Find Your Device:
Or Continue to Thread: Matsunichi/Innocomm 'Griffin' …
19th December 2011, 04:41 AM |#2  
OP Junior Member
Thanks Meter: 36
This post is just to keep an archive of all the historical information about porting ICS/CM9 to the griffin/TC970 tablet.

Most of the information here has been superseded by the progress made more recently (see post #1), but I thought it would be useful to have it around, just in case.


================================================== ==============================

Update 1/16/2012

Great news!
With chinabull's help, I found out how to generate the 20 bytes SHA1 checksum for trhe images contained in the firmware.
It is the SHA1 checksum of the image + the 'cafeefac' trailer + the length of the image (including the 'cafeefac' trailer).

I updated the C program 'unpacker.c' to also compute and check the SHA1 checksum.
The program can be compiled with the following command:
gcc -O -Wall -o unpacker unpacker.c -lz -lcrypto

We still haven't found out how to generate the 20 byte SHA1 checksum for the whole firmware, but I think we are very close now.

I'll also start writing the 'packer' because I think we'll have all the pieces in place very soon.

Many thanks to chinabull again for all his help.


================================================== ==============================

Update 1/15/2012

What chinabull found is the CRC32-like checksum for the header of the firmware and for each of the images.
As he pointed out in the thread there is still a 20 bytes (160 bits) signature/checksum that we haven't figured out.
I updated the 'unpacker' code attached to this thread with the header CRC checksum stuff that chinabull found out.
The still unknown 160 bits field is displayed as 'signature/checksum' if you run the'unpacker'; if you figure out how to generate it from each image content, please let us know, since this is the last thing we need to know to be able to create ourown firmware images.


================================================== ==============================

Update 1/13/2012

Very good news!
Chinabull figured out the algorithm used by Innocom to sign/checksum the images and the firmware!
This means that it should be possible to create our own firmware images (possibly with CWM recovery) and start replacing parts of the firmware on the TC970/griffin.

Congratulations to chinabull!


================================================== ==============================
Update 1/8/12

First of all, thanks to the many who posted useful information about the hardware in this tablet and thanks for the comments (btw, negative critiques do not upset me, so don't worry about them, as long as they don't violate this forums policies).

I thought that in order to boot any alternative ROM or firmware it would be useful to find out how locked down Innocomm has made this tablet.
Since the CPU is an OMAP3630 and the Wifi is a WL1271 and they are the same on the Nook Color tablet and since we know that the TC970 can boot off the SD card using the same type of MLO x-loader and bootloader used by the Nook Color, I downloaded the Nook Color 'Monster Bootpack' SD card bootable images from here: They have a couple of 2GB SD card images there.
I tried both of them and in both cases I had the 'bad firmware image' screen, which seems to indicate that the Innocomm recovery boot checks for 'something' (beyond what a normal OMAP3630 does) in order to boot an MLO x-loader from the SD card.

At this point I thought I would try to discover the full format of the 'griffin.ifw' file, in order to be able to create our own ROM images.
I was able to decode a few more fields in the firmware (the memory load address and a few other value) and I have updated the attached 'unpacker.c' accordingly.
Unfortunately a couple of values are still unknown:
- one is a 28 byte (224 bits) field in the header of each image in the firmware - I strongly suspect it is some sort of checksum (224 bits is the length of a SHA224 checksum), but I haven't been able to find out how to generate that value (I tried doing SHA224 checksums of the image,the image+header, and other combinations, but without any luck). If someone here can find how to generate it, big reward!
- the second one is a 24 byte (192 bits) field in the header of the whole firmware - it is probably some other checksum/signature, but I haven't found out any kind of 192 bit signature to make sense of it, so big reward here too if you can figure out what it is.

Both values are printed out by this version of 'unpacker', so you can play around with it and let me know if you find anything.

Finally, I saw from the FCC schematics that the TC970 presents the OMAP3630 UART3/serial port on the 30 pin connector and I saw that one guy ('chinabull') in the TC970 rooting thread was able to connect to it and obtain a shell in recovery mode. My next step is going to be buying the $15 'podbreakout' from sparkfun Electronics (among others) (I am not good with the soldering iron; if you are good and have patience, you may want to try with the $4 iPod connector from the same site) and connect to pins 17, 18, and the ground to have a serial connection and be able to see the actual messages when I try to boot with a different MLO x-loader (should be also useful to 'de-brick' the TC970, since I only have this tablet).

I'll let you know how it goes.


================================================== ==============================

This thread is about gathering and sharing info about the hardware, firmware, Linux kernel and modules for the Mitsunichi/Innocom 'Griffin' M6001 tablet, aka Le Pan TC970 in order to be able to port ICS/CM9 to it, if possible.

I'd like to keep this thread about 'low-level' hardware/kernel, i.e. please do not post questions about rooting this tablet (it has already been done, see here: or about problems with specific applications.

Below is what I found so far.

