[Discussion] Extracting/modifying script.bin - Allwinner A20/A23/A30/A31 tablets - Upgrading, Modifying and Unlocking

Hello folks,
Been hacking firmwares for Allwinner SOC-based tablets for a while. The key to "porting" firmwares bertween similar tablets used to be the script.bin / script0.bin files found in the bootloader (nanda) FAT partition.
However since Kitkat things have changed and these files are no more. The data still is somewhere though, and probably in the same format.
When a stock flashable image is available, imgRePacker or DragonFace allows for extracting the binary (config.fex) file and corresponding source (sys_config.fex). However I'm wondering how to get this from a tablet for which no such Livesuit/Phonenixsuit image is available.
After many hours of hacking, I've eventually found a way to extract it from a live, booted (and rooted) tablet because the data is mapped into the SOC's virtual address space (details will come in a later post if there's interest).
I have yet to find a way to dump it from the tablet's NAND flash memory. AFAIK this data is *not* in a section of the NAND flash memory that's accessible through the /dev/block/nandX partition devices.
I've made some progress by using the Phoenixcard tool and make it generate a bootable SD card with a full Android firmware aboard (as opposed to the minimal system used for an upgrade). The binary "script.bin" data can be found in a section of the SD card formatted in what looks like a proprietary, very rudimentary filesystem (well, more like subpartitions with a name really). Reverse-engineeering this doesn't look very difficult, it's basically a table of contents with a name and a logical block number. However I have found no way yet to reach this area of the tablet's internal NAND flash memory.
Not sure that studying the publicly released A23 SDK v1.0 code will lead to a solution because AFAIK it seems to be for Jellybean (4.2) firmwares, which still used the old script.bin in bootloader partition scheme.
I've spent much time Googling for this and haven't found any public information on this, so I'm opening this thread with the hope that it will catch the right people's eyes.

just picked up a generic a83 tablet and i'm anticipating this sort of thing. my hardware info is at your disposal. i'll be digging in myself in the next few days to dump the nand and see what i can and can't to with the stock rom.
cpuinfo is reporting sun8i, i thought the a83 was sun9i, so i need to clarify that. stock rom is KK 4.4.4 no su. let me know if you want to collaborate.

Maybe not perfect but the fastest way is use /sys/class/script/dump, you only need to know the section names
Code:
[email protected]:/sys/class/script # echo lcd0_para > dump
echo lcd0_para > dump
[email protected]:/sys/class/script # cat dump
cat dump
++++++++++++++++++++++++++__sysfs_dump_mainkey++++++++++++++++++++++++++
name: lcd0_para
sub_key: name type value
lcd_bl_en gpio (gpio: 25, mul: 1, pull 0, drv -1, data 1)
lcd_power gpio (gpio: 204, mul: 1, pull 0, drv -1, data 1)
lcd_pwm gpio (gpio: 161, mul: 2, pull 0, drv 2, data 1)
lcd_gpio_0 gpio (gpio: 158, mul: 1, pull 0, drv 2, data 1)
lcd_gpio_1 gpio (gpio: 159, mul: 1, pull 0, drv 2, data 1)
lcd_gpio_2 gpio (gpio: 23, mul: 1, pull 0, drv 2, data 0)
lcd_gpio_3 gpio (gpio: 157, mul: 1, pull 0, drv 2, data 1)
lcd_gpio_4 gpio (gpio: 26, mul: 1, pull 0, drv 2, data 1)
lcdd2 gpio (gpio: 72, mul: 2, pull 0, drv 2, data -1)
lcdd3 gpio (gpio: 73, mul: 2, pull 0, drv 2, data -1)
lcdd4 gpio (gpio: 74, mul: 2, pull 0, drv 2, data -1)
lcdd5 gpio (gpio: 75, mul: 2, pull 0, drv 2, data -1)
lcdd6 gpio (gpio: 76, mul: 2, pull 0, drv 2, data -1)
lcdd7 gpio (gpio: 77, mul: 2, pull 0, drv 2, data -1)
lcdd10 gpio (gpio: 80, mul: 2, pull 0, drv 2, data -1)
lcdd11 gpio (gpio: 81, mul: 2, pull 0, drv 2, data -1)
lcdd12 gpio (gpio: 82, mul: 2, pull 0, drv 2, data -1)
lcdd13 gpio (gpio: 83, mul: 2, pull 0, drv 2, data -1)
lcdd14 gpio (gpio: 84, mul: 2, pull 0, drv 2, data -1)
lcdd15 gpio (gpio: 85, mul: 2, pull 0, drv 2, data -1)
lcdd18 gpio (gpio: 88, mul: 2, pull 0, drv 2, data -1)
lcdd19 gpio (gpio: 89, mul: 2, pull 0, drv 2, data -1)
lcdd20 gpio (gpio: 90, mul: 2, pull 0, drv 2, data -1)
lcdd21 gpio (gpio: 91, mul: 2, pull 0, drv 2, data -1)
lcdd22 gpio (gpio: 92, mul: 2, pull 0, drv 2, data -1)
lcdd23 gpio (gpio: 93, mul: 2, pull 0, drv 2, data -1)
lcdclk gpio (gpio: 94, mul: 2, pull 0, drv 3, data -1)
lcdde gpio (gpio: 95, mul: 2, pull 0, drv 2, data -1)
lcdhsync gpio (gpio: 96, mul: 2, pull 0, drv 2, data -1)
lcdvsync gpio (gpio: 97, mul: 2, pull 0, drv 2, data -1)
deu_mode int 0
lcdgamma4iep int 22
smart_color int 90
lcd_used int 1
lcd_if int 6
lcd_driver_namestring "b079xan01"
lcd_x int 768
lcd_y int 1024
lcd_width int 0
lcd_height int 0
lcd_dclk_freq int 66
lcd_pwm_freq int 50000
lcd_pwm_pol int 1
lcd_bl_0_percentint 2
lcd_bl 5_percentint 5
lcd_bl_10_percentint 15
lcd_bl_25_percentint 20
lcd_bl_50_percentint 37
lcd_bl_75_percentint 58
lcd_bl_100_percentint 73
lcd_hbp int 120
lcd_ht int 948
lcd_hspw int 64
lcd_vbp int 80
lcd_vt int 1140
lcd_vspw int 50
lcd_hv_if int 0
--------------------------__sysfs_dump_mainkey--------------------------

@lolet: thanks for the tip. I was already aware of this. It's a handy way to grab the textual contents of a particular section but there are drawbacks: you can't request too long of a section or the complete data, on my A23 tablet it causes a kernel panic. Probably an unhandled buffer overflow.
I've found another way to get the full, binary (compiled) data by running the following script on the tablet:
Code:
#!/system/bin/sh
SYS_CONFIG_MEMBASE="0x43000000"
SYS_CONFIG_MEMSIZE="0x10000"
CHUNK="0x200"
OUTFILE=/mnt/sdcard/sysconfig_dump.txt
rm $OUTFILE
let address=$SYS_CONFIG_MEMBASE
let "end=(SYS_CONFIG_MEMBASE+SYS_CONFIG_MEMSIZE)"
while [ $address -lt $end ]; do
let "last=(address+CHUNK-1)"
busybox printf "%04x,%04x\n" $address $last
busybox printf "%04x,%04x\n" $address $last > /sys/class/sunxi_dump/dump
cat /sys/class/sunxi_dump/dump >> $OUTFILE
let "address=(address+CHUNK)"
done
This produces a file going like:
Code:
0x43000000: 0x00000045 0x00000000 0x00000001 0x00000002
The next Perl script will put back the data in the correct byte order and convert it to raw binary data:
Code:
#!/usr/bin/perl
while(<>) {
chomp;
@words = split;
shift @words;
foreach $w (@words) {
$w =~ s/^0x//;
$w = reverse(pack('H*', $w));
print $w;
}
}
(reads hex dump on stdin, produces binary data on stdout)
The resultant binary file has passed the "fexc -I bin -O fex binfile fexfile" test successfully and checking a sample of sections against the data returned by the method you have mentioned has shown the data as consistent.
However, neither of this provides an answer to my main question: where is the bloody data in the NAND flash of the tablet when it's no longer in the script.bin/script0.bin files from the bootloader partition?

lanning: is uboot even using script.bin? I've just started poking around, and the uboot output over serial during startup includes this peculiar line:
Code:
mount part name bootloader
cant open script.bin, maybe it is not exist
looks like maybe my tablet is asking your question too...?

