DUMP STOCK-ROM . & . BUILD UP FLASHABLE IMAGE

[imet]

OK
we will see... perhaps someone can teach it to us
(at the moment I've an extract by wendal tooll from the "K-R42_HFW_1.2.0_Final_1080p.rar" from lewy)

Update Post #5 and #6

PS:
Why I'm asking:
I don't understand how the "ROM_Flash_Tool_137.exe" exactly works?
I know that I need a parameter file...OK
BUT what about the values in the "Address" column?
From where do I get the right values?
...

As I understand it, the ROM flash tool that came with the firmware
of the link I posted above already has the memory addresses preset.
I'm guessing that it's in the *.ini or *.cfg file in the directory.
I'm also guessing that since they are all base on RK3188 that
the memory addresses are the same for all devices.

P.S. too
Who ever made the ROM flash tool must have an access to the datasheet,
where those address could be found. Or they could be really smart and did it the hard way

[no_spam_for_me]

Yes, they are in the "config.cfg"...

I'm also guessing that since they are all base on RK3188 that
the memory addresses are the same for all devices.

I think so too, but only think so

[no_spam_for_me]

Yesterday I found the successor to "RK29xxImageTools_v2.1" by wendal...
But have trouble to run it...
It's "RK3xxx Firmware Tools" by SergioPoverony
You can find it here at this board, that's the actual download link and that's the reason why I have trouble

[imet]

Yesterday I found the successor to "RK29xxImageTools_v2.1" by wendal...
But have trouble to run it...
It's "RK3xxx Firmware Tools" by SergioPoverony
You can find it here at this board, that's the actual download link and that's the reason why I have trouble

I've tried that tool it's very good to extract and rebuild images.
Sometime if it gives you error check the filename, I think there is a limit for length,
or some characters are not allowed, I can't remember right now.
Downside once I extract, I have no idea what to do, I'm pretty new with this tv sticks and box thing.
I'm able to rebuild and reflash, I just did not change anything. Basically just learning to use the tool.

[no_spam_for_me]

Catch your device specific parameter file

via adb shell:
root@android:/ # cat /proc/cmdline

[SIZE=2][FONT=courier new]console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00130
000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00008000@0x00004000(kernel
),0x00008000@0x0000C000(boot),0x00008000@0x00014000(recovery),0x000C0000@0x0001C
000(backup),0x00040000@0x000DC000(cache),0x00400000@0x0011C000(userdata),0x00002
000@0x0051C000(kpanic),0x00100000@0x0051E000(system),-@0x0063E000(user) bootver=
2013-05-18#1.20 firmware_ver=4.1.1[/FONT][/SIZE]

But this is only a part of the needing/possible information, so you have to use rkflashtool

There exists a windows version too of rkflashtool
But don't work for me because of "rkflashtool: fatal: cannot open device" ...


Under Windows
- download the archiv from XDA (v2)
- extract the rkflashtool.c
- use notepad++ to open the rkflashtool.c
For RK3188 Insert at line 132

                             if (!(h = libusb_open_device_with_vid_pid(c, 0x2207, 0x310b)))

save
- copy to usb-stick or so on


Under Ubuntu (VMware)
- copy rkflashtool.c to home dir
- open terminal
ich@ubuntu:~$ sudo apt-get install libusb-1.0-0-dev
ich@ubuntu:~$ gcc -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall -s
Start device in bootloader mode*/**
ich@ubuntu:~$ lsusb

 :
 Bus 001 Device 003: ID 2207:310b
 :

ich@ubuntu:~$ sudo su
root@ubuntu:/home/ich# ./rkflashtool r 0x0000 0x2000 >parm
root@ubuntu:/home/ich# exit
ich@ubuntu:~$
(0x2000 is more than enough)
- copy parm file to usb-stick or so on

*bootloader mode, bootloader(currently made by rockchip only) is loaded
from flash or USB, it should be possible to read/write RAM, NAND and
IDB(bootloader) via USB. rkflashtool can read/write NAND and can read
RAM/IDB for now.
** start to bootloader mode:
1. unplug all cables from device.
2. plug micro usb otg cable into device and into pc (nothing else)
3. press and hold little restore button (on which is under device)
4. plug in power cord (remember to still hold restore button) and wait a moment and you are in


Back to Windows
- use notepad++ to open the parm file
- copy this part at the beginning of the parm file to a new file naming parameter

