yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] mforce2:
I added some stat and statfs commans.

For /dev/flash, /dev/flashu and /dev/flasha there's just failures:

Sys stat failure

Sys stat failure

Statfs failure

I'm thinking maybe they actually don't exist on the Powkiddy J6.

For the rest of the files I got some more interesting results.

For /mnt/disk files both sys_stat and stat fail but sys_statfs actually works reporting :

Statfs success

FS type: 0

No f_type

Avail blocks: 198

Blocks: 23424

FS type is set to 0 for /mnt/disk.

Even more info is obtained from files in /mnt/diska:

Sys stat success

Type: 32768

Stat success

Type: 32768

Statfs success

FS type: 4

Avail blocks: 150

Blocks: 7905

For me that's it with the SDK for now. I think it's all the info I can get. One more thing would be to use the get and set configuration functions to try and modify some things but I think I'll leave that for later.

Also for later would be fixing the binaries so that they correctly can be started from the launcher and when they quit control returns to the launcher. This is not really working right now so I've had to make it crash which results in dumping the data to the card followed by a reboot.

I'm going to look at the SPI dump and try and identify the partitions ( at least some if not all are FAT32 I believe ).
[General Questions and Answers] The_YongGrand:
Thanks for the recommendations. :)

There are Powkiddy J6 that is being sold too for that price in SE Asia, so I'll try to get one if we can get the firmware at the SPI flash replaceable.

The strange part is, are these different versions of SDKs (including this one and the other places) having the same SDRAM configs?

I'm not sure if these Actions SDK inside the git are the entire firmware with the bootloader plus whatever config data for the these hardware like the SDRAM.

Or, these SDK is only responsible for compiling the apps inside and not the entire firmware?

I'm suspecting that the SDK doesn't keep those SDRAM config files - these factories might be deploying the firmware with different brands of SDRAM available. The one I have "Gameplayer" that uses the ATJ2259 has a "Dynet" (or Micron?) SDRAM, and I do believe each of those SDRAM would have different refresh rates. Putting a wrong SDRAM config in would mess up the program or to cause the firmware to crash.

On my free time I'll dig up further on that SDK. And, I'm following this pretty closely too - I love these kind of surprises! :D
[General Questions and Answers] mforce2:
This particular

This particular SDK that I am using seems more high level , just for making GUI apps. It's all based on an API that makes calls to functions at fixed locations.

Actions uses this API to abstract even between different SOCs. The RAM and hardware part is initialize by this ActBrm I believe and then there might be some low level UCOS things.

Take a look above if you are curious. I have referenced the dump from the J6 plus some article talking about some similar firmware.
[General Questions and Answers] The_YongGrand:
Aha, just read the rockbox link that you have suggested. That entire firmware image have all the config details hardcoded inside. So, this SDK is just to build the app and not the entire firmware image.

The unpacked firmware reveals quite a lot of stuff - the ADFUS.bin, MBRC__.bin and the BREC__.bin could have been quite hardware specific.

For the factories that churn those toys out, I suspect they could have made minor modifications on these .bin files, while the developers of the app will only work on the API without need to know much about the hardware area.

That's how these ATJ toys boots up. I'm not sure what's ADFU Server and PC tools means - could be an interface between this and the PC to download/upload binarys. (But could we do a bare-metal here? :LOL:)

These bin files must be preserved to have the toy running - or else we wouldn't boot it up. As these bin files could be very, very hardware specific, losing them would turn these things into a brick. Lucky we have the firmware image that is pasted there in the Steward Fu's link you have mentioned.
[General Questions and Answers] The_YongGrand:
Earlier on, I have kept some links about these toys, and they are not Powkiddy J6, but an earlier version of it that is built on a fake PSP shell.

This git dated 2012 might be a custom loader app for that device:

https://github.com/uli/actsemi

There are blogs documenting about how it works, and how they dissect it:

PulkoMandy's Reverse Engineering notes for ATJ227x

Uli's WIP emporium

Maybe you have checked on these already - these are pretty good read and reference.
[General Questions and Answers] mforce2:
Already checked them, thanks.

Actually all of libActSemi is superseded by this SDK. It uses the exact same address for the functions as the SDK but it's much easier with the SDK.

As I said this SDK seems to be just for building the apps.