@jawbonegroove: well, I haven't got as far as hooking a serial interface to my Allwinner tablets yet, because I need to buy a converter first. It's in my todo list.
So I haven't seen this message.
I presume that uboot does use sysconfig data, but it might be able to get it from the legacy location (script.bin file in bootloader FAT partition) and the new one (somewhere well hidden on the NAND flash). Not finding it in the legacy location might cause this message to be sent out, don't know.
What I know for sure is that the kernel does find and use sysconfig data, wherever it is, because it's mapped to the kernel VM and kernel modules use this data to configure themselves.
And by the way, it's "Lannig", no "n" before the "g", thanks

lanniG: (sorry) I also haven't done much with serial yet, mainly just logged a normal boot. It does also show this nand layout...
Code:
--------fastboot partitions--------
-total partitions:10-
-name- -start- -size-
bootloader : 1000000 1000000
env : 2000000 1000000
boot : 3000000 1000000
system : 4000000 30000000
misc : 34000000 1000000
recovery : 35000000 2000000
cache : 37000000 30000000
metadata : 67000000 1000000
private : 68000000 1000000
UDISK : 69000000 0
-----------------------------------

@jawbonegroove (now I'm trying not to misspell it ): you said you got this chinglish message "cant open script.bin, maybe it is not exist". From what log did you get it? It comes from u-boot, I'm fairly sure of this. The dmesg command doesn't show messages coming from that early in the boot process, only kernel messages.
The partitioning: nothing out of the usual here. These can be addressed through the /dev/block/nandX (X=a,b,...) and /dev/block/by-name/* device files.
AFAIK from my searches, the binary configuration data formely contained in script.bin is nowhere to be found in any of these partitions. So my guess is that it's outside of the NAND flash memory addressable through these devices files. Possibly in between the MBR and the nanda partition.

yeah, that was uboot over the serial console. i just used serial again to root it last night so i've got nand images to play with now. in regards to the op:
Code:
[email protected]:/ # mount -t vfat /dev/block/nanda /data/nanda
[email protected]topus-ibt:/ # cd /data/nanda/
[email protected]:/data/nanda # find .
.
./font24.sft
./bat
./bat/low_pwr.bmp
./bat/bat0.bmp
./bat/bat1.bmp
./bat/bat3.bmp
./bat/bat9.bmp
./bat/bat8.bmp
./bat/bat2.bmp
./bat/bootlogo.bmp
./bat/bat4.bmp
./bat/bempty.bmp
./bat/bat5.bmp
./bat/bat7.bmp
./bat/bat6.bmp
./bat/battery.bmp
./bat/battery_charge.bmp
./bat/low_pwr_bak.bmp
./bat/bat10.bmp
./bootlogo.bmp
./font32.sft
./magic.bin
./data.notfirstrun
i don't have a script.bin, but i've got a magic.bin. (and, it does try and boot from an sdcard partitioned for uboot. i'll probably try to put together a bootable sd image sooner than later.)
what do your nanda and kernel cmdline look like?
[edit] also, have you used meminfo?

I've had a few A23 tablets in my hands, most KK-based and one JB (4.2).
Some don't have any script0.bin/script.bin file in the bootloader partition, but a magic.bin file just as you mention. However if you open this file you'll see that it has most likely nothing to do with h/w configuration. It's just a few hex strings looking like filesystem UUIDs.
Some of them do have a script0.bin file only (no script.bin) which I'm almost sure is completely ignored (I've tried modifying it with no visible effect). Checking its contents against the config data extracted from the live tablet as explained above (kernel memory dump through the /sys interface) shows that it does not even match 100%. I suspect it's a leftover.
Besides this, bootloader partition's contents looks exactly like what you've listed.
Command line: nothing unusual:
Code:
console=ttyS0,115200 rw init=/init loglevel=4
Have you actually managed to make a fully bootable SD yet for an A23 tablet? I'm not sure I get what you wrote. If you did, please tell us more. That's something I've done in the A10 times but it was using a special version of u-boot I don't know where to find for the A23.

hm, good to know. i haven't found many resources for sunxi hardware...linux-sunxi has some good info but its scattered and they seem kind of militant about joining their cause before they'll help you...
ill keep digging.

didn't see that last sentence before. no, this a83 is my first allwinner...i say it tried to boot because when i put in an sd card with uboot mbr and friends (semi-random device fs image), it powered on but with no visible response -- it didn't just continue with a nand boot until i pulled the card and hard reset it. maybe all that tells me is that i don't need to muck about with button sequences or whatnot to boot from sd.

Oh well, no need to try this actually.
Allwinner devices do have the SD card before the internal NAND in the boot sequence. So they will try booting from the SD if they find an uboot structure there. This is true since the A10 days (and still is).

Related

How To Modify Security Level in Tornado?

Hi guys,
I'm new to the forum and not very savvy in the lingo and specifics of XDA development.
I have a Tornado smartphone and I'm trying to flash an image to it. Unfortunately the current image has a Security Level which does not allows to flash my image to the phone. This is the optput I get when connecting to the phone through USB (using mtty) in bootloader mode:
Code:
Cmd>set 32
set 32
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
rtask a
- SD Controller init
+StorageInit
CMD55 failed
g_cKeyCardSecurityLevel = FF [COLOR="Red"]<<<--- I guess this is the problem[/COLOR]
HTCE
Cmd>l gentorn.bin
l gentorn.bin
clean up the image temp buffer at 0x8C080000 Length 0x03B00000
MTTYDownloadImageNot allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
Cmd>
I've been browsing all arround the forum and finding a lot of information and tools but since I'm not very familiar with the internals of these things I have not been able to clear this flag in order to flash my image.
I'll appreciate very much if somebody here kindly helps me to achieve this.
Thanks and Best Regards
Kalep.
Bump......
No answer? Bump...
Is your phone CID and application unlocked?

Unrevoked problems with Linux x86_64 (SOLVED)

Hi all,
I was trying to root with unrEVOked 3.1 on a 64bit Ubuntu installation and hit this problem and found a solution so I thought I'd post it up here to help any other newbies like me
Problem (running from terminal)
Code:
unrEVOked recovery reflash tool
git 7bb95e5
/usr/lib/gio/modules/libgioremote-volume-monitor.so: wrong ELF class: ELFCLASS64
Failed to load module: /usr/lib/gio/modules/libgioremote-volume-monitor.so
/usr/lib/gio/modules/libgiogconf.so: wrong ELF class: ELFCLASS64
Failed to load module: /usr/lib/gio/modules/libgiogconf.so
/usr/lib/gio/modules/libgvfsdbus.so: wrong ELF class: ELFCLASS64
Failed to load module: /usr/lib/gio/modules/libgvfsdbus.so
I assume the problem is that reflash is 32 bit and my libs are 64, so install
frozenfox.freehostia.com/cappy/getlibs-all.deb
then
Code:
getlibs libgioremote-volume-monitor.so
This will install the 32 libs / gvfs and reflash is happy.
not solved for me
Unfortunately, this doesn't solve the problem for me:
Code:
[email protected]:~/Downloads$ sudo ./reflash
unrEVOked recovery reflash tool
git version: 4f78f67
/usr/lib/gio/modules/libgvfsdbus.so: wrong ELF class: ELFCLASS64
Failed to load module: /usr/lib/gio/modules/libgvfsdbus.so
ERROR: n = -1, errno = 19 (No such device)
ERROR: n = -1, errno = 19 (No such device)
ERROR: n = -1, errno = 19 (No such device)
ERROR: n = -1, errno = 19 (No such device)
This was my first attempt. unrevoked reported "done" in the end, but it didn't work. Now I followed your suggestion:
Code:
[email protected]:~/Downloads$ getlibs libgioremote-volume-monitor.so
libgioremote-volume-monitor.so: gvfs
The following i386 packages will be installed:
gvfs
Continue [Y/n]? y
Downloading ...
Installing libraries ...
[email protected]:~/Downloads$ sudo ./reflash
unrEVOked recovery reflash tool
git version: 4f78f67
/usr/lib/gio/modules/libgvfsdbus.so: wrong ELF class: ELFCLASS64
Failed to load module: /usr/lib/gio/modules/libgvfsdbus.so
ERROR: n = -1, errno = 19 (No such device)
ERROR: n = -1, errno = 19 (No such device)
ERROR: n = -1, errno = 19 (No such device)
ERROR: n = -1, errno = 19 (No such device)
Same error messages. And again it didn't work although unrevoked reported "done".
This is on Ubuntu 10.04 64bit. Any help appreciated.
Sorry, apparently it DID work. Titanium Backup was reporting a failure with root access, but that was down to a not-working BusyBox. Titanium downloaded an alternative, crashed with force close on restart but after a second restart it worked.
So potentially the first rooting without the 32bit libraries might have worked as well?
need to:
Code:
sudo apt-get install lib32ncurses5 libgtk2.0-0 ia32-libs-gtk

[Q] How to unbrick Dropad A8x?