FIRMWARE_VER:4.1.1
MACHINE_MODEL:rk31sdk
MACHINE_ID:007
MANUFACTURER:RK31SDK
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 3066
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
#RECOVER_KEY: 1,1,0,20,0
CMDLINE:console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00008000@0x00004000(kernel),0x00008000@0x0000C000(boot),0x00008000@0x00014000(recovery),0x000C0000@0x0001C000(backup),0x00040000@0x000DC000(cache),0x00400000@0x0011C000(userdata),0x00002000@0x0051C000(kpanic),0x00100000@0x0051E000(system),-@0x0063E000(user)

BTW:
adb at ubuntu
ich@ubuntu:~$ sudo apt-get install android-tools-adb
ich@ubuntu:~$ sudo su
root@ubuntu:/home/ich# cat > /etc/udev/rules.d/51-android.rules
udev - dynamic device management
(INPUT via copy & paste or keyboard)

SUBSYSTEM=="usb", ATTR{idVendor}=="2207", MODE="0666", GROUP="plugdev"

[ONLY 1 x return]
[ctrl] + [c]
root@ubuntu:/home/ich# cat /etc/udev/rules.d/51-android.rules (only to/for compare)
root@ubuntu:/home/ich# exit
ich@ubuntu:~$ mkdir ~/.android
ich@ubuntu:~$ cat > ~/.android/adb_usb.ini
(INPUT via copy & paste or keyboard)

0x2207

[ONLY 1 x return]
[ctrl] + [c]
ich@ubuntu:~$ cat ~/.android/adb_usb.ini (only to/for compare)
ich@ubuntu:~$ sudo udevadm control --reload-rules
=> disconnect/connect device <=
ich@ubuntu:~$ adb devices

List of devices attached 
0123456789ABCDEF    device

[no_spam_for_me]

V) BUILD UP FLASHABLE IMAGE

UNDER CONSTRUCTION

WinHex or any other Hex-Editor who can work with large files
Rk29xx ImageTools V2.1 by wendal (I download it here at 4. (it's without "su" and "Superuser.apk"))
(Alternatively you can use RK3xxx Firmware Tools by SergioPoverony)

First check the "dd.out/backup.img" with a HexEditor to determine whether there is information in it (first 4 characters "RKAF") or only zeros (HEX "FF") what means it is empty...

If there is this information in it, you will perhaps* have the complete ROM in it, which will include the loader and parameter files and you can use "wendal tools" to extract it...
1. Put the "backup.img" into the wendal tools directory and rename it to "wendal.img"
2. Start the "Runme.bat",
2a. Select 1 + return
2b. then any key
2c. and then you have to wait
Output

[FONT=courier new]D:\RK3066_IMG_Mod_Tool>lua rk29xx_rom_tools_tnt.lua
RK29xx Image Pack/Unpack Tools
Blog http://wendal.net
Project: https://github.com/wendal/teclast_tools
feedback: [email protected]
Pls input: 1-Unpack 2-Pack 3-Exit
1
Pls copy Image file into this folder,and rename to wendal.img
Notify any errors!
Drücken Sie eine beliebige Taste . . .
Reading file header...
File header: RKFWf
Read loader's offset
Read loader's len
Read update.img's offset
Read update.img's len
Output Loader
offset(0x66) len(0x2F8AE)
Output updata.img
offset(0x2F914) len(0x1973A804)
Unpack updata.img to Temp folder
Check file... OK
------- UNPACK ------
package-file    0x00000800      0x00000241
RK3188Loader(L)_V1.20.bin       0x00001000      0x0002F96E
parameter       0x00031000      0x00000266
Image/misc.img  0x00031800      0x0000C000
Image/kernel.img        0x0003D800      0x00846034
Image/boot.img  0x00884000      0x000FE6F1
Image/recovery.img      0x00982800      0x00B18000
Image/system.img        0x0149A800      0x16E09800
backupimage/backup.img  0x182A4000      0x01495004
update-script   0x19739800      0x000003A5
recover-script  0x1973A000      0x0000010A
Unpack firmware OK!
------ OK ------
Unpack -- All Done
Pls input: 1-Unpack 2-Pack 3-Exit[/FONT]

*In my case it don't seems so (the dump with rkdump it's to small and the rest in the "dd.out/backup.img" is HEX "FF") so the showing output is an example using a flashable img for "RKBatchTool.exe"...

After that, you can find the extracted images, parameter, bootloader... in the folder "Temp".

Be aware: use it on your own risk!

With these both tools your are able too to pack a flashable image witch can flash with the RKBatchTool witch you can find at Tronsmart or for example at K-R42 Hybrid Firmware by lewy20041

-------------------------------------------------------------------------------------


The second way to flash using Windows is the RKAndroidTool witch you can find at FreakTab Downloads by Legitsu or at geekbuying or for example at K-R42 Firmware by wasser.

