yashsingh1/xdaforums huggingface dataset:
[Other SmartWatches] Margino:
Look at post 1950 and post 1758. There's lots of info throughout the thread which can be found using the search tools.

---------- Post added at 05:48 PM ---------- Previous post was at 05:46 PM ----------

You can reboot into recovery using the Rom Manager or Quick Boot apps from the market.
[Other SmartWatches] CEnnis91:
Don't Lose Hope Yet!

Sorry about another delay, but I got caught up in school and life. But I come bearing good news! I was slowly working on the flashable zips for you guys, and I finally finished them. They are actually uploading as I send this (45 min to go =/). They are in a neat little format letting you flash them 3 different ways (RSD Lite, Recovery, or Fastboot); I'll get into the specifics of this in an official post. There are 4 zips, which is why it is taking so long to upload, and they are all based on 1.6.6 (I know there is 1.6.12 out now). There's stock and rooted zips for BOTH the 8gb and 16gb!

Once these are released, I will begin work on an update.zip to root any stock rom regardless of device model or firmware version. School is out of the way for now so this won't take as long. After that, I'll begin work on HyprActv.
[Other SmartWatches] delboydell:
Ive just updated to 1.1.3a, did a clean install and re rooted.

I,m not sure if this is a bug or somthing I may have done wrong but,

I am unable to move apps to the SD card? the app I know could be moved there were my slingbox app as its quite large,

any ideas?
[Other SmartWatches] d2tw4all:
Missing Keyboard

Since I switched to the ROM on here a few weeks ago, I get no keyboard in maxthon. Can anyone tell me how to set the keyboard options on this so hopefully I can get some kind of keyboard working for maxthon?

Tom
[Other SmartWatches] th3drow:
does the keyboard work in anythng else? you can put a shortcut to the keyboard settings and check and see if its disabled or something.
[Other SmartWatches] PhilPan:
Is there anyway to mark all notifications as read? Because I'm having so many unread notifications on watch, when I check them with my phone?

I
[Other SmartWatches] fernandoavc:
Just for information I did an install without wipe and everything went just fine! Nice work!
[Other SmartWatches] rusty1701:
apk's not showing up

Im having the same problem as delboydell!! I was running cleardroid 1.1.2b with no problems ( being able to transfer apk's). Since upgrading to 1.1.3 a, i cannot transfer apks!! I thought i might have messed something up, so I went back to full stock and then re rooted and reflashed 1.1.3a, used root tools, installed ics launcher, the install apk mod, and button mapper. When i transfered my apks, like i have done numerous times before, they will not show up on the launcher. I then went back to stock, re-rooted, went back to 1.1.2b. I completed the mods as above, and I still cant see the apks!!! I've rechecked my steps, and I just cant get any progress. Any ideas? I'm going to unroot and go back to full stock and see if anyone knows whats going on!!! please help!!

---------- Post added at 08:27 PM ---------- Previous post was at 08:21 PM ----------

...oh and yes, i have been clearing the caches!!
[Other SmartWatches] speedyink:
stop adb using motoactv easy modder tool
[Other SmartWatches] rusty1701:
apk's not showing up

ok, but it the mod tool worked before. was there some type of change??? i downloaded it from the motoactv wiki. how would i get a new launcher to start from the default launcher??? how to access the apk for the new launcher.. sorry, kind of a newb issue, i guess.. Thanks for your help!!!
[Other SmartWatches] ClearD:
I'm not entirely sure what the question is. Are you talking about moving a physical .apk file from your computer to the watch or are you talking about moving installed applications to SD card after they're installed?

Sent using XDA-funded carrier pigeons
[Other SmartWatches] rusty1701:
apk's not showing up

sorry to be confusing.. ( a little tired) I guess what mean is; once I have flashed the new ROM, how do i access the ADW launcher apk to install the new launcher. What I was doing before, was using the modder tool to install ICS launcher. I was then able to install a file manager that i downloaded from the Market (play). Then I was able to install other apps that I transfered to the actv, using the file manager to access the install apk. This is probably not the easiest way, but its the only way I know how to get apps on the actv, and it worked great before. Thanks for your help.
[Other SmartWatches] ClearD:
Install your launcher through adb. Something like:

adb install launcher.apk

It will install your apk file to the watch, and when you reboot, it will ask you which one you wish to use. Once you get into the launcher, you can access the play store and download apps.

Sent using XDA-funded carrier pigeons
[Other SmartWatches] Triumph:
OMG!!! THANK YOU!!! I CANNOT WAIT! YOU ARE AWESOME!!

