 0x300a.

Once you see this then we can progress.
[Android Software/Hacking General [Developers Only]] Jin^eLD:
Hi,

thanks for this great tool, now one can actually do backups before rooting the tablet (i.e. to have an original image that can be flashed back in case of warranty return).

I can confirm that it works on a TrekStor Ventos 9.7 which also has an RK3066 chipset, just like the Cube, I also had to add the USB ID as above.

One thing though, and I am not sure if it is true or if it is something different.

I booted into flash mode (vol+ and power), backed up all of my partitions, then rebooted via rkflashtool. I did not write anything.

But after that the tablet feels slower, I can't explain it. I ran Antutu, unfortunately I did not have a direct comparison, last time I ran it before was right after I bought it (about 2-3 weeks ago). So according to Antutu I lost about 2000 points.

Question is: can this speed drop be somehow related to reading the flash? I know, it makes no sense... Maybe rk30xx need some other/additional commands when leaving the flash mode? It really felt slower immediately after what I did, so I thin it can't be a coincidence. Any ideas? Is anyone familiar with the rockchip protocol?

Kind regards,

Jin
[Android Software/Hacking General [Developers Only]] TheSSJ:
Hi,

what could help would be wiping the cache partition, I don't know if your rockchip flashtool is able to do this as I don't own a rk device :)

regards
[Android Software/Hacking General [Developers Only]] Jin^eLD:
Thanks for the hint, I did already think about that however I am not sure how - the stock recovery mode does not seem to work for me, and as far as I know it should be possible to wipe the cache partition from recovery. On the Ventos I get a "dead robot" screen but I have no menu, tried pressing all available buttons, tapping on the screen - but still no recovery menu.

Can the cache be cleared from inside Android?
[Android Software/Hacking General [Developers Only]] Jin^eLD:
I had a look at the RK29kitchen and pasted together one simple script that will backup all relevant partitions, it requires rkflashtool and mkkrnlimg in $PATH.

It is basically copied from Oleg's scripts from https://github.com/OlegKyiashko/RK29kitchen, I only added some extra sanity checks and made sure that everything is just in one script file (the original RK29kitchen script sources various plug-in scripts and that was too cumbersome for me).

It will first read and parse the partition table and then dump boot, kernel, misc, recovery, system, backup to your harddrive. Just to be clear, this functionality has already been available in RK29kitchen, I simply put some of the existing things together and modified them to my needs.
[Android Software/Hacking General [Developers Only]] Jin^eLD:
OK answering my own question now: when in the "dead robot" (standard recovery mode) screen I had to press Power + Volume Up to get the menu to show. After wiping the cache I am back at the original 8224 Antutu points, so I can confirm that the rkflashtool had most likely nothing to do with the tablet getting slower, it was probably just a coincidence that I noticed it after using the tool.
[Android Software/Hacking General [Developers Only]] earthspiritraven:
Hello to all. I believe I royally f****up my tablet. First off the specs are:

Manufacturer: Shenzhen Hengguan Electronic Co,

Model: ColorTab CTC07SO

It has 4Gb internal (2 hynix chips), 512Mb DDR3 (I think its a 29F32G08CBACA chip), wifi (RealTek rtl8188CUS) and an RK2918 chip

It all started with the tablet being dismal with the battery usage. I would leave the tablet with 90% charge try to turn it on next day (say about 36 hours later) and it would be at 5% or even completely dead. Decided I need to work with the rom and check for things not going into deep sleep. As a start I was following a post here in XDA about getting CWM into an RK2918 tablet and of course I did not read that I first needed the bloody partition table (and that there are other "safer" ways to try roms). Used the windows RK flash tool that had the recovery and misc sections checked. So I think even though the recovery image did go in correctly (no errors) the partition table got screwed and now it will not turn on apart from going into the download/flash mode.

I compiled the tools here and went fishing into the tablet. The header spit out (which btw appears five times at 0x00000000; 0x00004000; 0x00008000; 0x0000C000; and 0x0000FFFF downstream)

0x00002000@0x00002000(misc), [downstream it says recovery.--wipe_all]

0x00004000@0x00004000(kernel), [starts with ....$.q]

0x00008000@0x00008000(boot), [starts with Android!]

0x00008000@0x00010000(recovery), [starts with KRNL]

0x000F0000@0x00018000(backup), [starts with RKAF.(v.CTC07SO)]

0x0003a000@0x00108000(cache), [starts in blank, has other characters downstream]

0x00200000@0x00142000(userdata), [starts blank, has other characters downstream]

0x00002000@0x00342000(kpanic), [has text that I recognize as part of one of my files]

0x000E6000@0x00344000(system), [starts with ...div class="topic"]

-@0x0042A000(user).. [starts blank]

Fished the first 0x2000 of each section and these spit out the info in [ ] above. Following:

I'm guessing that the info at the start of each section does not coincide with what should be there. Nevertheless, would 0x000F0000@0x00018000(backup), [starts with RKAF.(v.CTC07SO)] be the (update.img) from which I can extract all other images and be able to "recover" the tablet to how it was? What other "headers" am I looking for in each section?

I've already used ./rkflashtool r with those parameters (backup) and got 503.3Mb out.

I've yet been unable to get much info from the manufacturer so no dice at getting all info from them, that is why I'm trying to get everything from the tablet. And really, now that I'm going to work on this project might as well change from cramfs to ext3 and add a bit more space to system.

Thanks.
[Android Software/Hacking General [Developers Only]] Jin^eLD:
I think you "got stuck" in recovery, I would wipe out this string in the misc partiton (dd yourself a small file from /dev/zero and flash it to misc).

Why didn't you backup all partitions fully earlier? This way you could simply restore them at any time using rkflashtool. Although from what it looks your other partitions are OK if I look at the magic strings that you posted. Sure is sure, I'd make a full backup of each partition right now if I were you.

