[Thinkpad Tablet General] suntechnic:
Here I will post some information regarding using nvlash tool with ThinkPad Tablet.

NVflash tool is a tool for tegra devices which allows different low level operations such as:

1. reading device partition table

2. partitioning device memory

3. reading a device partition

4. writing a device partition

1 and 3 are usefull for backing up device partitions

2 and 4 are usefull for restoring everything back

After backing up a partition you can split the image to a lot of usefull components and information using your PC. You can even edit or add some files to a partition image, i.e. this tool could help you to root your device at any time you want.

Everything here is just for educational puproses. I'm not resposible for any damage which may occur to your device. Use it at your own risk.

Here's small tutorial. Put attached file 04.EBT.img on your hard disk (/space/android/_tpt/device in my case).

Booting to bootloader

1. Turn off your device and disconnect it from PC

2. Hold Rotation button and press Power button for approx 2 seconds

3. Start nvflash:

$ nvflash -w --bl /space/android/_tpt/device/04.EBT.img --go

4. Connect device via USB. After that you should able to see the following:

Nvflash started
rcm version 0X20001
System Information:
chip name: t20
chip id: 0x20 major: 1 minor: 4
chip sku: 0x8
chip uid: 0x043c6246433f44d7
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 0
sdram config strap: 2

downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: /space/android/_tpt/device/04.EBT.img
/ 6291456/6291456 bytes sent
/space/android/_tpt/device/04.EBT.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully

5. The device screen should display "Entering NvFlash recovery mode / Nv3p Server" message at the top with Lenovo logo at the backroung.

If everything worked fine you have started a bootloader for futher low level communication with your tablet.

Getting partition table information

1. Boot your device with a bootloader as described above.

2. Run the following command

$ nvflash -r --getpartitiontable ptable.txt

3. The following output will be displayed on PC console:

Nvflash started
[resume mode]
Succesfully updated partition table information to ptable.txt

4. This means you have successfully downloaded partition table information to ptable.txt file. You can view it. Here's some useful information from it:

....
PartitionId=4
Name=EBT
DeviceId=18
StartSector=1536
NumSectors=1536
BytesPerSector=4096
....
PartitionId=6
Name=SOS
DeviceId=18
StartSector=3584
NumSectors=1536
BytesPerSector=4096

PartitionId=7
Name=LNX
DeviceId=18
StartSector=5120
NumSectors=2048
BytesPerSector=4096

PartitionId=8
Name=APP
DeviceId=18
StartSector=7168
NumSectors=196608
BytesPerSector=4096
....
PartitionId=15
Name=UDA
DeviceId=18
StartSector=611840
NumSectors=7202816
BytesPerSector=4096

Here I'll try to give some more information:

PartitionId=4 -- is a number of partition

Name=EBT -- is a name of partition. This partition holds a bootloader image. The same you used to boot your device!

StartSector, NumSectors, BytesPerSector -- these parameters determine a location and size of partition in the internal device memory.

Partition 6 is a recovery partition which holds recovery image (kernel + ramdisk). You can use split_bootimg.pl to split it.

Partition 7 is a bootable partition which holds bootable image (kernel + ramdisk). You can use split_bootimg.pl to split it.

Partition 8 is an ext4 image of /system partition. You can mount it using mount linux utility.

Partition 15 is an ext4 image of /data partition. You can also mount it using mount linux utility.

Reading partition images from device

This method can be used to backup your device. I will show you how to backup a recovery partition (6) but you can do it with any partition you want.

1. Boot your device with a bootloader as described above.

2. Read partition number 6 to file 06.SOS.img with the following command

$ nvflash -r --read 6 06.SOS.img

3. The following output will indicate a successfull read

Nvflash started
[resume mode]
receiving file: 06.SOS.img, expected size: 6291456 bytes
/ 6291456/6291456 bytes received
file received successfully

Using split_bootimg.pl you can split you to kernel and ramdisk image:

$ split_bootimg.pl 06.SOS.img
Page size: 2048 (0x00000800)
Kernel size: 3659716 (0x0037d7c4)
Ramdisk size: 1496705 (0x0016d681)
Second size: 0 (0x00000000)
Board name:
Command line:
Writing 06.SOS.img-kernel ... complete.
Writing 06.SOS.img-ramdisk.gz ... complete.

Now you can get ramdisk contents:

$ mkdir ramdisk
$ cd ramdisk
ramdisk$ gzip -dc ../06.SOS.img-ramdisk.gz | cpio -im
4405 blocks
ramdisk$ ls
data dev init proc sbin system ueventd.goldfish.rc
default.prop etc init.rc res sys tmp ueventd.rc

Writing an image to device partition

Be very carefull! This operation can brick you device. If you are unsure of result you'd better don't use it :)

1. Boot your device with a bootloader as described above.

2. Write file recovery.img to partition number 6 (recovery) with the following command:

$ nvflash -r --download 6 recovery.img

3. Here's a sample output of successfull operation:

Nvflash started
[resume mode]
sending file: recovery.img
/ 6291456/6291456 bytes sent
recovery.img sent successfully

4. You will also note a large message PASS on your device screen following with the message "Success to update the system, please reboot your system to leave the recovery mode"

5. Now you can easily reboot your system and test your new recovery.

Conclusion

You can use nvflash for deep exploration of your device software, backing up software before any critical updates, flash modified software.

Thank you

P.S. Sorry for any mistakes as English is not my native language.