(sorry for caps)
[Other SmartWatches] ByronCole:
i think its bricked

I am stuck in fastboot... every time i try to flash the boot.img or any image it fails... but when i use "fastboot devices" it shows the activ... is there any hope?
[Other SmartWatches] ClearD:
How does it fail? How did you get into fastboot?

Sent using XDA-funded carrier pigeons
[Other SmartWatches] ByronCole:
i get into fastboot by plugging in the homemade factory cable, and pressing power + start

I try to flash boot.img (fastboot flash boot boot.img)

says failed: command write failed (unknown error)

when i try to turn it on (with factory cable) it gets stuck on the red M and doesnt do anything
[Other SmartWatches] ClearD:
Stupid phone. Mispost.

Sent using XDA-funded carrier pigeons
[Other SmartWatches] ClearD:
I'm not sure anyone's tried a factory cable flash yet, to be honest. I bought one and it boots and is connected in fastboot, but haven't tried it with low battery or anything. I am assuming your battery is low, or else you wouldn't be trying the factory cable route?

By chance, you didn't try to "fastboot/adb reboot bootloader", did you? That will throw a device into the "fastboot loop of death", as speedy calls it lol.

Sent using XDA-funded carrier pigeons
[Other SmartWatches] ByronCole:
I dont think i did the reboot bootlaoder but i bricked it a while ago... is there any fix for that if i did?

And the cable works but it exits boat loader after like one min... and the actv gets really hot after a while
[Android Software/Hacking General [Developers Only]] cdesai:
If you want the kernel source, contact the manufacturer, as the Linux kernel is licenced under GPL and they need to release source!

From my fingers to your eyez
[Android Software/Hacking General [Developers Only]] fv+:
just in case 2
[Android Software/Hacking General [Developers Only]] DerKoch:
Best of luck!!!!

DerKoch
[Android Software/Hacking General [Developers Only]] dbaybay:
Good luck.
[Android Software/Hacking General [Developers Only]] BreeZyer:
Appreciate the work to gather the info together, OP. Glad another soul fights for our shiny toy ;)

Having a forum would help putting such info in stickies. Keep voting!

Vote +1 Le Pan forum here

As for source code... anyone threatening legal action yet? ;) j/k ...
[Android Software/Hacking General [Developers Only]] TchuLandry:
Dude, problem? Calm down, I think this is the best thread with all the infos right now.
[Android Software/Hacking General [Developers Only]] dbaybay:
10chars...
[Android Software/Hacking General [Developers Only]] gfinockio:
$30 US to the first person with a working CM7 (or CM9) custom ROM on the Le Pan, via Paypal!
[Android Software/Hacking General [Developers Only]] Bigtech313:
I'll give $50
[Android Software/Hacking General [Developers Only]] whatid:
Thx OP, nice... Keep up the good work guys!

So, correct me if I am wrong. In theory the first step is to recreate a 2.2 'custom' kernel replace the existing one, repackage, and try to flash it and see if it works, right?

Worst case (assume the boot loader is not messed up), it should be able to flash back to the official ROM image, right?

(or I should say, first test is to replace the boot screen in ROM image to test repackage and see if it works... Yes I am aware you can change the boot logo in the filesystem afterwards but that's not the point)

I do plan to set up a build environment over the holiday, but I hope those alreay have experience can have a head start!

---------- Post added at 06:33 AM ---------- Previous post was at 06:02 AM ----------

OZ8805 Gas Gauge seems to be an obsolete product from O2Micro. However from some old document (http://www.docin.com/p-97287653.html or http://www.scribd.com/doc/61448457/o2m-Int-Power-Brochure) it shows the pin out which looks like I2C interface (SCL/SDA)

Hynix253 Camera:

Bit and piece of info

http://e2e.ti.com/support/dsp/davinci_digital_media_processors/f/100/t/135743.aspx

And looks like it is widely available in China for use in cell phone camera, however can't fins much specs other than a few photos. It is made by 冠普科技. http://detail.china.alibaba.com/buyer/offerdetail/891985423.html

ePL580x Light sensor:

according to this page http://www.computex.biz/elan/default.aspx?pagetype=ProductDetail&pdt_id=38766&cid=561 it is made by ELAN Microelectronics Corp. http://www.emc.com.tw But I can't seems to find the product on their website

Digging continues...
[Android Software/Hacking General [Developers Only]] colbynmeghan:
I was able to find this website with

more on the tablet. I tried to email them for more information but idk if it sent to them. Maybe someone else can try on a PC, only have my phone for now....

