Announcement

**no_spam_for_me** · 27 October 2013, 23:29

I) WHAT YOU NEED

I) What you need:
1. USB-Driver via Moborobo
(BTW: needs internet connection to install driver AND keeps USB-drivers after uninstall)
2. ADB by neomode
3. romdump_v82b.zip (Android ROM dumper by Sebastian404)
4. Micro-USB-cable
5. microSD-card OR USB-Stick *
(5a. HP USB Disk Storage Format Tool 2.2.3)
(5b. Integrity check for microSD-card OR USB-Stick H2testw 1.4)
6. Newer busybox (see III)2. )

* If you don't want to work with microSD-card OR USB-Stick you can use:
ADB push <from-PC-file> <to-android-file>
ADB pull <from-android-file> <to-PC-file>
(don't forget the pathes)

**no_spam_for_me** · 27 October 2013, 23:30

II) PREPARE SYSTEM(S)

II) Prepare system(s):
1. Setup android
I've these settings in android
Settings -> [DEVICE] USB -> Enable Connect to PC
Settings -> [PERSONAL] Security -> Enable Unknown Sources
Settings -> [SYSTEM] Developer options -> Enable USB debugging
1a. Unplug power

2. Install USB-Driver via Moborobo
2a. Connect device via micro-USB-cable at OTG-Port at the device with your PC
2b. Plug power to your device (starts up automatically)
(2c. uninstall Moborobo)
(if there are any problems try other way to install USB-Driver)

3. Format microSD-card/USB-Stick with HP USB Disk Storage Format Tool 2.2.3 with FAT32
3a. copy romdump form romdump_v82b.zip to the microSD-card/USB-Stick
3b. make directory "rompump.out" and "dd.out"
3c. Remove it "secure" from PC
3d. put it into your device

**no_spam_for_me** · 27 October 2013, 23:30

III) COLLECTING INFORMATION

III) Collecting information
1. Starting shell via ADB
To starts ADB on PC I use a batch file calling "cmd-call.cmd" with only one command

Code:

cmd

Witch is in the same directory as ADB...

D:\adb_neomode>adb version
Android Debug Bridge version 1.0.26

D:\adb_neomode>adb devices
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
0123456789ABCDEF device
=> If any device is at the list

D:\adb_neomode>adb shell
(quits with "exit")

Code:

root@android:/ #

=> this seems to be the ideal, because it's root (SU), if you don't have the # you have to try to type su

Confirm the correct user:
root@android:/ # busybox whoami

Code:

whoami: unknown uid 0

OR
root@android:/ # id

Code:

uid=0(root) gid=0(root)

OR
root@android:/ # echo $USER

Code:

root

You can find your microSD-card/USB-Stick under the directory "/mnt"
In the following I use a microSD-card

root@android:/ # cd /mnt
root@android:/mnt # ls

Code:

asec
external_sd
obb
sdcard
secure
shell
usb_storage

root@android:/mnt # cd external_sd
root@android:/mnt/external_sd # ls

Code:

LOST.DIR
dd.out
romdump
romdump.out

If you want to use an USB-Stick instead of a microSD-card, you have to find out the correct path:
root@android:/mnt # cd usb_storage
root@android:/mnt/usb_storage # ls

Code:

USB_DISK0

root@android:/mnt/usb_storage # cd USB_DISK0
root@android:/mnt/usb_storage/USB_DISK0 # ls

Code:

udisk0

root@android:/mnt/usb_storage/USB_DISK0 # cd udisk0
root@android:/mnt/usb_storage/USB_DISK0/udisk0 # ls

Code:

LOST.DIR
dd.out
romdump
romdump.out

Then, at this example, you have to use "/mnt/usb_storage/USB_DISK0/udisk0" instead of "/mnt/external_sd"...

