[Android Software/Hacking General [Developers Only]] tweakradje:
Hi,

I have made a backup of 3 mtd block of my Telechips Android stick. This runs on Android 4.0.4 with a tcc8920st. The NAND images are boot.img recovery.img and system.img

(system.img is Yaffs2 fs like /data and /cache)

The mtd's are as follow:

I made a backup using the dd method:

dd if=/dev/mtd/mtd0 of=/sdcard/boot.img -bs=4096

dd if=/dev/mtd/mtd2 of=/sdcard/system.img -bs=4096

dd if=/dev/mtd/mtd6 of=/sdcard/recovery.img -bs=4096

Boot and recovery flash back without problem (both 10 Mb). However system.img won't.

(I use fastboot.exe and the device supports fastboot)

After reboot the /system partition is empty.

The yaffs info of the working system is:

shell@android:# cat /proc/yaffs

YAFFS built:Aug 10 2012 15:20:29

Device 0 "system"
start_block........... 0
end_block............. 149
total_bytes_per_chunk. 8192
use_nand_ecc.......... 1
no_tags_ecc........... 1
is_yaffs2............. 1
inband_tags........... 0
empty_lost_n_found.... 0
disable_lazy_load..... 0
refresh_period........ 0
n_caches.............. 10
n_reserved_blocks..... 5
always_check_erased... 0
data_bytes_per_chunk.. 8192
chunk_grp_bits........ 0
chunk_grp_size........ 1
n_erased_blocks....... 44
blocks_in_checkpt..... 1

n_tnodes.............. 2627
n_obj................. 1038
n_free_chunks......... 11364

n_page_writes......... 0
n_page_reads.......... 27991
n_erasures............ 0
n_gc_copies........... 0
all_gcs............... 0
passive_gc_count...... 0
oldest_dirty_gc_count. 0
n_gc_blocks........... 0
bg_gcs................ 0
n_retired_writes...... 0
n_retired_blocks...... 0
n_ecc_fixed........... 0
n_ecc_unfixed......... 0
n_tags_ecc_fixed...... 0
n_tags_ecc_unfixed.... 0
cache_hits............ 24839
n_deleted_files....... 0
n_unlinked_files...... 0
refresh_count......... 0
n_bg_deletions........ 0

Device 2 "userdata"
start_block........... 0
end_block............. 607
total_bytes_per_chunk. 8192
use_nand_ecc.......... 1
no_tags_ecc........... 1
is_yaffs2............. 1
inband_tags........... 0
empty_lost_n_found.... 0
disable_lazy_load..... 0
refresh_period........ 0
n_caches.............. 10
n_reserved_blocks..... 5
always_check_erased... 0
data_bytes_per_chunk.. 8192
chunk_grp_bits........ 0
chunk_grp_size........ 1
n_erased_blocks....... 419
blocks_in_checkpt..... 0

n_tnodes.............. 3511
n_obj................. 2358
n_free_chunks......... 123583

n_page_writes......... 6923
n_page_reads.......... 21678
n_erasures............ 28
n_gc_copies........... 3655
all_gcs............... 743
passive_gc_count...... 743
oldest_dirty_gc_count. 27
n_gc_blocks........... 29
bg_gcs................ 29
n_retired_writes...... 0
n_retired_blocks...... 0
n_ecc_fixed........... 0
n_ecc_unfixed......... 0
n_tags_ecc_fixed...... 0
n_tags_ecc_unfixed.... 0
cache_hits............ 15682
n_deleted_files....... 0
n_unlinked_files...... 571
refresh_count......... 0
n_bg_deletions........ 0

Device 4 "cache"
start_block........... 0
end_block............. 74
total_bytes_per_chunk. 8192
use_nand_ecc.......... 1
no_tags_ecc........... 1
is_yaffs2............. 1
inband_tags........... 0
empty_lost_n_found.... 0
disable_lazy_load..... 0
refresh_period........ 0
n_caches.............. 10
n_reserved_blocks..... 5
always_check_erased... 0
data_bytes_per_chunk.. 8192
chunk_grp_bits........ 0
chunk_grp_size........ 1
n_erased_blocks....... 74
blocks_in_checkpt..... 0

n_tnodes.............. 24
n_obj................. 35
n_free_chunks......... 19143

n_page_writes......... 32
n_page_reads.......... 35
n_erasures............ 1
n_gc_copies........... 0
all_gcs............... 0
passive_gc_count...... 0
oldest_dirty_gc_count. 0
n_gc_blocks........... 0
bg_gcs................ 0
n_retired_writes...... 0
n_retired_blocks...... 0
n_ecc_fixed........... 0
n_ecc_unfixed......... 0
n_tags_ecc_fixed...... 0
n_tags_ecc_unfixed.... 0
cache_hits............ 10
n_deleted_files....... 0
n_unlinked_files...... 43
refresh_count......... 0
n_bg_deletions........ 0

All unyaffs and unyaffs2 tools crash on linus and windows. Then I ran into Yaffey windows tool (http://code.google.com/p/yaffey/). Allthough the tool doesn't really work on these system.img files it comes up with an interesting warning message:

Incomplete page found at the end of file (see picture in attachement)

That is the cause of my problem. I have other system.img that does flash with fastboot.exe into the device and that system.img does not give that message in Yaffey.

What does dd do (with -bs=4096) at the end of mtd blocks? Does it dump until the bitter end of the mtd block? What is missing at the end of my system.img Yaffs2 file? Some more FF's? How much more?

My system.img is 300 Mb (300x1024x1024=314.572.800 bytes) Divided by the dd bs of 4096 that would give exactly 76800 blocks. No halve blocks or so.

Still Yaffey says something is missing. And I think there is too. Another proper Yaffs2 system.img also has only FF's at the end. Perhaps the answer is in the /proc/yaffs file from above.

EDIT: must be a footer problem (not everything is dd-ed!) See second picture for proper footer. My system.img has only FF's.

Now how to reconstruct that footer? How many Chuncks per Block? 11364/44=256/257/258/259

With 256(?) chunks/block and 150 blocks and 8192 bytes/chunk: 314.572.800 = 300 Mb that would make sense.

Cheers