Edit: forgot the Website. http://211.72.69.29/en/product5802.html

So here it is

Sent from my i777 high in the sky
[Android Software/Hacking General [Developers Only]] squirreltech:
what is the website?
[Android Software/Hacking General [Developers Only]] gfinockio:
There is a new firmware file on the horizon for the Le Pan TC 970. Not sure if that's of any importance to you...
[Android Software/Hacking General [Developers Only]] sockbot:
Source?

Op, is there anything community members can do to help?
[Android Software/Hacking General [Developers Only]] dbaybay:
A member of le pan support is a member of the le pan group and asked a few members to test out the firmware. It should be released publicly soon.
[Android Software/Hacking General [Developers Only]] srivers33:
Let us know if theres anything that can be done to help. Would love to see some CM9 port on this thing. Thanks again for the hard work. Keep it up.
[Android Software/Hacking General [Developers Only]] esunday:
Any info on significant changes, I'm pretty happy with the current firmware....
[Android Software/Hacking General [Developers Only]] sockbot:
There is a discussion on the new firmware here: http://xdaforums.com/group.php?do=discuss&discussionid=1446&pp=10

It looks like it is mostly stability fixes but it is still a 2.2 firmware.

This thread is about getting a custom 2.3+ firmware on the TC 970 which I want so my apps behave as tablet apps instead of large phone apps. Ever notice how sometimes you see an app screenshot in landscape mode having two panels for navigation and content but when you actually download it it only shows the content? Its because the tablet can only act as a huge phone in 2.2. Need 2.3 and ideally 4.0 in order to have proper tablet behaviour.
[Android Software/Hacking General [Developers Only]] dbaybay:
Keep the dream alive because the reality of it happening is getting dimmer day by day. Le Pan announced the Le Pan 3 and Le Pan TC978 today and with the Le Pan 2 already being shipped I have a feeling the tc970/lp1 test model will be forgotten just as fast as Le Pan forgot it :(
[Android Software/Hacking General [Developers Only]] GnatGoSplat:
Actually, you need 3.2 Honeycomb or up. 2.3 is Gingerbread and still acts as a huge phone. Only visible difference between 2.2 and 2.3 is the notification bar is black with slightly different looking icons. The rest looks identical.

Anyone tried getting CWM on the Le Pan yet? I read the tutorial here:

http://www.koushikdutta.com/2010/10/porting-clockwork-recovery-to-new.html

I already failed his first prerequisite, "This guide will assume you have some familiarity with doing an Android Build." D'oh! And for his second prerequisite, "This guide will work for phones that use a standard Android boot image format." Uh, what? Guess I won't be the hero that ports CWM to Le Pan. :(
[Android Software/Hacking General [Developers Only]] sockbot:
Franco, If the headers are only 24 and 28 bytes, is it feasible to brute force them? If so, that may be a way to distribute the work among the community.
[Android Software/Hacking General [Developers Only]] chinabull:
Just for some more info here from the u-boot serial console investigations based on the u-boot environment variables.

NAND Layout:

00000000 - 0007FFFF SIZE = 00080000, 512KB : MLO, 4 copies same image. Each of them 128K.

00080000 - 001FFFFF SIZE = 00180000, 1536KB : u-boot, 3 copies same image, each of them 512K.

00200000 - 00C1FFFF SIZE = 00A20000, 10368KB : Probably for "innocomm"

00C20000 - 00FDFFFF SIZE = 003C0000, 3840KB : Recovery partition

00FE0000 - 011DFFFF SIZE = 00200000, 2048KB : RAMDISK

011e0000 - 0159FFFF SIZE = 003C0000, 3840KB : Linux kernel

015A0000 - 016DFFFF SIZE = 00140000, 1280KB : Probably "misc and kpanic" based on sizes

016E0000 - 116DFFFF SIZE = 10000000, 256MB : System Partion

116E0000 - 11A9FFFF SIZE = 003C0000, 3840KB : Android Cache

11AA0000 - 1FFFFFFF SIZE = 0e560000, 229MB : Data partition on NAND, not used.

p.s. The mtd map from the kernel:

# cat /proc/mtd

dev: size erasesize name

mtd0: 00280000 00020000 "innocomm"

mtd1: 00080000 00020000 "misc"

mtd2: 000c0000 00020000 "kpanic"

mtd3: 10000000 00020000 "system"

mtd4: 003c0000 00020000 "cache"

mtd5: 0e560000 00020000 "userdata"

I was able to use the "nand read" command to read anything off the nand. I plan to dump the first half of the nand(boot loader/etc) into the data partition and use the kernel mtd driver to dump it to sd card.