2. for the correct busybox release
root@android: # cat /proc/cpuinfo

Code:

Processor       : ARMv7 Processor rev 0 (v7l)
 :

After you have via PC download the newer busybox (I give it the name "busybox-armv7l_1.21.1") and put it to your microSD-card, then you have to copy it to your device
root@android:/ # cp /mnt/external_sd/busybox-armv7l_1.21.1 /data/busybox-armv7l_1.21.1
Destination MUST BE "/data/", otherwise it isn't executable...

root@android: # cat /proc/mtd

Code:

dev:    size   erasesize  name
mtd0: 00400000 00004000 "misc"
mtd1: 01000000 00004000 "kernel"
mtd2: 01000000 00004000 "boot"
mtd3: 01000000 00004000 "recovery"
mtd4: 18000000 00004000 "backup"
mtd5: 08000000 00004000 "cache"
mtd6: 80000000 00004000 "userdata"
mtd7: 00400000 00004000 "kpanic"
mtd8: 20000000 00004000 "system"
mtd9: 113400000 00004000 "user"

root@android: # cat /proc/partitions

Code:

major minor  #blocks  name
  31        0       4096 mtdblock0
  31        1      16384 mtdblock1
  31        2      16384 mtdblock2
  31        3      16384 mtdblock3
  31        4     393216 mtdblock4
  31        5     131072 mtdblock5
  31        6    2097152 mtdblock6
  31        7       4096 mtdblock7
  31        8     524288 mtdblock8
  31        9    4509696 mtdblock9
 179        0    3941376 mmcblk0
 179        1    3941344 mmcblk0p1

root@android:/ # ls -al /dev/block

Code:

brw------- root     root       7,   0 2013-10-27 15:39 loop0
brw------- root     root       7,   1 2013-10-27 15:39 loop1
brw------- root     root       7,   2 2013-10-27 15:39 loop2
brw------- root     root       7,   3 2013-10-27 15:39 loop3
brw------- root     root       7,   4 2013-10-27 15:39 loop4
brw------- root     root       7,   5 2013-10-27 15:39 loop5
brw------- root     root       7,   6 2013-10-27 15:39 loop6
brw------- root     root       7,   7 2013-10-27 15:39 loop7
brw------- root     root     179,   0 2013-10-27 16:29 mmcblk0
brw------- root     root     179,   1 2013-10-27 16:29 mmcblk0p1
drwxr-xr-x root     root              2013-10-27 15:39 mtd
brw------- root     root      31,   0 2013-10-27 15:39 mtdblock0
brw------- root     root      31,   1 2013-10-27 15:39 mtdblock1
brw------- root     root      31,   2 2013-10-27 15:39 mtdblock2
brw------- root     root      31,   3 2013-10-27 15:39 mtdblock3
brw------- root     root      31,   4 2013-10-27 15:39 mtdblock4
brw------- root     root      31,   5 2013-10-27 15:39 mtdblock5
brw------- root     root      31,   6 2013-10-27 15:39 mtdblock6
brw------- root     root      31,   7 2013-10-27 15:39 mtdblock7
brw------- root     root      31,   8 2013-10-27 15:39 mtdblock8
brw------- root     root      31,   9 2013-10-27 15:39 mtdblock9
drwxr-xr-x root     root              2013-10-27 15:39 platform
drwx------ root     root              2013-10-27 15:39 vold

root@android:/ # ls -al /dev/block/mtd/by-name

Code:

lrwxrwxrwx root     root              2013-10-27 15:39 backup -> /dev/block/mtdblock4
lrwxrwxrwx root     root              2013-10-27 15:39 boot -> /dev/block/mtdblock2
lrwxrwxrwx root     root              2013-10-27 15:39 cache -> /dev/block/mtdblock5
lrwxrwxrwx root     root              2013-10-27 15:39 kernel -> /dev/block/mtdblock1
lrwxrwxrwx root     root              2013-10-27 15:39 kpanic -> /dev/block/mtdblock7
lrwxrwxrwx root     root              2013-10-27 15:39 misc -> /dev/block/mtdblock0
lrwxrwxrwx root     root              2013-10-27 15:39 recovery -> /dev/block/mtdblock3
lrwxrwxrwx root     root              2013-10-27 15:39 system -> /dev/block/mtdblock8
lrwxrwxrwx root     root              2013-10-27 15:39 user -> /dev/block/mtdblock9
lrwxrwxrwx root     root              2013-10-27 15:39 userdata -> /dev/block/mtdblock6

root@android:/dev # /data/busybox-armv7l_1.21.1 blkid

Code:

/dev/block/mmcblk0p1: UUID="04A7-463C"
/dev/block/vold/31:9: UUID="8269-1ED1"
/dev/block/vold/179:1: UUID="04A7-463C"
/dev/block/mtdblock9: UUID="8269-1ED1"
/dev/block/mtdblock8: LABEL="system" UUID="06bc9880-9e07-4dec-ae8d-1e59a1b88921"
/dev/block/mtdblock6: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
/dev/block/mtdblock5: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b"

**no_spam_for_me** · 27 October 2013, 23:31

IV) DUMPING

IV) Dumping (at adb shell)

1.) via dd:
dd if=/dev/block/mtdblock0 of=/mnt/external_sd/dd.out/misc.img

Code:

[FONT=courier new]8192+0 records in
8192+0 records out
4194304 bytes transferred in 0.677 secs (6195426 bytes/sec)[/FONT]

dd if=/dev/block/mtdblock1 of=/mnt/external_sd/dd.out/kernel.img

Code:

[FONT=courier new]32768+0 records in
32768+0 records out
16777216 bytes transferred in 1.734 secs (9675441 bytes/sec)[/FONT]

dd if=/dev/block/mtdblock2 of=/mnt/external_sd/dd.out/boot.img

Code:

[FONT=courier new]32768+0 records in
32768+0 records out
16777216 bytes transferred in 2.665 secs (6295390 bytes/sec)[/FONT]

dd if=/dev/block/mtdblock3 of=/mnt/external_sd/dd.out/recovery.img

Code:

[FONT=courier new]32768+0 records in
32768+0 records out
16777216 bytes transferred in 1.340 secs (12520310 bytes/sec)[/FONT]

dd if=/dev/block/mtdblock4 of=/mnt/external_sd/dd.out/backup.img

Code:

[FONT=courier new]786432+0 records in
786432+0 records out
402653184 bytes transferred in 69.198 secs (5818855 bytes/sec)[/FONT]

dd if=/dev/block/mtdblock8 of=/mnt/external_sd/dd.out/system.img

Code:

[FONT=courier new]1048576+0 records in
1048576+0 records out
536870912 bytes transferred in 57.050 secs (9410533 bytes/sec)[/FONT]

/data/busybox-armv7l_1.21.1 ls -ltr /mnt/external_sd/dd.out/

Code:

[FONT=courier new]-rwxrwxr-x    1 1000     1015       4194304 Oct 27 21:09 misc.img
-rwxrwxr-x    1 1000     1015      16777216 Oct 27 21:12 kernel.img
-rwxrwxr-x    1 1000     1015      16777216 Oct 27 21:14 boot.img
-rwxrwxr-x    1 1000     1015      16777216 Oct 27 21:15 recovery.img
-rwxrwxr-x    1 1000     1015     402653184 Oct 27 21:17 backup.img
-rwxrwxr-x    1 1000     1015     536870912 Oct 27 21:27 system.img[/FONT]

?not really need?
dd if=/dev/block/mtdblock5 of=/mnt/external_sd/dd.out/cache.img
dd if=/dev/block/mtdblock6 of=/mnt/external_sd/dd.out/userdata.img
dd if=/dev/block/mtdblock7 of=/mnt/external_sd/dd.out/kpanic.img
dd if=/dev/block/mtdblock9 of=/mnt/external_sd/dd.out/user.img

2.) via "romdump":
cp /mnt/external_sd/romdump /data/romdump

/data/romdump

Code:

[FONT=courier new]Android ROM dumper v0.82b
(c)2011 Sebastian404
Device : rk31sdk-eng 4.2.2 JDQ39 eng.linking.20130709.184313 test-keys
 