I prefer the RKAndroidTool because I'm able to flash separate parts.

To use it, you need at minimum the bootloader (RK3188Loader(L)_V1.2x.bin), (the parameter file) and 1 image file (misc, boot, kernel or...) that you want to flash.

The first column is for selecting/activating what you want to use to flash.
The second column called "Address" contains the value depends of the parameter file.
The third column called "Name" contains the value depends of the parameter file.
And the last column called "Path" contains the whole filename.
These whole settings can be save or load by using right mouse button at one of the rows, and add new rows also...

First row have to contains the bootloader (RK3188Loader(L)_V1.2x.bin) at address 0x00000000 with Name=Loader . Don't ask me why, I couldn't get an answer, but it seems it is a must to have (Perhaps after "EraseIDB" (nand) for temporary use in ram??? Because the parameter file have the same address as the bootloader, but I've also seen a picture at the internet where the bootloader hasn't any address???)
BTW: For my stock-rom I use "RK3188Loader(L)_V1.20.bin" because of the output of the "cat /proc/cmdline".

The next row should have the parameter file at address 0x00000000.

For each other image ("partition" like kernel and so on) you want to flash, you can find the address in the parameter file at CMDLINE:

CMDLINE:console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 [B]mtdparts[/B]=rk29xxnand:0x00002000@[B]0x00002000(misc)[/B],0x00008000@[B]0x00004000(kernel)[/B],0x00008000@[B]0x0000C000(boot)[/B],0x00008000@[B]0x00014000(recovery)[/B],0x000C0000@[B]0x0001C000(backup)[/B],0x00040000@0x000DC000(cache),0x00400000@0x0011C000(userdata),0x00002000@0x0051C000(kpanic),0x00100000@[B]0x0051E000(system)[/B],-@0x0063E000(user)

Where the @0x.... the 0x... means the value for the "Address" column and the (...) means the value for the "Name" column.
For example:
0x00008000@0x00004000(kernel)
Address: 0x00004000
Name: kernel
Don't forget to activate it in first column and to enter the whole filename...

If you have build up each row / the complete configuration, save it and you have to connect the device via the OTG-USB-port with your computer and power the device up while pressing the recovery button.
If you don't have installed the Windows-Driver until jet, you can find it in the download from Legitsu or download it at Tronsmart or geekbuying and install it.

If you are ok with the driver you can see at the RKAndroidTool the following message: "Found RKAndroid Loader" or "Found RKAndroid Loader Rock Usb" (depends on witch version do you use/download).

Now you are ready to flash your device.

If you flash all needing images/partitions (parameter, misc, kernel, boot, recovery, backup and system) and/or changing to another rom, first you have to do an "EraseIDB" (nand).
If you for example only flash the kernel DON'T DO SO.
You have to watch the erase process because it MUST count up to 2048 (if don't do so, retry it).
If you get
ERROR:Lower format failed
ERROR:Erasing IDB failed
try to deinstall / install driver, administrator, try another cable, USB-port, PC...
(I have this problem and fixed it, but can't say with witch of these steps. I deinstall / install driver, administrator and try another cable, and suddenly it works...)

Run / Flash ROM
If you get
ERROR:Test device failed
ERROR:Run failed
try it more than once and/or try to deselect the bootloader (Loader)...

As a benefit I attaches a "quick and dirty" translation of the RKAndroidTool "manual"

[no_spam_for_me]

That's, unter Linux, a very comfortable solution instead of my

http://www.freaktab.com/showthread.php?9118-Help-Identifying-t-r42-device&p=124546&viewfull=1#post124546

[bluesmanuk]

Fantastic thread no_spam_for_me and so very useful.

Thanks for all the time and effort you have put into it.

[hackadroid]

Excellent guide, thanks so much

I managed to dump all the required files and build up a working image that I flashed to another box

I didn't know how to get a parameter file so used the following image tool to extract the latest firmware release. Once extracted, I replaced all the .img files with the files from dd.out, rebuilt it (parameter file was included) and flashed that update file

The menu driven utility runs on Ubuntu Linux

Forum link

Download link

There are a number of executables called from the script so make sure to set 755 permissions before trying to extract or repack an update

[no_spam_for_me]

Rockchip AndroidTool 2.1

The latest and easiest way to dump can found her Rockchip AndroidTool 2.1
and use this howto by Finless (because of parameter file)

[whocares]

The latest and easiest way to dump can found her Rockchip AndroidTool 2.1
and use this howto by Finless (because of parameter file)

@no_spam_for_me

Can You Upload A Sample "parameter file",
I Want To Know How The File Looks Like...