Then zero out the recovery.--wipe_all string in misc as I described above. Good luck.
[Android Software/Hacking General [Developers Only]] earthspiritraven:
Thanks for posting Jin^eLD...

I didn´t make the backup because that was why I wanted CWM in for, to make the bloody backup. I didn´t know there was an rktool with which to read all partitions before going into them. Definitely my fault and even though I had read a lot in the forums it was not enough apparently. I have made backups of all partitions as decribed in the magic strings. What bothers me is that at the beggining there is the machine Id and stuff like that.. it doesn´t coincide with the CTC07SO the tablet has and that shows up in the "backup" string.

Just zero out the string? Can it be done in hexeditor and then flashed back? Because I didn't understand the /dev/zero thing you mentioned. Would you care to explain a little bit more?

Thanks
[Android Software/Hacking General [Developers Only]] earthspiritraven:
Jin^eLD... I've backed up all partitions (except the last one... user), zeroed the misc section of the tablet with a zeroed version. Alas when I issue ./rkflastool b it boots back into the download mode. I think the partition table is screwed. From the first post:

I gather I can look for the partition table in the RKAF headed section (backup) but does this mean I need to mount the backup.img file or do I need to extract it...?
[Android Software/Hacking General [Developers Only]] Jin^eLD:
Yes, that's what I would try. You can also wipe it out with a hexeditor, I mainly thought it'd be easier to do something like:

dd if=/dev/zero of=mymisc.img bs=1 count=16384

...which would give you a file with 16k of 0x00 in it, if I understand correctly the recovery string is right at the beginning of the misc partition, so it'd be enough to overwrite just that part, no need to flash the whole partition, I think misc has just zeroes to the end anyway.
[Android Software/Hacking General [Developers Only]] earthspiritraven:
Well... I've had much work and been doing things slowly. Managed to unpack the backup.img I dumped from the tab. Got many files including the parameters, an RK29xxloader (ver2.26) and other stuff.

I've confirmed that the parameters were off but from userdata onwards so in theory it shouldn't have been a problem if the boot didn't mind the recovery. (should just go ahead and flash the original recovery?)

Flashed back the correct parameters, but I have a nagging question in my mind. When I opened the CWM parameter file it had the line:

COMBINATION_KEY: 0,6,A,7,0..

My guess is that these are for use within CWM or are they for getting into recovery? But are the calls machine specific or button-type specific (can find anything on the net as of a couple of days ago)? In any case I modified the original parameters to include the line.

Zeroed misc as suggested by Jin^eLD

I've tried to reboot the machine but it doesn't turn on, it just goes back to the download/flash. Pressing PWR + Volume+ doesn't get me into recovery or anything. Does anybody know the "usual" combinations to get in there? ADB (windows) doesn't recognize the tablet because it goes into download/flash so I can't issue an adb reboot recovery from it. Is there a way to do it in lunix in these rk tabs, because it does respond to the b modifier in rkflashtool.
[Android Software/Hacking General [Developers Only]] Jin^eLD:
Wait, you dumped all the flash at once and then flashed back all at once? I was merely talking about the misc partition, also when I talked about backing up I was referring to backing up single partitions. I think in your case it may be better to ask the manufacturer to send you an original firmware image which you can flash with RKBatchTool on windows, it contains everything in proper setup, including the loader and should bring your tablet to the original factory state.
[Android Software/Hacking General [Developers Only]] earthspiritraven:
No. From what was in the tablet I dumped parameters, misc, backup, kernel and system. Unpacked backup and got many files. Opened parameters that unpacked and saw the discrepancies. I've only flahed the correct parameters and the void misc file. Nothing else. But the tab is still stuck.
[Android Software/Hacking General [Developers Only]] Jin^eLD:
Well, I would not have touched parameters, only misc. Parameters could be critical, I'd leave the original stuff there. Try getting a full image for RKBatchTool from your vendor. It should contain really everything and should bring you to the original state.
[Android Software/Hacking General [Developers Only]] earthspiritraven:
I didn' like the fact that the parameters in the 0x00000000 offset did not identify my tab (some mhc or other) while in unpacked it states ctc07so which is the correct model). Also the size for userdata was smaller in unpacked and thus kpanic, system and user offsets were different

In any case I did contact mfgr on 2jan. Human did Ack but said they'd answer back when they returned from holidays... Maybe monday.
[Android Software/Hacking General [Developers Only]] earthspiritraven:
Well as much fun as it was to play around with my RK2918 tablet it has ended. Had a difficult time with the manufacturer to get a full rom from them. So had to work with what I had offloaded from the tablet.

Managed to get it up an running again (yay!!!) after many tries. For some reason it had stuck in download/flash mode. It is possible that having sent the command via ADB might have done something to the tablet and it wouldn't restart normally. What finally clinched it was formatting the thing with the windows tool and then putting everything back in, including the loader. I read that when the loader does not recognize something bootable in the initial partitions it goes looking for them in the SD card. If it doesn't find anything it loops back to the download/flash mode. So it is possible that things were totally awry until fully formatted and started fresh.

Anyway, being a noob I couldn't get a better battery performance out of the tablet. I'm sure it has to do with deep sleep and what not. I just don't have enough knowledge at this point. So I sent it back for a full refund to the distributor, who promptly paid up next day. Too bad, I did like it.
[Android Software/Hacking General [Developers Only]] suslovsky:
trouble

I tried to compile rkflashtool.c within Linux Mint 14 x64 and meet a trouble with some errors and warnings, like

expected identifier or «(» before «<» token

expected «=», «,», «;», «asm» or «__attribute__» before «<» token

expected identifier or «(» before numeric constant

symbol 8 on octal constant

and so much

what can I do?