Creating required files... done.
Opening mtd table... done.
Dumping kernel config... sh: cat: /proc/config.gz: No such file or directory
done.
Dumping boot partition... done.
Dumping recovery partition... done.
Dumping system partition... done.
Creating Checksums... done.
Cleaning up... done.
All done.[/FONT]

ls -al /sdcard/romdump

Code:

[FONT=courier new]
-rwxrwxr-x system   sdcard_rw   16777216 2013-10-27 22:46 boot.img
-rwxrwxr-x system   sdcard_rw        275 2013-10-27 22:48 checksum.md5
-rwxrwxr-x system   sdcard_rw          0 2013-10-27 22:46 config.gz
-rwxrwxr-x system   sdcard_rw   16777216 2013-10-27 22:46 recovery.img
-rwxrwxr-x system   sdcard_rw       1507 2013-10-27 22:46 system.info.gz
-rwxrwxr-x system   sdcard_rw  373034496 2013-10-27 22:48 system.tar[/FONT]

cp /sdcard/romdump/boot.img /mnt/external_sd/romdump.out/boot.img
cp /sdcard/romdump/checksum.md5 /mnt/external_sd/romdump.out/checksum.md5
cp /sdcard/romdump/config.gz /mnt/external_sd/romdump.out/config.gz
cp /sdcard/romdump/recovery.img /mnt/external_sd/romdump.out/recovery.img
cp /sdcard/romdump/system.info.gz /mnt/external_sd/romdump.out/system.info.gz
cp /sdcard/romdump/system.tar /mnt/external_sd/romdump.out/system.tar

ls -al /mnt/external_sd/romdump.out

Code:

[FONT=courier new]
-rwxrwxr-x system   sdcard_rw   16777216 2013-10-27 23:15 boot.img
-rwxrwxr-x system   sdcard_rw        275 2013-10-27 23:15 checksum.md5
-rwxrwxr-x system   sdcard_rw          0 2013-10-27 23:15 config.gz
-rwxrwxr-x system   sdcard_rw   16777216 2013-10-27 23:15 recovery.img
-rwxrwxr-x system   sdcard_rw       1507 2013-10-27 23:15 system.info.gz
-rwxrwxr-x system   sdcard_rw  373034496 2013-10-27 23:16 system.tar[/FONT]

3.) There is a third way to dump by using rkdump BUT don't work with every filesystem / imagetyp...
(I extract it to the microSD-card and make a dir "rkdump.out ")
cp /mnt/external_sd/rkdump /data/rkdump
/data/rkdump /dev/block/mtdblock0 /mnt/external_sd/rkdump.out/misc.img

Code:

[FONT=courier new]unknown image (00 00 00 00)[/FONT]

/data/rkdump /dev/block/mtdblock1 /mnt/external_sd/rkdump.out/kernel.img

Code:

[FONT=courier new]kernel.img found (8675372 bytes)
dumping...
crc found (4 bytes, 0xe6132873)
done[/FONT]

/data/rkdump /dev/block/mtdblock2 /mnt/external_sd/rkdump.out/boot.img

Code:

[FONT=courier new]kernel.img found (1018124 bytes)
dumping...
crc found (4 bytes, 0xfe9e480d)
done[/FONT]

/data/rkdump /dev/block/mtdblock3 /mnt/external_sd/rkdump.out/recovery.img

Code:

[FONT=courier new]unknown image (41 4e 44 52)[/FONT]

/data/rkdump /dev/block/mtdblock4 /mnt/external_sd/rkdump.out/backup.img

Code:

[FONT=courier new]update.img found (21581824 bytes)
dumping...
crc found (4 bytes, 0x3481a45a)
done[/FONT]

/data/rkdump /dev/block/mtdblock8 /mnt/external_sd/rkdump.out/system.img

Code:

[FONT=courier new]unknown image (00 00 00 00)[/FONT]

But the benefit is, that you get "netto" data

Catch your device specific parameter file

Now you have al lot of "gross" data and it depends on different thinks, what you will need in the following.