I did however find some others that seem to be more complete but they are older I think and don't seem to fit the J6 so well.
[General Questions and Answers] mforce2:
Also here's some observations about the dump file structure:

0 - 00080000 -> text recognizable , various text and routines, FF at the end ( exactly 512K )

00080000 - 00C00000 -> unrecognizable text, seems like data partition, FF at the end ( exactly 11 MB )

00C00000 - 00FE5600 -> unrecognizable text, seems like data partition, FF at the end ( exactly 3 MB )

It seems to me that there's 2 partitions here and a 512K are in the beginning. Interesting is that while for the 512K area at the start the strings are clearly visible for the 2 data partition they're not.

I wonder in what format the data is on those partitions that makes it not accessible, compression , encryption ? Just a FAT32 partition ? I'm not that familiar with these low level things to if anyone can contribute here....
[General Questions and Answers] mforce2:
I've started to analyze the firmware update but I don't have the X16 so I'm trying the firmware update for the X16 on the Powkiddy J6.

It seems that while there's support for some Python update script at least in the beginning the X16 firmware is not using Python. It's trying to read some ChipID , RAM parameters and stuff like this.
[General Questions and Answers] mastee76:
Great that you guys have picked-up this project, I was on the now mysteriously vannished thread and managed to install the modified FW successfully couple of days before the thread disappeared. I have the older x16 and it was with the older menu so it was nice to get it a bit updated. Except being able to launch games from the icons the rest works well. The psx games are quiet slow but the rest play well, will be checking-in to see how yall doing, thanks
[General Questions and Answers] mforce2:
Hi,

Glad that you're still around. It's a pity about the original forum thread. I don't really know what happened, I tried to contact someone from xda support but never got any answer back.

What was cool is that someone shared the original firmware for the X16. I still wonder where he got it from.
[General Questions and Answers] ThegreatHAMbino:
Not gonna swear to it but iirc the guy who dropped that .fw download said he got in contact with the vendor who provided it for them. Not 100 percent sure but that seems believable given you were told a similar thing when reaching out for information. Seems far fetched that as many times as these were rebranded, that a vendor would have access but hey it definitely came from somewhere.
[General Questions and Answers] ThegreatHAMbino:
Glad to have you aboard! A cheaper alternative for anyone wondering, would be the x12/x12+ In the last thread, there was a guy that ran that .fw for the x16 and it ran fine on the x12. The same chipsets are used across the devices, shells and screens being the only real differences. But if the j6 allows for execution from the SD card as stated and has a better screen it's probably the way to go. Either way we're making headway definitely stick around..
[General Questions and Answers] ThegreatHAMbino:
Shot in the dark, would that be due to the way the ucos systems are designed? Prioritizing the sequence of events from the "bootloader" ie: the more important events first (boot sequence, screen, graphics, etc..) followed by the smaller changes/details.. I'm also going to say as far as the partitions are concerned it's most likely encryption.
[General Questions and Answers] mforce2:
We're getting help from Gianluca who posted his finding here:

teardown/powkiddy/mbrec.md at master · gipi/teardown

Devices that happened to be dismantled by me. Contribute to gipi/teardown development by creating an account on GitHub.

github.com
[General Questions and Answers] mforce2:
In the meantime I've made some discoveries of my own.

1. There's no python script as I thought initially . The Actions Pad Tools does indeed support flashing using Python scripts but at least for the Q700 firmware ( where Q700 = X16 ) this is not how the update is done.

2. Instead there's some sort of state machine as far as I can tell and it's mostly all in this Production.dll

3. SQLite3 is statically linked inside Production.dll and queries are fun from the functions inside this dll

Now for the interesting part. I've generated a text file , here: https://drive.google.com/file/d/1LSeQ4VLt3gwJQPyMkF6t3tgaUNdQ6lvM/view?usp=sharing

with all or almost all of the SQL queries that are run during the update in the sequence that they're called in. I think this speaks a lot about what's actually being done.

It also seem there's some functions defined the SQL Database under tables like : ExSymbol and FuncSpec. These functions are then using binaries like hwsc09.bin ( found in FileTable ) to perform operations.

It also seems there is indeed some encryption :

'select count(*) from sqlite_master where type=',27h,'table',27h,' ' 'and name=',27h,'ENCRYPT_EN',27h,0

'select NumberA from ENCRYPT_EN ;',

In the Q700 update this 'ENCRYPT_EN' is set to 1.

The sequence itself of the update is.

1. Check if ADFU and if not switch to ADFU mode

2. Open Connection ( using winusb.dll )

3. Use ADFU write from Hardware60u.dll to upload the ADFU binary to the device, adec09_1.bin

4. Run various command using CHardware::ExtCommand

The problem with using the Q700 firmware upgrade file to update the Powkiddy J6 is that it gets stuck and give and error in the flashing software. It's not bad since I don't want it to mess up my J6 which is not compatible for sure because of the NOR SPI vs NAND.