- Hardware
According to the application with the FCC, these are the most interesting components:

- Name: griffin
- Model: 6001
- Manifacturer: Innocomm
- Processor: TI OMAP3630 ES1.2
- LCD: LP097X02-SLA3 (transmitter: TI SN75LVDS83B)
- Power regulator: TI TWL5030
- Front facing camera: 2M pixel fixed focus CM8188-A200SF-E
- g-Sensor: BMA150
- e-Compass: YAS529-PZ
- light sensor: EPL5804
- gas gauge: OZ8805
- Wireless/Bluetooth/FM: TI WL1271-YFV
- GPS: GSD-4t

- Firmware:
Le Pan has apparentely two versions of its latest firmware, V4431 and V4431-2. My analysis below is based on the one with MD5 checksum f9cabf696f08f1c3791d0a4ec14876db.

I wrote the attached C program to extract all the 'images' (files) from the firmware.
The program can be compiled with the following command:
gcc -O -Wall -o unpacker unpacker.c -lz
(all these commands should work on Linux - Fedora 64 bit; you may have to change them to run them on a different version of Linux/OS).

The firmware is composed of the following nine 'images':

- recovery ('.cpio.gz' archive - it can be opened with the command: gzip -dc recovery | cpio -idm)
- linux (this is the actual Linux kernel; see more about it below)
- iload (same as the first stage 'MLO' x-loader binary in the firmware installation disk)
- iboot (same as the second stage 'iboot.ism' loader in the firmware installation disk)
- splash (probably a bitmap image for the splash screen)
- chargesplash (probably a bitmap image for the splash screen when charging)
- bootifw_logo (probably a bitmap image with the company logo to be displayed at boot time)
- ramdisk (.cpio.gz' archive - it can be opened with the command: gzip -dc ramdisk | cpio -idm)
- system (a YAFFS2 filesystem - it can be opened with the 'unyaffs' program - available here:

The griffin board is based on the TI OMAP3630 ARM CPU, which is the same used by the very popular BeagleBoard ( Most of the information available for the BeagleBoard apply to griffin, included the functions of the files MLO, iload, iboot (see here: - OMAPpedia is definitely a good starting point here).

- Kernel and drivers:
The firmware file 'linux' is the actual Linux ARM kernel; it has some code at the beginning to uncompress it and the rest is a 'gzip' compressed file.
The actual uncompressed kernel can be extracted with the command:
dd if=linux bs=12878 skip=1 | gunzip -dc > kernel

I then ran 'strings -td -a kernel' and it looks like all the drivers are compiled into this kernel (also confirmed by the very few '.ko' files contained in 'system').

The 'strings' command shows the following lines toward the beginning:

183356 twl5030
183392 griffin-i2c-touch
183428 bma150
183464 yas529
183500 OZ8805
183536 epl5800-ls
183572 hynix253
183608 griffin-ha2608-tk

I think these are the drivers which we need to come up in order to be able to compile ICS/CM9 for this tablet.

Here is what I found about them:
- 'twl5030' is the power regulator for the OMAP board and it is already supported by Linux
- 'griffin-i2c-touch' is the capacitive touch screen (see more about it below)
- 'bma150' is the accelerometer and it is already supported by Linux
- 'yas529' is the magnetometer and it is already supported by Linux
- 'oz8805' is the gas gauge - I didn't find much about it
- 'epl5800-ls' is the light sensor - I didn't find much about it
- 'hynix253' is the 2M pixel camera - I didn't find much about it
- 'griffin-ha2608-tk' is the touch key - I found some code about it here

I started looking at the touch screen first, since it is probably the most critical component in this list (and the one that took some work to get to work correctly on the CM7 for the HP Touchpad).

The 'bootinfo.txt' log file posted on the TC970 rooting thread shows the following kernel message lines for the TS:

input: griffin-i2c-touch as /devices/virtual/input/input7
griffin-i2c-touch 2-0055: registered with irq (313)
Goodix TouchScreen Version:GT801NI_1R02_13T
griffin-i2c-touch 2-0055: Create proc entry success!
Goodix debug sysfs create success!
griffin-i2c-touch 2-0055: Start touchscreen griffin-i2c-touch in interrupt mode

which show that the TS is a Goodix GT801.

Search for Goodix Linux drivers, I found the following page (in Chinese) It looks like it contains the source code for the Linux driver for the TS and it looks like the driver is under the GPL license. Unfortunately the source code refers to a couple of include files ('goodix_touch.h' and 'goodix_queue.h') that I was not able to find anywhere. The guy who posted that source code might have them, I did not try to contact him. Also the 'goodix_touch.ko' kernel drivers out there refer to a source file 'goodix_touch_1024n.c' that I was not able to find either.

Interestingly enough, the schematics posted on the FCC site do not mention any Goodix chip at all (at least I wasn't able to find it there).

This is what I found so far; I'll add more updates as I find them.

I would also appreciate very much if anyone could post information about the source code for the drivers (or even developer's guides, SDKs, datasheets) for the touch screen (most important), the light sensor, the camera, the GPS, etc

Last edited by fv+; 28th January 2012 at 02:17 AM. Reason: historical information
The Following User Says Thank You to fv+ For This Useful Post: [ View ]