Hello
I accidentally brick my device with firmware upgrade
First: it was Boot logo. and after that black screen. Using DNW tool i got this information
===== USB DEVICE STATUS =====
USB_CONFIGURATION_DESCRIPTOR
bLength = 0x9, decimal 9
bDescriptorType = 0x2 ( USB_CONFIGURATION_DESCRIPTOR_TYPE )
wTotalLength = 0x20, decimal 32
bNumInterfaces = 0x1, decimal 1
bConfigurationValue = 0x1, decimal 1
iConfiguration = 0x0, decimal 0
bmAttributes = 0xc0 ( ??? UNKNOWN!! )
MaxPower = 0x19, decimal 25
-----------------------------
USB_INTERFACE_DESCRIPTOR #0
bLength = 0x9
bDescriptorType = 0x4 ( USB_INTERFACE_DESCRIPTOR_TYPE )
bInterfaceNumber = 0x0
bAlternateSetting = 0x0
bNumEndpoints = 0x2
bInterfaceClass = 0xff
bInterfaceSubClass = 0x0
bInterfaceProtocol = 0x0
bInterface = 0x0
-----------------------------
USB_ENDPOINT_DESCRIPTOR for Pipe00
bLength = 0x7
bDescriptorType = 0x5 ( USB_ENDPOINT_DESCRIPTOR_TYPE )
bEndpointAddress= 0x81 ( INPUT )
bmAttributes= 0x2 ( USB_ENDPOINT_TYPE_BULK )
wMaxPacketSize= 0x200, decimal 512
bInterval = 0x0, decimal 0
-----------------------------
USB_ENDPOINT_DESCRIPTOR for Pipe01
bLength = 0x7
bDescriptorType = 0x5 ( USB_ENDPOINT_DESCRIPTOR_TYPE )
bEndpointAddress= 0x2 ( OUTPUT )
bmAttributes= 0x2 ( USB_ENDPOINT_TYPE_BULK )
wMaxPacketSize= 0x200, decimal 512
bInterval = 0x0, decimal 0
-----------------------------
Second: device in system appears as SEC S5PC110 Test B/D. and asks for driver.
I used drivers for samsung dev board.
The device build on samsung s5pc110 with 512mb nand memory
some shots of board inside.
Add some log from rs232
Rid images mywes below 0x0.
?lengthsdistance symbolsdynamic bit lengths tree{tance codent memoryINVAL
Error:Neither High_Speed esize:0x0
[s3c_usb_print_pkt:tcoov ...
?kernel entry point!
rom environment
o current device
(null)
(s)
not valid on device 26476424 **
ize(0x0)
_J?Under 128M
ME u¬??t erase FAT region~~!!!
ormat complete.
qoe>img4 buffer~~!!
uffer~~!!
er?~a???*I?for jounaling : 0
dr : 0x0
Descriptor Table(0)~~~!!!
?t<erase inode table(0)~~~!!!
Can't write rootdata~~~!!!
't write 7th inode~~~!!!
ta~?youg to mount ext2 filesystem...
(indir 1) malloc failed. **
1) failed. **
fsyz?U2gs read block (indir 2 2) malloc failed. **
2) failed. **
fs doesn't support tripple indirecv8au?9?zYXzONI?‘•?partition sector 0
alid Block Device Descriptor (NULL)
**
(e8rc8?{yZev: (null)
s Firm: (null) Ser#: ”y“libuP^?Oy“o7wP^?j{?v
s available
movable i?ion Map for UNKNOWN Partition Type: (null)
own partition table
partition table on 0:ad .5µt 0 26476424 1835e50s
rtition Start Sector Num Sectors Type
- list files from 'dev' on 'interface' in a 'direaooy[filename] [bytes]
- load binary file 'filename' from 'dev' on 'interface'
to address 'addr' from ext2 filesystem
o–‹?address not on sector boundary
precedes start sector
r boundary
sN…EN?and/or end address not on sector boundary
or: end address (0xx) not in flash!
tect Flash Bank # 0
Bad sectoo?|EN•‘) type
address format
0 sectors
Bank # 0
ash Sectors 0-0 in e?on for all FLASH memory banks
flinfo N
- print information for FLASH memory bank # N
ase - erase FLASH memory
|–?'start' to the end of sect w/addr 'start'+'len'-1
erase N:SF[-SL]
- erase sectors SF-SL in FLASH bank # N
erase bank N
?yuaFLASH write protection
tart end
- protect FLASH from addr 'start' to addr 'end'
protect on start +len
- protect FLqO?,?KI?SF-SL in FLASH bank # N
protect on bank N
- protect FLASH bank # N
protect on all
- protect all FLASH banks
proteaoyi> - make FLASH from addr 'start' to end of sect w/addr 'start'+'len'-1 wrtable
protect off N:SF[-SL]
- make sectors SF-SL wreuajj…*•?all FLASH banks writable
s'
-lt=?®EOµA•UMNEO?N?returning error when dumping path: , (null)
0 times to (null)...
wSUI?...
to 0x00000000 at 0 bps...
for binary (kermit) download to 0x00000000 auya0vo 0 bps and press ESC ...
ad Addr = 0x00000000
## Last Load Addr = 0x00000000
## Total Size = 0x00000000 = 0 BytesSi?0S-Record file over serial line
- load S-Record file over serial line with offset 'off'
adb - load binary ??offset 'off' and baudrate 'baud'
- load binary file over serial line (ymodem mode)
Address: 0x00000000
:?O?‘?00000000, expected 00000000
???
word at 0x00000000 (0x00000000) != word at 0x00000000 (0x00000000)
alfwordayA•02x)
ordwere the same
0000y
[# of oa?y{j•µ?Ea?modify, auto increment address
m(constant address)
ddress
- memory modify, readaory
opy
e target count
- copy memory
cmpre
addr2 co~CRC32 checksum [save at addr]
set address offset
- print address offset for memory commands
base offi??ue
.w, .l] address number_of_objects
- loop on a set of addresses
mtestRAM test
tart [end [pattern]_]yagxecution for N seconds (N is _decimal_ !!!)
turer ID: 0
cSpeed: tZ<0-bit
C read: dev # 0, block # 0, count 0 ...: (null)
write: dev # 0, blyuw,saIN•µread <device num> addr blk# cnt
mmc write <device num> addr blk# cnt
mmc rescan <device num>
mmc list - list available davoENyesoot of image at addr 0x00000000 ...
- boot image via network using BootP/TFTP protocol
stIPaddr:]bootfilename]
ootRP/TFTP protocol
dhcp - invoke DHCP clientato ob|O8=}IEUMQ?to network host
Saving Environment to (null)...
or: illegal character '=' in variable name "(null)"
uuI?not supported
tenvonment size: 0/0 bytes
onment variables
- print8?…µ•?
t environment variables
e ...
- set environment variable 'name' to 'value ...'
setenv name
- ay|?K…?•)vironment variable
- run the commands in the environment variable(s) 'var'o8oot a block start address
th is not block aligned
write (0 blocks):
ad blocks 0 at 0x0 is skipped.e80x0, 0
---ofs=0x0,len=0x0,retlen=0x0,addr=0x0,oob=0x0
(0 blocks):
k8(0) reading page 00000000
:
00 00 00 00 04 00 2x 00 00 00 00 00
zess
ffs2 write:
ata -- 0%.0x0, 0vice 0 bad blocks:
0000 at 0x00000000
ND (null): Q®I•?failed 0x0, 0
iled 0x0, 0
rite test failed at 0xx
b: (null)
—?…?‘OneNAND sub-systemable OneNAND devices
onenand bad - show bad blocks
onenand read[.oob] addr off size
oneny?uy?Ea?address 'addr', skipping bad blocks.
onenand write.yaffs addr off size - read/write `size' bytes starting
at offset `off'?uytest [off size] - test 'size' bytes from
offset 'off' (entire device if not specified)
onenand dump[.oob] off - dump page
onena?oEµ…N???)to transmit data
nw - initialize USB device and ready to receive for Windows server (speaigy?A•?for (null) command
art
for imxtract
tractt a part of a multi-image
qble.
known command '(null)' - try 'help' without arguments for list of all known commands