Will report back.
[Android Software/Hacking General [Developers Only]] touche112:
I'll give $20 for Honeycomb or ICS. Haha Froyo sucks.
[Android Software/Hacking General [Developers Only]] fv+:
Thanks chinabull, dbaybay, and sockbot for your useful comments.

First of all I am not a CM developer, nor I have created any ROMs myself, so my approach to this problem may be inadequate (or completely wrong) and I would be happy if you told me right away before I waste too much time.

This is what we know:

- from the FCC schematics the tablet has the SYS_BOOT switch set to boot in the following order:

1. NAND 2. USB 3. UART3 (serial) 4. MMC1 (SD card)

- as chinabull pointed out, the first sector in the NAND is Innocomm x-loader (aka MLO)

- the 'strings' command on Innocomm x-load shows that it checks for the firmware (for instance it has to be called 'griffin.ifw') before it loads it

This is what I am assuming (correct me if I am wrong):

- we want to be able to load our custom ROMs (eventually CWR) from the SD card (this is what I did for the Nook Color and this is how it is done on many phones); although it would be possible to boot from the serial connection or the USB, given the boot order above, I don't think we have much choice but have to 'pass' the Innocomm x-loader test

- once we know how to generate all the headers in the Innocomm firmware, it will take only a day or two to create a 'packer' that packs together our custom ramdisk, recovery, system, etc and that the x-loader will recognize as a valid firmware file

Given these assumptions, my goal for now is to be able to just change one line (for instance a comment) in any file within system, assemble the firmware back together and have the tablet load it without problems.

As I mentioned in the first post, there are only two numbers (probably checksums) that I don't know how to generate.

The fact that in firmware 4626 Innocomm did not change the splash images and that the checksum for those images is the same as in 4431 makes me think that the 224 bit checksum for these files is computed based only on the file content, not on their load address, name, version, etc

Last but not least, there not really 'brute force' approach to find out the algorithm used to generate these checksums: we need to be able to arbitrarily change the content of the files of the firmware and generate a new valid firmware image.

Which also means that if those numbers are actually 'signatures' and Innocomm used their private key to sign that firmware, there's not really much we can do (assuming my assumptions are correct; in this case I really hope I am wrong).

Franco
[Android Software/Hacking General [Developers Only]] chinabull:
I compared the MLO in 4431 and 4626. They are different and but the difference is only the version string.

So I think there is no signature checking what so ever in the MLO which means we can modify it in binary in theory.

Another thing I did is to disassemble the MLO (BTW, the MLO loads to 0x40200000 and you would have to skip the first 8 bytes)

I found the checksum calculation routine and currently working on a C version of it.

Both the .ifw file header and .ism header use the same routine but with different parameters.

I think we have 2 choices:

1. Modify the MLO so it skip checking the checksum completely. This is easy in code wise (mostly 4-12bytes of modification). After mod, we can copy the new MLO to SD card and use the u-boot serial console to burn it.

But the risk doing this is that if anything goes wrong, your TC970 is completely dead other than opening the cover to set the jumper to boot from SD card first.

2. Work out the C program to generate the checksum.

Will report back for progress.
[Android Software/Hacking General [Developers Only]] fv+:
Chinabull, that's the very good news I was hoping to hear.

Franco
[Android Software/Hacking General [Developers Only]] chinabull:
Great news guys.

I have successfully implemented the signer for the TC970 firmware headers.

I changed the version number to 8888 in griffin.ifw in hex editor and signed the header with my signing tool, the firmware upgrade process showed up version 8888 with no complaint(errors if not signed, see logs).

The firmware header and image header use the same signing method. It is just the checksum result was put into difference location.

The firmware header use 0x10 offset (4 bytes) while the image header uses 0x1C offset (4 bytes).

PM me if you want the source code.

Here are some logs:

Modified to version 8888 without signing:

i-Load 201108181716-s4431

Loaded from NAND

[POWER_DEBUG] power button: YES, rowbits = 0x01, colbits = 0x02

Firmware Booting ...