BTW:
romdump.out/boot.img AND dd.out/boot.img is identical...
romdump.out/recovery.img AND dd.out/recovery.img is identical...
(compared with " Beyond Compare 3")

**no_spam_for_me** · 27 October 2013, 23:32

V) BUILD UP FLASHABLE IMAGE

UNDER CONSTRUCTION

WinHex or any other Hex-Editor who can work with large files
Rk29xx ImageTools V2.1 by wendal (I download it here at 4. (it's without "su" and "Superuser.apk"))
(Alternatively you can use RK3xxx Firmware Tools by SergioPoverony)

First check the "dd.out/backup.img" with a HexEditor to determine whether there is information in it (first 4 characters "RKAF") or only zeros (HEX "FF") what means it is empty...

If there is this information in it, you will perhaps* have the complete ROM in it, which will include the loader and parameter files and you can use "wendal tools" to extract it...
1. Put the "backup.img" into the wendal tools directory and rename it to "wendal.img"
2. Start the "Runme.bat",
2a. Select 1 + return
2b. then any key
2c. and then you have to wait
Output

Code:

[FONT=courier new]D:\RK3066_IMG_Mod_Tool>lua rk29xx_rom_tools_tnt.lua
RK29xx Image Pack/Unpack Tools
Blog http://wendal.net
Project: https://github.com/wendal/teclast_tools
feedback: [email protected]
Pls input: 1-Unpack 2-Pack 3-Exit
1
Pls copy Image file into this folder,and rename to wendal.img
Notify any errors!
Drücken Sie eine beliebige Taste . . .
Reading file header...
File header: RKFWf
Read loader's offset
Read loader's len
Read update.img's offset
Read update.img's len
Output Loader
offset(0x66) len(0x2F8AE)
Output updata.img
offset(0x2F914) len(0x1973A804)
Unpack updata.img to Temp folder
Check file... OK
------- UNPACK ------
package-file    0x00000800      0x00000241
RK3188Loader(L)_V1.20.bin       0x00001000      0x0002F96E
parameter       0x00031000      0x00000266
Image/misc.img  0x00031800      0x0000C000
Image/kernel.img        0x0003D800      0x00846034
Image/boot.img  0x00884000      0x000FE6F1
Image/recovery.img      0x00982800      0x00B18000
Image/system.img        0x0149A800      0x16E09800
backupimage/backup.img  0x182A4000      0x01495004
update-script   0x19739800      0x000003A5
recover-script  0x1973A000      0x0000010A
Unpack firmware OK!
------ OK ------
Unpack -- All Done
Pls input: 1-Unpack 2-Pack 3-Exit[/FONT]

*In my case it don't seems so (the dump with rkdump it's to small and the rest in the "dd.out/backup.img" is HEX "FF") so the showing output is an example using a flashable img for "RKBatchTool.exe"...

After that, you can find the extracted images, parameter, bootloader... in the folder "Temp".

**no_spam_for_me** · 27 October 2013, 23:32

VI) QUESTIONS

VI) QUESTIONS

**leolas** · 28 October 2013, 07:47

Re: DUMP STOCK-ROM . & . BUILD UP FLASHABLE IMAGE

Good guide.

leolas.

**michael2t** · 28 October 2013, 12:53

Busybox

Hello no_spam_for_me,

Thanks For the Nice Guide ...
Sorry in advance a newbee ...

Questions:

1) What should the screen say if I have The correct Busybox version?
and What will it say if I have the wrong version ?
My version I am Using shows this:

Processor : ARMv7 Processor rev 0 (v7l)

2) The ADB ?? This is for the PC not the RK3188 right ???
I already have adb from android sdk ... is this ok ?

3) I understand about creating the images ...
I understand how to do a ADB pull to get to PC ... But what about the rest of the stuff ?
I do NOT understand the Romdump and What I should be copying from My sdcard
with adb to Where and the correct way to Restore the image ...

Does This Make a update.img like lewy's Post ???

I am sorry ... long time Programmer ... first time Android/linux ...

Michael T.

Originally posted by no_spam_for_me View Post

VI) QUESTIONS

**no_spam_for_me** · 28 October 2013, 14:39

1) not wrong, but the existing version at the device for example have not build in the applet "blkid", so you have more functionality with the downloaded version ...