ynewline
like /bin/sh
]
- test functionality
t script
§help' prints online help for the monitor commands.
Without arguments, it prints a short usage message for all commands.
To get guys as arguments.
- alias for 'help'
devices available!
utput devices available!
_env---default_environment=0x0,ENV_SIZE=0x0
ror - default environment is too large
arning - bad CRC, using defaultui/Flash
t and/or end address not on sector boundary
Unknown Vendor of Flash
pe of Flash
E)t allocated
There is a global environment variable with the same name.
I?µ?main input shell.
iftil) reached
ERROR, too many US~ F?U?E?AN?E± error 0
config descriptor too short (expected 0, got 0)
t reset port 0!?
USB device not responding, gi?Wk•?descriptor (error=0)
device descriptor short read (expected 0, got 0)
d to set default configuration len 0, staooyel part
Unknown errorCd(SOH)/0(STX)/0(CAN) packets, 0 retries
ock sequence error/checksu}??II?file1 .. 0, ld x 0x0ld loader.. 0, 0 ernel..>7y?mmc r/w sub system for SMDK board
Initialize moviNAND and show card info
movi read {u-boot | kernel} {addr} - Read data0g?‘‘Eo?[bytes(hex)] - Read rootfs data from sd/mmc by size
movi write rootfs {addr} [bytes(hex)] - Write rootfs data to sd/mmc by sia {sector#} {bytes(hex)} {addr} - instead of this, you can use "mmc write"
for Android image downloading.
8cyte) installation.
tem image installation.
d system image(0 byte) installation.
ge instalua?±•N•‘?kernel image (0 byte) installation.
installation.
ed uboot image (0 byte) installation.
vor Android
insdroid zimage - Install zimage image for Android
insdroid ramdisk - Install ramdisk image for Android
insdroid syu?eE??write u-boot {address} - Make bootable SD card with uboot
Partition table on OneNAND]
-…™™IWarning can not do hw and sw ecc for partition '(null)'
ng these flags
boot: Adding partitions from envy?Error:FASTBOOT no partition name for '(null)'
Error:FASTBOOT no closing on name
ror:FASTBOOT partitii?Y[±?a?default partition information
rtition informations!dding: (null), offset 0x8x, size 0x00000000, flags 0x00000000
•?N•‘)ted
ables setading of 0 bytes finished
load buffer
yN????does not exist
rtition '(null)' erased
ownloadad of 0 bytes
y?•±?.
mage..
ng failed
eset the board
alid boot image?…ENaN???partition '(null)' flashed
'(null)' failed : (null)
'(null)' saveenv-ed
NFOunknown OEM comma?rytes read
sing Image from SD Card.]
ill read images from the followy???A?oot- use USB Fastboot protocol
out]
- Run as a fastboot usb device.
?oy?!sdfuse - read images from FAT partition of SD card and write them to booting device.
- print0yz0 erase userdata, cache, and reboot.
sdfuse flash <partition> [ <filename> ] - write a file to>yy"•U??•?is NOT founded.
device's initialization is failed.
block start # block count paoti|*A"? 0x00
0 0 0x00
0 0 0*yysd/mmc.
e_num> - create partition.
fdisk -p <device_num> - print partition information
- using default u~yE«99?..
riables
bootable device data
oyyIThe input address don't need a virtual-to-physical translation : 00000000
DKC110
dowi syo?aON?down system now!
s 0!
!
s 1 already!
{KKKVE‹}µµ?}‘•U??•?error!
le to use mmc 0 for fatload **
-------------Download_addr--=0xi–‘…N…?image Error!
nd!
ea00000 0ge installation.
aDya‚‚‚?
A0000 write.yaffs2 40000000 e00000 6a00000age installation.
imgonenand write 30008000 b00000 300000k image installation.
nload kernel image Error!
ernel imq000l image installation.
logo.binnload logo image Error!
yo’‚‚‚‚‚onenand write 30008000 80000 200000.
d.bin‚A‚‚‚‚Completed uboot image installation.
update software!
d!
a|e Android zImage images Fail!
id Ramdisk images Fail!
droid System images Fail!
Android userdata imayyy‹?Uboot images Fail!
mages Fail!
images Fail!
;########################################
Completed Write Android all images From SD to Onenand!
ndroid images include:uboot/zim??0123456789abcdefghijklmnopqrstuvwxyz?literal/length code enderrorry?}IO‰µ?N}©?‰e ENOMEM
Full_SpYuZ«‘?
0, Download Filesize:0x0
sb_print_pkt:able Connected!
a OTG cauynjJ?N??fastboot ...
SId Fastbootbytes: (null)
ate_success--shut doy+E‹…
ironment
AT32 nt device
Interface: y=Invalid FAT entry
(null) file(s), 0 dir(s)
get_dentfromdir: (null)
atname: |(null)|
== NULLu=t>valid on device 0 **
on0: Start Address(0xx), Size(0x0)
is broken **
r~~!!
?•E?256M
16G~
NO NAME ite PBR~~~!!!
ke img buffer~~(reserved)!!
ggion~~!!!
ite FAT~~~!!!
n0 format complete.
* Partition0 is not ext2 file-system 0 **
mg2 buf?y?y?
make zero buffer~~!!
an't make img5 buffer~~!!
ake rootdata buffer~~!!
buffer~~!!
aling : 0
te addr : 0x0
lock(0)~~~!!!
ptor Table(d)~~~!!!
an't write reserve.~oe(0)~~~!!!
ta~~~!!!
an't write root+1~~~!!!
te 7th inode~~~!!!
't write 8th inode~~~!!!
A:?±•IaIN•µ?..
lock (indir 1) malloc failed. **
ead block (indir 1) failed. **
ext2fs read block*(?indir 2 2) malloc failed. **
d block (indir 2 2) failed. **
ext2fs doesn't support tripple indirect blocks. **
ay|ition sector 0
* Invalid Block Device Descriptor (NULL)
ext2fs_devread() read error **
* ext2fs_devread() read error8E> (null) Firm: (null) Ser#: s
Type: evice# 00 # Capacity:<y|yNition Type: (null)
?T?NA?9a&g§?`?IGyiy?y?Io?yyy??a::‚Aba? r4 : 00000000
?|VE«n?instruction
y??}?’?I2ay?*AIaI?= 0MHz, PclkPsys = ‹5!e
?yu?…?‘?erase ea00000 1160000onenanaa~oyyada/¬??•yaffs_unlink returning error:ay??yY.EEEEEEEEE *")nPageReads........... 0unAiiyyyycyceaTrying to add an object to a null pointY>u??aoa?N?valids_guts.h 0
?you•?N?values pagesInUse 0 counted chunk bits 0
?o}Yyr mismtch parentId 0 obj->parent is NULL
y??‡~ou•?0 0 0
?y?,uk*I)|oIbn 0 has chunkId 0 (null) (null)
?ea??W?I?(0:0)
yyy«N§???invalid chunk 0
x?aa!
±±??…N?E?out !!!!!!!!!!!!!!!!!
y—Y?I…ffs_FindObjectByName: non-directory
oyy<{*| obj addr 0
d
nyyauo ON?data chunk into a non-file
y: exis|uuoyuz?E??*?0,
that has no chunksau?yyyawN•?0 after gc, should be erased
yy?ya)yYx?point device
y=;E‹?checksum |
heckpointed 0
y+iEe?or wrong
~?cw|d not allocate block index!
yxy?from 0 0
rit|en block 0 being set for iyy???ound.
rds ends
yycuyyaffs: yaffs_GutsInitialise() done.
a??e yaffs_nand.c 0
?y±?nate
ext checkpt block: start: blocks 0 next au??yx…?±?0 next 0
ut of c??yy?yµt|i–i±v 1.19 2007/02/14 01:09:06 wookey Exp $y?x?*]ithTagsToNAND chunk 0 data 00000000 tags 00000000
failureay?y™? acc error fix performed on chunk 0:0
yaffs ayyy??ojNY?ecc error unfixed on chunk 0:0