## Loading griffin.ifw from SD Card...

Invalid i-packer firmware header (3)

Invalid firmware file

**Unable to read griffin.ifw from SD Card**

with signing:

i-Load 201108181716-s4431

Loaded from NAND

[POWER_DEBUG] power button: YES, rowbits = 0x01, colbits = 0x02

Firmware Booting ...

## Loading griffin.ifw from SD Card...

Board Name: griffin

Firmware Version: 8888

## Loading iboot from SD Card ...

Image Name: iboot

Image Version: 201108181716-4431

Verifying Data ... OK
[Android Software/Hacking General [Developers Only]] DerKoch:
That is outstanding!!!!! Great work from you all!
[Android Software/Hacking General [Developers Only]] whatid:
Outstanding!

So now, what's next. I understand it is easy to compile a new kernel. But where are the additional drivers (.ko files?) come into play?

p.s. is that also means somewhat safe to 'restore' to older firmware if needed? (e.g. testing a kernel w/o touchscreen support then roll back to something that's more usable)
[Android Software/Hacking General [Developers Only]] fv+:
Awesome job chinabull!

I already updated the OP with this great news.

If you are OK with it, I'd like to include your code in the unpacker and write a packer to be able to make our own firmware images for the TC970/griffin from the actual files (giving you all the credit you deserve, of course).

Do you think as a start that we could start replacing Innocomm recovery (that is pretty bad, IMHO) with Clockwork Mod recovery, leaving everything else unchanged? This would provide us with 'nandroid' for full backups, ability to flash zip files, wipe cache, etc.

Thanks again for all your work chinabull!

Franco
[Android Software/Hacking General [Developers Only]] chinabull:
Yes, that will be the plan.

But first we would have to get through the second level checksum.

Again, we have 2 options:

1. Binary hack the MLO and u-boot to skip the second level checksum.

2. Work out the algorithm of the second level checksum.

Btw, second level check sum seems to be 20 bytes long. Any well known methods that generates 20 bytes checksum?
[Android Software/Hacking General [Developers Only]] chinabull:
Another good news here.

I found they have used the SHA for the generating the second level checksum since I saw the SHA initial data digest signature in the MLO.

Will post later for progress.
[Android Software/Hacking General [Developers Only]] sixtythreechevy:
Can I help?

I would like to contribute to this development in any way that I can. I have a TC970 as well and would like to start learning how to develop for Android.

Thanks,

Justin
[Android Software/Hacking General [Developers Only]] fv+:
Justin,

the first thing we are working on at this time is to be able to create firmwares that are compatible with the TC970/griffin tablet; I think we are almost there.

The next step will be to replace Le Pan/Innocomm recovery (which I really don't like that much) with ClockworkMod Recovery and at that point I think we'll need all the help we can get.

You can get ready by reading the instructions on how to port ClockworkMod Recovery to a new device here: http://www.koushikdutta.com/2010/10/porting-clockwork-recovery-to-new.html

Franco
[Android Software/Hacking General [Developers Only]] chinabull:
I manually replaced the recovery image to include CWM(recovery executable only, downloaded version for motorola defy) and signed the signatures.

I can boot into CWM recovery now!

volume -/+ actually works. Power key also works but doesn't do the selection.

I think it's time to build our own CWM for le pan from source.

Picture attached.
[Android Software/Hacking General [Developers Only]] kravlor:
Congratulations on this accomplishment, and thanks for your hard work that has led to it.
[Android Software/Hacking General [Developers Only]] QkSi1ver:
great job dude!

Now all we need is some ROMS :)

keep it up!
[Android Software/Hacking General [Developers Only]] chinabull:
Don't get too excited yet.

We will probably need to rebuild CWM recovery from source since there will be quite a few places needs to be changed, like keys, mounting point, etc.

Also, you may or may not have noticed that the screen is up side down. :)
[Android Software/Hacking General [Developers Only]] sockbot:
This is awesome news. Based on the hardware specs of the tablet, in your opinion what is a reasonable "end game" scenario in terms of what custom firmware we should expect to run reasonably well? Will ICS perform reasonably? Will all the functions of the tablet work, like volume buttons, bluetooth keyboard pairing, GPS, wifi?
[Android Software/Hacking General [Developers Only]] fv+:
Awesome chinabull!

Did you figure out how to generate the checksum for the full firmware or did you replace just the 'recovery' image with CWM?

If you figure out how to generate the checksum for the full firmware, do you mind telling us how you did (or PM me), so I can update the 'unpacker' code and write the 'packer'?

Also, which CWM did you use? The one for the Nook Color?

Again great job!

Franco