[no_spam_for_me]

For example from K-R42 wasser 1.2.1

FIRMWARE_VER:4.1.1
MACHINE_MODEL:rk30sdk
MACHINE_ID:007
MANUFACTURER:RK30SDK
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 3066
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
#RECOVER_KEY: 1,1,0,20,0
CMDLINE:console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00008000@0x00004000(kernel),0x00008000@0x00012000(boot),0x00010000@0x00020000(recovery),0x00020000@0x00030000(backup),0x00040000@0x00050000(cache),0x00800000@0x00090000(userdata),0x00002000@0x00890000(kpanic),0x00130000@0x00892000(system),-@0x009c5000(user)

For example from my K-R42 stock rom

FIRMWARE_VER:4.1.1
MACHINE_MODEL:rk31sdk
MACHINE_ID:007
MANUFACTURER:RK31SDK
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 3066
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
#RECOVER_KEY: 1,1,0,20,0
CMDLINE:console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00008000@0x00004000(kernel),0x00008000@0x0000C000(boot),0x00008000@0x00014000(recovery),0x000C0000@0x0001C000(backup),0x00040000@0x000DC000(cache),0x00400000@0x0011C000(userdata),0x00002000@0x0051C000(kpanic),0x00100000@0x0051E000(system),-@0x0063E000(user)

If you dump at 0x0000 start, at my stock rom, it begins with not needing

PARMZ[STX][NUL][NUL]

You need the information till including

(user)

[whocares]

@no_spam_for_me

Thanks For Helping Me Out...

I Don't Get It If You Only Need This.

FIRMWARE_VER:4.1.1
Till
(user)

Why You Say On Post #20

- use notepad++ to open the parm file
- copy this part at the beginning of the parm file to a new file naming parameter

Because I See All Already On Pram File.
Why You Need To Copy To It,,

I Read My Box's Code From 0x00000 to 0x00200 using "Rockchip AndroidTool 2.1"
Here It Is

PARMY㄀㄀FIRMWARE_VER:4.1.1
MACHINE_MODEL:rk31sdk
MACHINE_ID:007
MANUFACTURER:RK30SDK
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 3066
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
#RECOVER_KEY: 1,1,0,20,0
CMDLINE:console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00008000@0x00004000(kernel),0x00008000@0x0000C000(boot),0x000C000@0x00014000(recovery),0x00140000@0x00020000(backup),0x00040000@0x00160000(cache),0x00400000@0x001a0000(userdata),0x00002000@0x005a0000(kpanic),0x00140000@0x005a2000(system),-@0x006e2000(user)
ê㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀㄀-------
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ------"This Goes On"

I Have Attached It To This Post..


So For Me I Have To Use This Parameter File...

FIRMWARE_VER:4.1.1
MACHINE_MODEL:rk31sdk
MACHINE_ID:007
MANUFACTURER:RK30SDK
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 3066
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
#RECOVER_KEY: 1,1,0,20,0
CMDLINE:console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00008000@0x00004000(kernel),0x00008000@0x0000C000(boot),0x000C000@0x00014000(recovery),0x00140000@0x00020000(backup),0x00040000@0x00160000(cache),0x00400000@0x001a0000(userdata),0x00002000@0x005a0000(kpanic),0x00140000@0x005a2000(system),-@0x006e2000(user)

Now I Need To Know Is

1, How To Reflash The Box Using The Files From "dd.out" Folder With This Parameter File
2, How To Make A Flashable Image.

[no_spam_for_me]

Why You Say On Post #20

- use notepad++ to open the parm file
- copy this part at the beginning of the parm file to a new file naming parameter

....

Now I Need To Know Is

1, How To Reflash The Box Using The Files From "dd.out" Folder With This Parameter File
2, How To Make A Flashable Image.

1. use notepad++ because of the possibility the visualizes the "special characters" instead of for example normal notepad of winword or so on... If you have another editor it works, use it...

2. have a look at #21...
"The next row should have the parameter file at address 0x00000000."
the next rows depends on the rest you have and want to flash depending on your CMDLINE in the using parameter file...

[whocares]

@no_spam_for_me


I have attached the parameter file can you check and make changes to it.
and upload here.

you didn't answer to the last 2 questions.

I am tottaly new to android.


1, How To Reflash The Box Using The Files From "dd.out" Folder With This Parameter File
2, How To Make A Flashable Image.