ecc errooay~?—?ad del 0 ser 0 seq I$Id: yaffs_ecc.c,v 1.9 2007i?o?E•?N?to ded; i_?yyau?~o.—oBytes transferred = 0 (0x0)
esizexyyyg—Y…a? ?~:"??*** WARNING: (null) is too long (0 - max: 0) - try~yyyOyuoi INVALID STATE
OTP broadcast 0
??‡i~ot umount
p fail
yy—o??receive the ext_csd.
yoYsyA?EN?any high-speed modes.
8x??y.never released inhibit bit(s).
y?u??has 0 eraseregions
[offset: 0x00000000, erasesize:a?—?yyuu)- 0MB y>y?ayya~|~™?device
yyy?~gXo•a??‘?end of device
ck: Atteo?y?yoy‘}??‰}??±??*e Attempted to read beyond end of device
?~zttempted to write past end of de~uy??+i?•‘?data
d
yynot erased.
onenand?set_boundary: Please erase blocks ~goEyy?OK?Die 0
e for Di} EI«‘?for oobsize 0
can_bbt: Out of memory
?? EE?Ee status check fail: 0x0
rc error
?’]E+Ee?in 32 bit mode
de
uy?ax onknown: 0 . 0) **
i?>yBad magic number
header crc
yziyOaddr - A valid autoscr header must be present
<y—)*??Y??OSnown Image?>‚??/s:
age 0:ay?ainit Ramdisk from multi component Legacy Image at y?yues-Nµ…?•scriptogramyuyer5ppc~oyy?aa|ionaterminated, rc = 0x0
yxa=08lX:
Image at 00000000 ...
a~yye?aA•e yuyEIUnsupported Archotecture 0x0
gg U?y>?uuuncompress or overwrite error - must Ryyyu?~O?U•E)?oyAA±??…N????image stored in memory
passing argumeiuoyyc?e‹?µ‘?
ation ?u?a?a~µ…?•?contents (magic number, header and payload che:?s-RROFFugh) Cache is (null)
yuu?]
- enable or disable data (writethrough) cacho>Yyu‘u~ess 0xlx
yu??uyEa)artiny?y?yyya)‹Ua??u?Yyaio|"•U??•± use `dev[art]' **
uo?Yapartitio?aA•?"(null)" (expect "U-Boot")
y?±•I?in a directory (default /)
ayaY§igname] [bytes]
- load binary file 'filename'a?~?y®e??by ext2 on 'interface'
at^cy<|ev[art]>
ition 0-----
?zayN±?‡‘?<interface> <dev[art]> <addr> <filename> [byuyyyu~?•Iu) - load binary file 'filename' from 'dev' on ?uy?uI™…?oya<dev[art]>
- print information about filesyoy?yiay‘?ad|ress not on sector boundary
??>??…rt and/or end address not on sector boundary
yyy?•|?ASH type
y?i~ for all FLASH memory banks
flinfo N
- print info~iyu?yxyI?sN…EN? to the end of sect w/addr 'start'+'len'-1
eryy?YyySx write protection
start end
- protect FLA?|y?uoI?OF-SL in FLASH bank # N
protect on bank N
-a?yyy?y~…*•?FLASH from addr 'start' to end of sect w/a|o?y?iyyyke all FLASH banks writable
r ''i’YI?yµA•UMNEO?N?returning error when dumping path: , '.ay:rrOr binary (ymodem) download ?yu>>a~ps and press ESC ...
y????E‘?file over serial line
o/—yyuYI•t 'off' and baudrate 'baud'
bi~yyyy???a?08lX, expected 00000000
y toa?yyo?AauWhalfword sao??Ia?modify, auto increment address
???<a - memory copy
.w, .l] source target ¬«iy?ya>??•?*IOµ?[save at addr]
or oau??yy—u .w, .l] address number_of_objects
- loop oao?????for N seconds (N is _decimal_ !!!)
yiy??‹)
yyyoutemaddr blk# cnt
mmc write <dc~?—o|yNgsmage at addr 0x00000000 ...
?INyAy‘‘Ee]bootfilename]
rpboot?eeuirEQUEST to network host
?y< not supported
* Abort
yzyµ•?
nment variables
|{…?•)mands in an environment varia~yyay~?N?a block start address
ERROR: 0 length is not biiai?y~yy0xax, 0
x0,len=0x0,retlen=0x0,addr?yyIB*"? ~eading page 00000000
age 00000000 dump:
y?yI)–OE write:
y?Iy?failed 0x0, 0
failed 0x0, 0
~?‡?yI«99?sub-system?y·~?address 'addr', skipping bad blocks.
onenand writ}.ua~yyyyWst [off size] - test 'size' bytes from
offset 'offo??~Eµation
NW to transmit data
?auy•afor (null) command
e Part
~u|?±oyoUnknown command '(null)' - try 'help' without argume~t>??y«Y±??•)..]
aa?y~^coU? prints online help for the monitor commands.
Wiy?yay·•oaX.
u?Oµ•?NI?
alias for 'help'
o}y•?Uµ--default_environment=0x0,ENV_SIZE=0x0
?EI9Outside available Flash
s not Eyy?oo~!ERROR : memory not allocated
|#yyzyµ?main input shell.
?Iyu?AN?E± error 0
escriptor ooo short (expecte| ~ua—???•?descriptor (error=0)
ort raayyy?y—±apart
error, 0(SOyyyx??II?filewriting(null) 0 0xyy?o?mmc r/w sub system for SMDK board
ze mo_Ey~?{adar} [bytes(hex)] - Read rootfs data from sd/mmc by sizy??yyy?—?{oector#} {bytes(hex)} {addr} - instead of this, you cana?yo?yy¬te/ installation.
on.
o»±•N•‘?kernel image (0 byte) installation.
t ube‹??xoy—?for Android
insdroid zimage - Install zimage image for
?uuyiudmovi write u-boot {address} - Make bootable SD card with ??yuoyy•.a–OWarning can not do hw and sw ecc for partition '(null)'
O?Y??ame for '(null)'
??yagmploy default partition information
yyy^??N•‘)tected
y?a~W‹????does not existyya?–?•±?.
/yx?…EN?N???partition '(null)' flashed
??uayNoI?®V‘)yy?yY‘?Chip)fastbooty·es
sdfuse - read images from FAT partition of SD card an| yyy?aa  erse userdata, ¬<?y^u??• is NOT founded.
/sd device's initializationayya.Ay 0x00
3 0 a?*Au?y??i
create partition.
fdZ?=?y?A~oEEWriting to OneNAND...
®yu?>?y• input address don't need a virtual-to-physicau??u??Na|e??system now!
y~u?©I§?‘}µµ?}‘•U??•?error!
rd OK!?yaI—?dXW?image Error!
yyay00a6a00000affs2 40000000 e00000 6a00????00 300000???‚?Completed kernel image installation.
EyY???o?0000rite 30008000 80000 200000ed licy?00?‚‚‚‚Completed uboot image installation.
y?}?‘E?a‘?zImage images Fail!
I??yWboot images Fail!
Android Log images Fail!
y#####################################
?uyY??123456789abcdefghijklmnopqrstuvwxyzCDEFCoyyyyiany length or distance symbolsxy?lite®±?length codey??ai_submit_job: ENOMEM
need 0 TDs, only have 0
>xz«n?
loada?y|y??yy?©)?N??fastboot ...
LSI0n?oyyy?oint!
d 0x0 from environment
younvalid FAT entry
(null)??y±§‘?on device 0 **
0xax?y???Yy?’??j)x
Au????uu…!!
ataaoo»yyOt make zero buffer~~!!
.u…?y~±§u??: 0
write addr : 0x0
yy~«e=d)~~~!!!
't write rootdata~~~!!!
te ~u?uyyay?>?±esystem...
* ext2fs read block (indir 1) malloc faeyyy~Nnuira2 2) malloc failed. **
read block (invIa?uy>_‹????sector 0
ce Descriptor u®u?u?a TKµe (null) Ser#: (null)
y?aua?yy?Keea device 0 -- Partition Type: (null)
_26?UK14_32lkMsys = 0MHz, PclkMsys = 52494216MHz
A Uyz, PclkPsys = 0MHz
yy?YX‚‚‚‚SS?‚‚‚‚‚onenand read 40000000 8600000 1400000a}ffs_unlink returning error: 0
returning error: 0
??•I•…‘I?.......... 0
nBlockErasures....... 52494216
nGCCopies............ 0
garbageCollections... 52494216
passiveGarbageColl'ns 4087376
u??|d an object to a null pointer directory
g to add an object to a non-directory
€*yaffs bug: yaffs_guts.h 0
undefined state 0
gsInUse 0 counted chunk bits 52494216
suspect sequence number of 0
tags 0 obj 320ff88 oh 3e5e50
yntId 0 obj->parent is NULL
0 header mismatch parentId 52494216 parentObjectId 0
?ft delete chunk 0
struck out
li•yynt block count wrong dev 0 count 0
0 count 52494216
blocks 0 (max is 1)
oz*"?(null) ”y libuP^>