2) is for the PC, but I don't use the SDK at the moment (and others too, I think so)...

3) UNDER CONSTRUCTION

V) BUILD UP FLASHABLE IMAGE

"...first time Android/linux..." ME TOO

(long time IT consultant, project manager... but not programmer)

**no_spam_for_me** · 28 October 2013, 19:09

Now I need a helping hand!

I try to unpack the backup.img (generated by dd...)

Code:

RK29xx Image Pack/Unpack Tools
Blog http://wendal.net
Project: https://github.com/wendal/teclast_tools
feedback: [email protected]
Pls input: 1-Unpack 2-Pack 3-Exit
1
Pls copy Image file into this folder,and rename to wendal.img
Notify any errors!
Drücken Sie eine beliebige Taste . . .
Reading file header...
File header: RKAF
Read loader's offset
Read loader's len
Read update.img's offset
Read update.img's len
Output Loader
offset(0x0) len(0x0)
Output updata.img
offset(0x0) len(0x0)
Unpack updata.img to Temp folder
Check file...

BUT => AFTER 11 hours I cancelled the process

Then I use rkdump
But get a file size of 21581828 Byte instead of 402653184 Byte
(It looks like, it is OK, because the first 21581828 Bytes are identical ("Beyond Compare 3") and then in the img by dd... there are only HEX "FF" so it couldn't be a backup

)

with AFPTool.exe (not by wendal)

Code:

AFPTool -info wendal.img
Check file... OK
Manufacturer: RK31SDK
Machine model: rk31sdk
Kernel: Linux version 3.0.36+ (root@localhost) (gcc version 4.6.x-google 2012010
6 (prerelease) (GCC) ) #10 SMP PREEMPT Tue Jul 9 18:41:51 CST 2013
Boot: ╦$♀CÇ(├═F═┐↔ ┌á
Recovery:

So what can I do with the existing files/infos to build up a reflashable set?
Are there more information that are needing?

Greetings

**imet** · 28 October 2013, 22:38

Thanks for the guide, I have successfully backed up my other cs918,
and reflash it to another.

I have a little question, most of the available rom has parameter
file in it. It is also an option in ROM flash tool. How does one get it,
or does it need to be extracted too? When I reflash my cs918 I used
the parameter file from other firmware in the other thread.

Thanks again.

**no_spam_for_me** · 28 October 2013, 23:00

OK, how do you do it?
Please details...

And how to get the parameter I want to know too...
I have the same question: Is it always the same at our PCB or at witch does it depends???

**imet** · 28 October 2013, 23:18

Originally posted by no_spam_for_me View Post

OK, how do you do it?
Please details...

And how to get the parameter I want to know too...
I have the same question: Is it always the same at our PCB or at witch does it depends???

Well, I followed your guide, I used dd with adb.
I saved everything on a USB stick it's already mounted.
Then I used ROM flash tool, but I did not do any modification.
I just reflash it to another cs918 just to see if it works. I used the parameter file from here:

Forums - FreakTab

http://www.freaktab.com/showthread.php?7462-T-R42-custom-firmware-by-wasser

vBulletin Forums

I do not know how to get it from the device, that's what I want to know.

It is working but I'm not sure yet what might be missing.

**no_spam_for_me** · 28 October 2013, 23:48

OK
we will see... perhaps someone can teach it to us
(at the moment I've an extract by wendal tooll from the "K-R42_HFW_1.2.0_Final_1080p.rar" from lewy)

Update Post #5 and #6

PS:
Why I'm asking:
I don't understand how the "ROM_Flash_Tool_137.exe" exactly works?
I know that I need a parameter file...OK
BUT what about the values in the "Address" column?
From where do I get the right values?
Witch sequence of the lines is needed?
...

Announcement

Announcement

DUMP STOCK-ROM . & . BUILD UP FLASHABLE IMAGE

DUMP STOCK-ROM . & . BUILD UP FLASHABLE IMAGE

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

What's Going On