Last query after which the failure happens is:

debug1456:10C657F9 aSelectFilename_10 db 'select FileName from NAND_ID where NumberB = 909717587 ;',0

I assume that 909717587 is the ID of the NOR flash on the J6 while the Q700 firmware only knows about 2 IDs :

858796102 and 858801747.

It all fails here and that's the end of the SQLite3 queries.

If you have the time I really suggest browsing the text file with the queries, it tells quite a good story and better than I can in words.
[General Questions and Answers] mforce2:
This script that is used is really weird,

FUNCS_AHEAD( )

{

BYTE UPG_TOOL = 1 , MAKER_TOOL = 2 ;

BYTE SCODE = 1 , SCODE_BAK = 2 ;

__RunFunc("LFI" , "TOOL_TYPE" , UPG_TOOL , "SCODE_TYPE" , SCODE_BAK);

__ReleaseFunc("LFI");

__RunFunc("LFI" , "TOOL_TYPE" , UPG_TOOL , "SCODE_TYPE" , SCODE);

__ReleaseFunc("LFI");

__RunFunc("HideDisk");

__ReleaseFunc("HideDisk");

};

And these __keywords are then defined in the production dll ... the functions are then expanded from what I can tell and it becomes recursise.

The above extract seems like the main upgrade instructions.
[General Questions and Answers] o-marshmallow:
@mforce2 More and more info are coming in, that's great!

I recall seeing some scripts in the Q700 firmware, they should be called by Action software when flashing, here is the HideDisk function that the code you showed calls:

HideDisk( ){
DWORD dDiskLen ;
BYTE pbFsType[6] = __ParamKey(1 , "MAKE_HIDE_DISK" , 0) ;
DWORD dDiskCap = __ParamKey(1 , "MAKE_HIDE_DISK" , 1) ;
BYTE bFsType = 1 ;
if(__MemCmp(pbFsType , "FAT16" , 5) ==0);
JmpFalse 9;
bFsType=1;
Jmp 18;
if(__MemCmp(pbFsType , "FAT32" , 5) ==0);
JmpFalse 13;
bFsType=2;
Jmp 18;
if(__MemCmp(pbFsType , "FAT12" , 5) ==0);
JmpFalse 17;
bFsType=18;
Jmp 18;
bFsType=1;
if(dDiskCap !=0);
JmpFalse 23;
BYTE pbFileName[12] = __ParamKey(1 , "HIDE_DISK_IMG" , 0) ;
MFILE fFileHandle = __FileOpen(1 , "HIDE_DISK_IMG" , pbFileName , 1) ;
dDiskLen=__FileSizeOf(1 , fFileHandle);
};

All these scripts can be foun din the table FuncSpec. Another interesting table is ExSymbol (External Symbol ?), I think it contains a declaration of the symbol used by the scripts but not present in the firmware file, they should be defined in the DLLs of the flashing software. Here is an example of the table entry:

Type	Name	ParentFunc	Script
2	ENCRYPT_FWIMAGE	MakeFwImage( )

FILE_ITEM ENCRYPT_FWIMAGE {encrypt_fw_part_1 ; fwutail ; }

It means that MakeFwImage() script in the FM image makes the use of ENCRYPT_FWIMAGE symbol (located in the DLLs I guess), the last column.. I am not sure about it
[General Questions and Answers] mforce2:
I think I've figured out one thing about how it all works.

1. First thing that the Production.dll does is look for the "FUNC_AHEAD" table. In the Q700 this points to "FUNCS_AHED".

2. Then the FuncSpec where Signature like 'FUNCS_AHEAD(%)' is queried. These 'FUNCS_AHEAD' functions will the be run

3. The ExSymbol table is also checked for ParentFunc like 'FUNCS_AHEAD(%)'. These will probably be also run

4. Now the dll looks for the "ADFU_PROBATCH" table ( it can also look for the ''ADFU_UPGRADE' or some others depending on some things) which points to "NoyaAdfuProBatch"

5. 'select * from FuncSpec where Signature like 'NoyaAdfuProBatch' . And then run these functions I assume.

6. 'select Name,Script from ExSymbol where ParentFunc like 'NoyaAdfuProBatch(%)' . Run these functions afterwards

Of course these functions can expand and make different SQL queries but I think this is all that drives the update process.