parent pointer 00000000 which does not look like an object
nt is not a directory (type 0)
bj cuaNj 0 has illegaltype 0
etiringmeDirty block 0 state 0 ”y libuP^>
iled 0
a{ounk 0
ine 0 delete of chunk 0
ore eraased blocks
ocated block 0, seq 52494216, 4087376 left
ya!!!!!!!!!!!!!!!!
unk 0 was not erased
d needs retiring
yaffs write required d attempts
yuy9…µ•e non-directory
isCheckpointed 0
ipping checkpoint write
kpoint validity
checkpoint devicyyave exit: isCheckpointed 0
daft chunkId 0 for 52494216
ocate Tnodes
uld not add tnodes to managyyno?a non-file
ting chunk < 0 in scan
alid
lected block 0 with 52494216 free, prioritioyy?a,WEe?block 0 that has no chunks in use
0
d 0 52494216
has no?e«±‘?be erased
unks before 0 after 52494216
im!!! erasedBlocks 0 after try 0 blaiy'0_[Na?file 0
mediate deletion of file 0
space during cache write
Could not allocatycNa)checkpoint objects
ruct size 0 instead of 0 ok 52494216
ead object 0 parent 52494216 ty?}ayoytore exit: isCheckpointed 0
fs: yaffs_GutsInitialise()
ice
ry problems: chunk size 0,a|: device already mounted
chunk group too large
checkpoint
only for YAFFS2!n{k index!
Block scanning block 0 state 0 seq 52494216
canning block 0 has bad sequence number?|i?written block 0 being set for retirement
ot make object for object 0 at chunk 52494216 during scan
?Y…rds ends
ntstartblk 0 intendblk 0...
on block 0 was not highest sequence id: block seq yuotialise() done.
s.c,v 1.52 2007/10/16 00:45:05 charles Exp $nknowncanningty?iting chunk 0 tags 52494216 4087376
g with no tags
affs_nand.c,v 1.7 2007/02/14 01:09:06 wookey Exp $ilableot block: start: blocks 0 next 0
h: block 0 oid 52494216 seq 0 eccr 52494216
pt block 0
…N????checkpt block 0
s
fer nand 0(52494216:4087376) objid 0 chId 52494216
t byte count 0
~E?‚SO‚EO‚????*•a?Exp $_MarkNANDBlockBad 0
nandmtd2_ReadChunkWithTagsFromNAND chunk 0 data 00000000 tags 0320FF88
_QueruIAyy 0 data 0320FF88 tags 00000000
at (null):52494216/4()!
G!/02/14 01:09:06 wookey Exp $?oyofor[Yz??chunk 0:0
ixed on chunk 0:0
error fix performed on chunk 0:1
~gd on chunk 0:0
mtd ecc error fix performed on chunk 0:1
>mtd ecc error unfixed on chunk 0:1
chunkaau?g<0
,v 1.9 2007/02/14 01:09:06 wookey Exp $needed but not set
u•
ARP Retry count exceeded; starting again
ss not given
yyn?= 0 (0x320ff88)
tluoo largeagicoot filya®’ Size is 0x0 Bytes = lx
ed; starting again
MB received
is too long (0 - max: 0) - truncated
Nameng vendor optional boot file
nBOOTP broadcast 0
ARP broadcast 0
2lX00320FF88.imga NFS from server ename '(null)/”y libuP^>'.i.'2?±•?lookup fail
MMC Device 0 not found
bl len failed
mmc r}y_y‘?
XT_CSD on a possible high capacity card. Card will be ignored.
le to read EXT_CSD, performance might su?n modes.
r 00000000init fail!
HSMMC0nnel 0
k neve?y?N?bit(s).
iting for status update.
during transfer: 0xx
mc: ^as}{asesize: 0x00000, numblocks: 0000]
Attempting to recover from uncorrectable read
L 2.65/3.3ND(null) 52494216MB 4V 16-bit (0x00)
n = 0x0000
timeout!ctrl=0x0000 intr=0x'?yynUE…I•e Unaligned address
ngth not block aligned
ase: Failed erase, block 0
nd_bbt_read_oob:0A|u?cg
olock: Attempt read beyond end of device
le_read_ops_nolock: Attempt read beyond end of devic}YY?to read beyond end of device
_oob_nolock: read failed = 0x0
e_oob_nolock: Attempted to start write outsy>>Attempted to write past end of device
ob_nolock: write failed 0
d_write_ops_nolock: Attempt write to past<UuyAI}??±??*e write filaed 0
tatus = 0x0
ma_transfer: DMA error!
nd_set_boundary: Invalid bound?uydset_boundary: Please erase blocks before boundary change
nd_set_boundary: boundary locked
flexonenand_set_boundary: Cxang^yy}‰?O?‘…Eae Failed PI write for Die 0
WN DEVICE ID!!!
rning - OneNAND read mode: async.
an(): Can't allocate?onyy?n_scan_bbt: Out of memory
or bad blocks
t 0x00000000
bbt: Can't scan flash and builduyA•x
rx crc error
error
big
ut
m9000 novooN‚‚O’O??????in 8 bit mode
00: Undefined IO-mode:0x0
02x:00:320ff88:3e5e50:x:00
lish link
…?a args (max. 0) **
efined
wn command '(null)' - try 'help'
yA«µ‰•E)Empty Script
ge format for autoscript
ting script at Aao®,.B•…‘•E?must be present
= 0x00000000
_paramsartethaddr =ip_addryi??N•?NOE•Unknown Imageget_format
x --------
bootm_low:
o)et = 0x00000000
g init Ramdisk from Legacy Image at 00000000 ...
i component Legacy Image at lx ...
ip2ippressedilesystem.W?‘…±??•Standalone Programat_dthaIntel x86kuperHarcckfinR32NetBSDotoO0x0
start application at address 'addr'
- start application at address 'addr'
passing ?yyy?Jµ…?•?at 00000000 ...
Bad Magic Number
Bad Header Checksum
CRC
rmt!
wycompressionData Size: 0 Bytes = 8x
Entry Point: x
xotgcture 0x0
Image Type for (null) command
t for (null) command
kernel image!
unknown yor overwrite error - must RESET board to recover
ompression type 0
RNING: legacy format multi component imagc?iE…?I™•EE????control to NetBSD stage-2 loader (at address 00000000) ...
sferring control to RTEMS (at address 00000000e ...
?•‘?in memory
passing arguments 'arg ...'; when booting a Linux kernel,
'arg' can be the address of an initrd image
yyi - print header information for application image
..]
- print header information for application image startincoa?anwmber, header and payload checksums)
sages found in flash
information about all imageo w|u?O??? Cache is (null)
Cache is (null)
le or disable instruction cache
on, off]
- enable or disqbuyuy~a䱥?data (writethrough) cache
ilable devices:
le devices and inf?year (null) @ 0x0320ff88 (4087376 bytes)
ot of VxWorks image at address 0x08lx ...
MAC address not cooyoyne (@ 0x0): ”y libuP^>
Starting vxWorks at 0x00000000 ...
terminated
n at 0x00000000 ...
?X–•II?of ELF image.
vxWorks from an ELF image
ess] - load address of vxWorks ELF image.
u…ENu? **
4 **
0 ....
boot file definedua?o2.$B*aA•?N?"U-Boot")
s 0:52494216 **
or disk - (null) 52494216:4087376 **
** Unable to read "(null)" from ao?y?~efault /)
art]> [directory]
- list files from 'dev' on 'interface' in a 'directory'
2load-uynye+‘?binary file 'filename' from 'dev' on 'interface'
to address 'addr' from ext2 filesystem
?boundary
sector precedes start sector
ddress not on sector boundary
r: cannot span across banks whayi~?N?on sector boundary
nd address (0x00000000) not in flash!
# 0
ification
—*M!?type
Erased 0 sectors
e Flash Bank # 0
rase Flash Sectors 0-d in Bank # zu # 0:a?~ks
flinfo N
- print information for FLASH memory bank # N
- erase FLASH memory
FLASH froio?N?w/addr 'start'+'len'-1
erase N:SF[-SL]
