[Android Software/Hacking General [Developers Only]] ericwong:
(I am posting this on behalf of a chinese developer. This is his finding, not mine. He has Haipad M9.)

Renesas EMMA EV2 device internal partition and ROM flashing logic

Recommended: The flashing method that uses VOL- will preserve the existing apk installed as well as other user data.

PS: this document only refers to the newer model, older model of the unit should be similar (The author had worked these out using his HaiPad M9).

Device partition explanation:

Renesas EMMA EV2 use iNand for internal storage, this is a type of new storage media using MMC connector (same connector as SD card), it can be viewed as an internal SD card. MMC connector is mounted as device mmcblk*p*, the first * means the device number, starting from 0. The second * means partition number, starting from 1.

Therefore:

iNand device becomes mmcblk0, the corresponding SD card becomes mmcblk1.

iNand is being divided into 7 partitions, as described below:

1)	mmcblk0p1--->uboot, used to load instructions to start the system, equivalent to the BIOS of the computer. If this portion is damaged, the device will not boot at all. The vibration when the device starts is also specified here.

2)	mmcblk0p2--->kernel, the place where the Linux kernel resides.

3)	mmcblk0p3--->a small scale file system, when you press VOL- to boot, it uses the file system in here. (kernel is only the core, when booting, it still requires the file system support, GUI, etc are all placed here.)

4)	mmcblk0p4--->expansion. Since only maximum of 4 partitions are allowed for the main partition, therefore this region is classed as expansion partition.

5)	mmcblk0p5--->android-fs. The files loaded during normal booting are loaded from here.

6)	mmcblk0p6--->data partition. The apk that the user installed are located in this partition. When you press VOL- into recovery and select “Wipe data”, this is the partition that is cleared.

7)	mmcblk0p7--->user storage for music, video, etc…

VOL- upgrade principle:

When you press VOL- to boot, the CPU will start reading the data located in mmcblk0p1(uboot) partition, uboot runs and then load the kernel in mmcblk0p2, and then load the file system in mmcblk0p3, and then execute upgrade recovery program. Recovery means the yellow interface, which contains the upgrade, WIPE data, etc operations.

When you execute “upgrade system from SDcard” operation, recovery will check the upgrade file (compute its MD5 value and compare with update.conf), if they are the same, it will execute the upgrade instructions, upgrade method is:

uboot4.bin--->copy document to mmcblk0p1 partition and replace existing uboot

uImage4--->copy document to mmcblk0p2 partition and replace existing kernel

android-fs4.tar.gz---> clear content from mmcblk0p5 partition, and then uncompress the document into mmcblk0p5 partition to update the android-fs

Note: if wipe data is not executed, the currently installed apk will be preserved. However, if the changes as a result of the upgrade are too much, it may cause strange problems to appear. To fix these problems, just boot using VOL- again and perform wipe data.

VOL+ upgrade principle:

If the user upgrade incorrectly, then VOL- would not boot the device. Depending on the circumstances, these may occur:

1)	After the device is turned on, the power LED is on but no vibration: This definitely means error in the mmcblk0p1 partition. Such situation means you must use SD card to re-flash the ROM.

2)	The device vibrate when it is turned on, however there is no LOGO, the screen is black: this may means there is some error in mmcblk0p or mmcblk0p5. If you press VOL- and can enter recovery, that means the error is in partition mmcblk0p2.

3)	The device vibrate when boot and also able to show LOGO and Android booting animation, but it keeps looping/restarting, this means something is wrong with mmcblk0p5 partition, if so, use VOL- to upgrade again.

When VOL+ is pressed when booting, the CPU will detect it and will use FAT file system to load mmcblk1p1 (SD card) partition’s sdboot.bin and uboot-sd.bin, if the loading is successfully, then it will also load uImage4 and cramfs4 file, uImage4 means the Linux kernel, if the loading is successful, then it will use cramfs4 as the file system and run the entire OS. After the OS is running, it will execute install.sh file, follow the instructions in install.sh and repartition mmcblk0 partition, and also copy uboot4.bin, uImage4, cramfs4.tar.gz, android-fs4.tar.gz into their respectively partitions (mmcblk0p*).

The difference with VOL- is that all the files are retained on the SD card, if the device is bricked, this method can be used to re-flash the ROM. Due to the use of FAT file system, FAT only support 2GB or smaller capacity, therefore, you need to use a 2GB or smaller SD card formatted into FAT for this operation. If your SD card is larger than 2GB, please refer to the upgrade document’s instruction and partition your SD card into 2GB or smaller.

install.sh file analysis:

1)	Nothing interesting at the beginning, mainly to check if certain files exist or not.

2)	Starting from fdisk, this portion contains instructions to repartition mmcblk0 (need linux foundation, you can search for linux fdisk online). The partition size that user want to change is also located here. From here onward, you can see several place with +xxM, these configures the size of each partition. E.g. +5M means this partition is 5MB. The order inside is :

+5M: mmcblk0p1, better don’t change the size of this partition

+10M: mmcblk0p2, for the kernel. Because the uImage4 is only 4.xM, this partition maybe shrinked slightly.

+50M: mmcblk0p3, for cramfs4.tar.gz. Since the cramfs4.tar.gz stored here is uncompressed, do not shrink this partition without serious consideration.

+250M:mmcblk0p, stores android-fs.

+750M:mmcblk0p6 stored data. If the user needs to install more apk, can increase the size of this partition, e.g. 1GB, etc…

Others: the rest of the space are devoted to storing video, music, etc

3)	The rest of the code aren’t interesting, mainly to copy files into mmcblk0