Interesting things would be now to see how these script functions are mapped to the dll functions ( I think I've found the function that does it )
[General Questions and Answers] godkingofcanada:
sort of what I meant yes, and its odd the other thread vanished, no mods contacted me or let me know what was going on, it just went poof. Fortunately most of the relevant information there is inside my head, and I put it and the zip on my own company site so its more permanent.
[General Questions and Answers] godkingofcanada:
Im not allowed to give out my website as its against forum rules, but the name of my company is Tech Toy Tinker Company
[General Questions and Answers] wake_drop:
At your website for modding the X16 (or here) can you give photos of the modded X16 screens, or is it the same as stock?

How different is the modded X16 from stock?

New emulators installed?

Any other information?
[General Questions and Answers] jerrimus:
HOLY CRAP!

Am I glad I found this thread, my google-fu is improving!

I bught one of these just recently, and have been going crazy, think we can do this. I've found a few things, but nothing I've seen in thread, here is hopefully new info.

There is a knockoff series, Xxx, at least X6-X20, I have a 20.

Some info on the OS SQLite: And links to software of interest: A firmware for a 2279 game system called joyou, aand the fw writing tool!

Reverse Engineering notes for ATJ227x

Threads on dingoonity, one I started, another I have read. Some cool links, but nothing groundbreaking.

ATJ2259 | Dingoonity.org - The Dingoo Community

ATJ2259

boards.dingoonity.org

X20 "Doubles" review | Dingoonity.org - The Dingoo Community

X20 "Doubles" review

boards.dingoonity.org

Edit: Also, my PCB is 2020, it's possible I might have newer emulators than everyone else?
[General Questions and Answers] jerrimus:
I found a decryptor for the .fw firmware files, but I can't get it to compile.

atj2127decrypt/decrypt at master · nfd/atj2127decrypt

Decrypt ATJ2127 UPGRADE.HEX firmware update files. Contribute to nfd/atj2127decrypt development by creating an account on GitHub.

github.com
[General Questions and Answers] o-marshmallow:
Hi @jerrimus,

What error are you getting when compiling the decrypter? I could compile it without any problem on Ubuntu 20.04.
[General Questions and Answers] Eliz_FW:
ЗHello, I don't know English well, so I'll use Google Translate. I need to contact mforce2, o-marshmallow,. I got the fw firmware on the powkiddy j6 console. And soon I am going to get the original firmware for powkiddy x16. I didn't quite understand how you can access the internal system, who can help?
[General Questions and Answers] ReX19:
Google Translate: I finally managed to install the firmware. My problem was with Actions Pad product. "Wrong version". I have 1.06 and it worked. On the right you have to tick "PRODUCTION" and "FLASH_ERASE". Download link https://ihax.io/actions-pad-product-tool/
[General Questions and Answers] RayanHafeez:
I just bought the powkiddy x16 for 20$ and i was hoping to install custom firmware on it. Is it possible? Can someone provide me with a guide for it please?
[General Questions and Answers] mforce2:
Hey, sorry but I haven't been active for a while. We could really use the firmware for the J6 if you have it. Let me know what you're interested in.

We're interested in hacking the J6 and maybe writing a custom firmware for it but at least writing some new software for it.
[General Questions and Answers] Eliz_FW:
I'm more interested in fixing many problems in powkiddy j6, as well as writing useful programs. I created a thread on another forum where I collect information about powkiddy j6. {Mod edit: Link to 4pda removed! Oswald Boelcke, Senior Moderator} And here is the firmware itself https://drive.google.com/file/d/1ojy2EU28dKLGM_SwbuJUSgGEc3TO57LU/view https://drive.google.com/file/d/1-s3uaLZhF78x-3wsqRmQ5D97RZ282TrM/view
[General Questions and Answers] kocoman:
is this the same as K163 media player? thx
[General Questions and Answers] Galen1722:
Hello,

I have a pokiddy X19 but I need the main firmware any clue where I could get that because I searched the whole internet and I could not find anything. I was hoping I could get help.

Thank you.
[General Questions and Answers] RayanHafeez:
Is there a working custom firmware for powkiddy x16 that i can use? also what flashing tool should i use? Sorry for my bad english.
[General Questions and Answers] Fing72:
Good evening,

I have a Powkiddy x16 console.

I tried to update the firmware and something went wrong.

Now the console no longer starts and the flash software (Actions_Product_Tool) doesn't see it.

What can I do to restore the firmware in these cases?

Is there a recovery mode?