- erase sectors SF-SL in FLASH bank # N
erase bank N
- erase FLASH bank # N
eyoouusN…EN?end
- protect FLASH from addr 'start' to addr 'end'
protect on start +len
- protect FLASH from addr 'start' to eiu??r)protect on bank N
- protect FLASH bank # N
protect on all
- protect all FLASH banks
protect off start end
- maogyy? 'start' to end of sect w/addr 'start'+'len'-1 wrtable
protect off N:SF[-SL]
- make sectors SF-SL writable in FLASH bank # Nuu|?itable
nknown operator '(null)'
Invalid data width specifier
=<= true/f}y?grror when dumping path: , (null)
Writing value (0) 320ff88 times to (null)... file (null)
lsotal Siuy?E?binary (ymodem) download to 0x00000000 at 52494216 bps...
# Ready for binary (kermit) download to 0xX at 0 bps...
ary (k}o}?^X
## Last Load Addr = 0x00000000
## Total Size = 0xlX = 0 Bytes
echoxuc??•) load S-Record file over serial line with offset 'off'
oadbnary file over serial line (kary?n'aaud'
file over serial line (ymodem mode)
ress: 0x00000000
r 00000000 ... 0320ff88 ==> 003e5e50
X
ength ???
sh... (0x00000000) != word at 0x00000000 (0x8lx)
8lx (0x0000) != ha|yyal of d (null)”y libuP^> were the same
08lx:d - memory display
.b, .w, .l] address [# of objects]
- memory displament address
- memory modify (constant address)
s
- memory modify, read and keep address
yy?, .w, .l] source target count
- copy memory
[.b, .w, .l] addr1 addr2 count
- compare memory
yIu)address offset
ss offset for memory commands
base off
- set address offsat ow[¬–}?™}?‰©•?NI) - loop on a set of addresses
t [end [pattern]]]
- simple RAM read/~y?os _decimal_ !!!)
Device: (null)
r ID: 0
0
: 0
MMC read: dev # d, block # 0, count 52494216 ...
e: dev # 0, block # d, count 0 ... A52494216u???X–?blk# cnt
mmc write <device num> addr blk# cnt
mmc rescan <device num>
mmc list - list available devices
ping failed; host aiae…?•?at addr 0x00000000 ...
pa network using BootP/TFTP protocol
ilename]
yarpbootrarpboot- boot image via network using RARP/TFTP protocol
CP client to obtain IP/boot params
ypingAddress
nt to (null)...
illegal character '=' in variable name "(null)"
_R
‰?EN)0 bytes
t environment variables
of all environmenta~Xonment variables
me value ...
- set environment variable 'name' to 'value ...'
setenv name
- delete environment variableozymmands in an environment variable
the commands in the environment variable(s) 'var'
lock a ?*II=Ie 0 length is not block aligned
te (0 blocks):
0x0 is skipped.
ne----ofs=0x0,len=xyIx0,len=0x0,retlen=0x320ff88,addr=0x0,oob=0x320ff88
a read (0 blocks):
s' is not a number
e (0x0) exceede|yy…?•?00000000 dump:
02x 00 320ff88 3e5e50 x 00 320ff88 3e5e50 01 00 320ff88 3e5e50 01 x 00 320ff88
x 00 320ff88 &?ua"…N…?-- 0%.ROR: Write failed 0x0, 0 at 0x00000000
s: y failed 0x0, 52494216
Read/Write test failed at 0x0
ittenNOT ma?yyu?y - show available OneNAND devices
onenand bad - show bad blocks
onenand read[.oob] addr off size
onenand write[.oob] addr off om?ung bad blocks.
onenand write.yaffs addr off size - read/write `size' bytes starting
at offset `off' to/from memory address `aday??' bytes from
offset 'off' (entire device if not specified)
onenand dump[.oob] off - dump page
onenand markbad off [...] - maryur<dNW to transmit data
lize USB device and ready to receive for Windows server (specific)
dress]
uqv‚…EN)8lx extract a part of a multi-image
addr part [dest]
- extract uxy?y ?Ea?'help' without arguments for list of all known commands
o monitor version
?test like /bin/sh
- test functionality
- exit script
onality
or<the monitor commands.
Without arguments, it prints a short usage message for all commands.
To get detailed help information vK
±?…I?for 'help'
In: ces available!
vailable!
rr: ces avaeix?oA•x,ENV_SIZE=0x0
default environment is too large
ng - bad CRC, using default environment
out writuuy?*WEN?and/or end address not on sector boundary
f Flash
f Flash
Programming Error
osyyqted
IFS"e is a global environment variable with the same name.
variablenknown cyyuyUEaRhiledoHUB (0) reached
USB Devices, max=0
RROR: ~ua}yc>•I?E?AN?E?too short (expected 0, got 52494216)
et port 0!?
SB device not responding, giving up (status=X)
yW"•U??•?descriptor short read (expected 0, got 52494216)
set default configuration len 0, status 320FF88
mu(?(xyzModem - (null) mode, 52494216(SOH)/0(STX)/52494216(CAN) packets, 0 retries
ksum errormingi?•1A .. 0, 52494216 lx 0x0 0x320ff88 0, 52494216 er.. 0, 52494216 l.. 0, 52494216 0, ||???…E‘)ialize moviNAND and show card info
movi read {u-boot | kernel} {addr} - Read data from sd/mmc
movi write {fw?iy??N™I?data from sd/mmc by size
movi write rootfs {addr} [bytes(hex)] - Write rootfs data to sd/mmc by size
movi read {sector#} {ry|yur} - instead of this, you can use "mmc write"
Android image downloading.
ad' buttiiytzaIN•µ?image installation.
stem image(0 byte) installation.
nstallation.
y|e) installation.
Start uboot image installation.
0 byte) installation.
age}0> - Install zimage image for Android
insdroid ramdisk - Install ramdisk image for Android
insdroid system - Install system imay}<y?a- Make bootable SD card with uboot
ition table on OneNAND]
me='(null)' art=N/A ) and sw ecc for partition '(null)'
ese flags
Adding partitions from environment
STBOOT syyuns…µ•?for '(null)'
r:FASTBOOT no closing c found in partition name
FASTBOOT partition name is too long
y?Eµ…N???)ions!t 0x00000000, size 0xx, flags 0x00000000
ty timeout 0 seconyet}cted
s set of 0 bytes finished
noring
ot?g:.s?
erase partitionion '(null)' erased
adf 0 bytes
FAILdata ?yRyErROR : bootting failed
hould reset the board
FAILinvalid boot imagewnloadedILimage too large foryI?•‘) failed : (null)
rtition '(null)' saveenv-ed
nknown OEM commandition: (null), File: ”y libuP^>/yyyay?e
People, help me somebody unbrick Dropad A8X, please !!!
Helter2 said:
People, help me somebody unbrick Dropad A8X, please !!!
Click to expand...
Click to collapse
I had exactly the same (Dropad A8X) - and many with us as I read on the DX forum and other places ... however, I managed to flash new firmware ...
Here is the description:
slatedroid.com/topic/19685-dropad-a8x-hardware/page__gopid__255906#entry255906
Great thanks to Adam and especially Rebellos for his fantastic hack.
Please read my story completely as I was just to impatient and messed it up after all (if any one can be of any assistance as how to go further .
However, the method lets you flash new firmware using Odin or Adam's One-Click tool.