Thanks for interesting.
[General Questions and Answers] Eliz_FW:
Try the firmware from my archive or the x12 firmware. It may be best if you uninstall Actions and reinstall it. Here is my little archive with firmware https://disk.yandex.ru/d/dk2AofpRwIGY0A

You can also visit this topic {Mod edit: Link to 4pda removed! Oswald Boelcke, Senior Moderator}

(if you want to download something on 4 p d a, then you need to register or use a mirror). There I have collected some information that will be useful. If the site does not work, use VPN. And about(if you want to download something on 4 p d a, then you need to register or use a mirror). There I have collected some information that will be useful. If the site does not work, use VPN. And I apologize for my English
[General Questions and Answers] Fing72:
Thank you,

I'll try it and then let you know.

Greetings.

Thank you, I recovered the console by installing the basic x16 firmware and reinstalling the ADFU drivers
[General Questions and Answers] Helxgamer:
(google translate) hello friends, how are you? I know this is my first post here but I wanted to ask a favor, I have an x12 plus, I had lost its firmware but the powkkid x16 firmware ended up serving as a replacement, but the difference in hardware caused some buttons to not be mapped like the volume and start and select, is it possible to map this? I don't usually use several emulators, just GBA games, so just having all the buttons working would be great.
[General Questions and Answers] DrBurkov:
Good afternoon! I have disassembled the firmware for the portable game console Project X. I was able to change the text menu items. But I can't change the graphics files in the res files. I couldn't find any program that could open them in Windows. Can anyone tell me how to change the res files extracted from the firmware? The second question is, how can I change the system.img file?

The modified firmware for Project X can be found here: {Mod edit: Link to 4pda removed! Oswald Boelcke, Senior Moderator}
[General Questions and Answers] Oswald Boelcke:
@Eliz_FW and @DrBurkov, hello and good afternoon to both of you!

I've removed the links to 4pda in your quoted posts! 4pda is not only another phone related website (and not at all affiliated with xda-developers) but also well known for the distribution of malware and warez. Links or references to 4pda are not accepted on XDA at all.

XDA Forum Rules (excerpt):

Please refrain from sharing any references to that website in future.

Thanks for your cooperation.

Regards

Oswald Boelcke

Senior Moderator
[General Questions and Answers] DrBurkov:
Thank you for your reply! However, among the links you have suggested, there are links only links to the firmware of various game consoles. I am looking for software to open and edit resource files from console firmware (res extension). Which reg file editing software should I use?
[Xiaomi Mi Max 3 Questions & Answers] elio321:
8.12.13 global developer ROM is Pie right guys ?
[Xiaomi Mi Max 3 Questions & Answers] JulianJenner:
No. 8.1. [MENTION=3247110]elio321[/MENTION] See the name of zip file:

miui_MIMAX3$Global_8.12.13_ec4e24afd9_8.1.zip

Last tag is _8.1 and this is its Android-version.

小米MIX标准版4GB128GB银色MIUI10中国开发者8.12.18
[Xiaomi Mi Max 3 Questions & Answers] GEoMaNTiK:
See my screenshot, 8.12.13 beta.

Check under Android version.. 9 = Pie
[Xiaomi Mi Max 3 Questions & Answers] JulianJenner:
[MENTION=2277386]GEoMaNTiK[/MENTION]

Your picture is NOT GLOBAL ROM, your ROM is XIAOMI.EU based on CHINA DEVELOPER ROM.
[Xiaomi Mi Max 3 Questions & Answers] jorgeepelos:
Opening thread to talk about that, when you have thousand posts and notices talking about this? Really...

And no, last beta its android R. Android Read

Enviado desde mi MI MAX 3 mediante Tapatalk

---------- Post added at 09:02 PM ---------- Previous post was at 09:01 PM ----------

Close this trash

Enviado desde mi MI MAX 3 mediante Tapatalk
[Mogul, XV6800 General] goon55:
Couple questions regarding the Pocket Outlook.

Anyone have a good method of blocking friggin spam and junk mail? I dont see an option within the app to "block senders" or anything.

If I use Outlook on my desktop and I have multiple "rules" and blocked addresses set up, if I allow my ppc to sync with my desktop outlook, will those rules and settings transfer over?

I know most of you prolly use gmail or yahoo. The issue I have with those is that I receive from multiple accounts. I know you can receive from multiple pop accounts with these, but I have not found a means to actually SEND from these pop addresses on the ppc. Course it is entirely possible I didn't set it up properly.

Looking for email solutions. Thanks.