[Q] Can someone help explain zImage, boot.bin, and recovery.bin on Samsung

I'm coming from another platform where we had separate partitions for the OS and the Recovery (boot.img and recovery.img). Each one included their own kernel (zImage) and their own initrd (initial filesystem for kernel)
I see on the E4GT PIT file, there is a partition for zImage, boot.bin, and recovery.bin
zImage I'm assuming is just the kernel. Does it include an initrd also?
What is boot.bin? I would have assumed it was the initrd to be used with zImage when booting the OS.
I would have thought when you booted to Recovery, it would used the kernel/zImage and then loaded an initrd from recovery.bin (or recovery.bin would contain it's own zImage and initrd), but I saw for the CWM recovery it seems to only flash the zImage and doesn't touch recovery.bin. Then I see a restriction that if you have CWM recovery, you would have stock kernel but it won't be really stock because it has the addition of CWM and installing it will result in the Yellow Triangle in download mode (which I assume means the kernel/zImage flashed with Odin were unsigned?)
Anyway, the way I would have thought CWM would have been built would be to replace recovery.bin and keep the existing kernel (zImage). Then you could modify each independently of each other. Alternatively recovery.bin could include its own zImage and initrd, so it would be completely independent of zImage kernel in case you mess that up.
Also I saw that there was no pull/backup of the stock recovery.bin. Is there a reason for that? Since the CWM flash seems to be implemeted through a new zImage, does that mean if you flash the stock kernel/zImage, then you'll also get stock Recovery back? I'm assuming here that CWM was hacked into zImage by forcing it to use CWM instead of using what is in recovery.bin.
Wondering if anyone could clear things up? I'm ok conceptually with how the linux boot process and Android work, just not with the specifics of how it works on Samsung.
Just popping over from the Infuse forums, and saw this question, so I thought I would throw out an answer for ya.. On stock Samsung, they all three are the exact same thing. zImage is a kernel + initramfs image. The kernel bootstraps, uncompresses the initramfs, and finally, runs the init. The init's job is to either run recovery, or bootstrap the system. The recovery, whether stock or CWM, is baked into the initramfs so that there is no reliance on something other than having a bootable kernel to get into recovery. Much more reliable this way, and you can completely screw over your filesystems and still get into recovery.
Thanks for the response.
LinuxBozo said:
Just popping over from the Infuse forums, and saw this question, so I thought I would throw out an answer for ya.. On stock Samsung, they all three are the exact same thing.
Click to expand...
Click to collapse
So zImage, boot.bin, and recovery.bin are exactly the same thing (ie the same binary image) or they are structured the same (ie they all have a zImage kernel and initramfs)?
LinuxBozo said:
zImage is a kernel + initramfs image. The kernel bootstraps, uncompresses the initramfs, and finally, runs the init.
Click to expand...
Click to collapse
In my past experience, zImage is just the kernel binary, then you package it with an initrd/initramfs and a cmdline to create a bootable binary image.
So you are saying with Samsung, zImage actually is that complete packaged bootable binary image, rather than just being the kernel, correct?
LinuxBozo said:
The init's job is to either run recovery, or bootstrap the system. The recovery, whether stock or CWM, is baked into the initramfs so that there is no reliance on something other than having a bootable kernel to get into recovery. Much more reliable this way, and you can completely screw over your filesystems and still get into recovery.
Click to expand...
Click to collapse
If these (boot and recovery) are sharing the same kernel (rather than having their own individual kernels, which happen to be the same version) then it seems less reliable, since it depends, as you say, on a bootable kernel, which you could have messed up with let's say custom kernels.
If you had the recovery have its own kernel and the os boot have its own kernel, then you could screw up the os boot kernel and still boot into recovery.
In the back of my mind, I still think there is some confusion here (probably on my part). I look at the old odin PIT definition source code here:
https://github.com/cmsgs/utilities/blob/master/pit-stuff/s1_odin_20100803.c
{ 0, 0, 0x00, 0x00, 0, 256, 1, "o\0f\0t\0 ", "IBL+PBL\0" /*concat*/ "S\0e\0r\0v\0e\0r\0\\\09\0\x30\0\\\0T\0o", "boot.bin\0" /*concat*/ "\0i\0n\0n\0;\0C\0:\0\\\0P\0r\0o\0g\0\0\0a\0m\0 \0F\0i\0l\0e\0s\0\\\0E\0S\0T\0s\0o\0f", },
{ 0, 0, 0x01, 0x00, 0, 256, 1, "", "PIT", "\0ries.pit"},
{ 0, 0, 0x14, 0x02, 0, 256, 40, "", "EFS", "efs.rfs"},
{ 0, 0, 0x03, 0x00, 0, 256, 5, "", "SBL", "sbl.bin"},
{ 0, 0, 0x04, 0x00, 0, 256, 5, "", "SBL2", "sbl.bin"},
{ 0, 0, 0x15, 0x02, 0, 256, 20, "", "PARAM", "param.lfs"},
{ 0, 0, 0x06, 0x00, 0, 256, 30, "", "KERNEL", "zImage"},
{ 0, 0, 0x07, 0x00, 0, 256, 30, "", "RECOVERY", "zImage"},
{ 0, 0, 0x16, 0x02, 0, 256, 1186, "", "FACTORYFS", "factoryfs.rfs"}, { 0, 0, 0x17, 0x02, 0, 256, 496, "", "DBDATAFS", "dbdata.rfs"},
{ 0, 0, 0x18, 0x02, 0, 256, 140, "", "CACHE", "cache.rfs"},
{ 0, 0, 0x0b, 0x00, 0, 256, 50, "", "MODEM", "modem.bin"},
{ 1, 1, 0x0b, 0x00, 0, 0, 0, "", "", ""},
Click to expand...
Click to collapse
and it seems to match more closely to what you are describing where kernel and recovery are both zImages, except it would seem they both have individual kernels (I may have misunderstood what you meant above by all three zImage, boot.bin and recovery.bin being exactly the same) as they both are zImage's, which according to what you described above is a zImage kernel + initramfs packaged together, but they are on separate partitions.
Now when I look at the E4GT PIT definition here:
http://forum.xda-developers.com/showthread.php?t=1278281
...
--- Entry #1 ---
Unused: No
Partition Type: 2 (EXT4)
Partition Identifier: 1
Partition Flags: 0 (R)
Unknown 1: 0
Partition Block Size: 0
Partition Block Count: 0
Unknown 2: 0
Unknown 3: 0
Partition Name: BOOT
Filename: boot.bin
...
--- Entry #6 ---
Unused: No
Partition Type: 2 (EXT4)
Partition Identifier: 6
Partition Flags: 0 (R)
Unknown 1: 0
Partition Block Size: 73728
Partition Block Count: 16384
Unknown 2: 0
Unknown 3: 0
Partition Name: KERNEL
Filename: zImage
--- Entry #7 ---
Unused: No
Partition Type: 2 (EXT4)
Partition Identifier: 7
Partition Flags: 0 (R)
Unknown 1: 0
Partition Block Size: 90112
Partition Block Count: 16384
Unknown 2: 0
Unknown 3: 0
Partition Name: RECOVERY
Filename: recovery.bin
Click to expand...
Click to collapse
It seems like they structured it differently than the earlier odin PIT definition, so instead of having 2 zImages, they now have 1 zImage and a separate boot.bin and recovery.bin. The latter two I was assuming where the initramfs for each respective piece.
Part of my confusion then stems from the CWM odin tar file only containing a zImage and no recovery.bin to flash, which lead me to believe CWM was crammed into the zImage initramfs, rather than using the recovery.bin partition like the stock Samsung zImage might do.
Again, I might have this all confused. I'm coming from a different platform where things were packaged a little differently.
sfhub said:
So you are saying with Samsung, zImage actually is that complete packaged bootable binary image, rather than just being the kernel, correct?
Click to expand...
Click to collapse
That's correct.
Part of my confusion then stems from the CWM odin tar file only containing a zImage and no recovery.bin to flash, which lead me to believe CWM was crammed into the zImage initramfs, rather than using the recovery.bin partition like the stock Samsung zImage might do.
Again, I might have this all confused. I'm coming from a different platform where things were packaged a little differently.
Click to expand...
Click to collapse
Yes, I think you are confused, but we're getting there.. ;-)
You'll notice that in your PIT data you posted, the boot.bin partition is of 0 size. Because it's not used here. The zImage partition has the kernel+initramfs image. the recovery.bin partition is an exact copy of the zImage parition. It is not used in any real way other than as a backup of the zImage partition.
So yes, the CWM zImage does have CWM crammed into the initramfs. The stock zImage does the exact same thing, except with a stock recovery.
Hopefully this clears this up a bit more for you.
LinuxBozo said:
The zImage partition has the kernel+initramfs image. the recovery.bin partition is an exact copy of the zImage parition. It is not used in any real way other than as a backup of the zImage partition.
So yes, the CWM zImage does have CWM crammed into the initramfs. The stock zImage does the exact same thing, except with a stock recovery.
Click to expand...
Click to collapse
So when does the recovery.bin ever get used?
Also then if someone restores stock kernel/zImage, they should get back stock Recovery as well, correct?
sfhub said:
So when does the recovery.bin ever get used?
Click to expand...
Click to collapse
In most cases, it really doesn't. Technically, it should be used if your original zImage partition has become corrupt in some way, but I've never tested that to be completely sure.
Also then if someone restores stock kernel/zImage, they should get back stock Recovery as well, correct?
Click to expand...
Click to collapse
Yep, since the recovery binary is baked into the initramfs in either case, flashing back to a stock zImage should return you to stock recovery.

Encryption fails with LOS13

After flashing an M9 with LOS 13, the device does not encrypt and fails to start. I get the following error in logs:
------------------------------------------------------------------------------------------------------------------------------------
E/QSEECOMAPI:: Error::ioctl call to wipe the encryption key for usage 1 failed with ret = -1, errno = 14
[ I/ ]
Keymaster version is not 1.0
[ D/ ]
HW based disk encryption is enabled
[ E/ ]
get_tmp_passwd: Passed argument is NULL
E/QSEECOMAPI:: Error::ioctl call to create encryption key for usage 1 failed with ret = -1, errno = 22
E/Cryptfs: Error enabling encryption after framework is shutdown, no data changed, restarting system
------------------------------------------------------------------------------------------------------------------------------------
If anyone could help with a workaround or had the same issue, it would be very helpful.

Categories

Resources