Because I don't run Windows nor NetBSD, I rewrote rkflash from scratch with the use of libusb-1.0, so you can now read and write your rk2818-based tablet's flash memory under Linux (also w/o the need to root your tablet). Credit for reverse-engineering the protocol goes to the original author of rkflash (see source).
- unzip the file
Linux (Debian, Ubuntu, ...)
sudo apt-get install libusb-1.0-0-dev gcc -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall -s
sudo port install libusb gcc -I/opt/local/include -I/opt/local/include/libusb-1.0 \ -L/opt/local/lib -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall
- powerdown your tablet
- disconnect all cables
To get into flash mode differs for many tablets. Google around or use trial and error
- insert the USB cable in computer
- hold vol+ (or put on/off/locked-switch in the locked position)
- insert the other end of your cable in the tablet
- wait a few seconds
- release vol+
Now if you run lsusb, the following line should appear:
Bus 001 Device 044: ID 2207:281a (290a for rk2918 based tablets)
Bus and device number may be different. The screen of your tablet stays black.
The USB device must be readable and writable for the user running rkflashtool. If that's not the case, you'll see an error like this:
$ ./rkflashtool b libusb couldn't open USB device /dev/bus/usb/001/048: Permission denied. libusb requires write access to USB device nodes. rkflashtool: fatal: cannot open device
Usage of rkflashtool
$ ./rkflashtool rkflashtool: fatal: usage: rkflashtool b reboot device rkflashtool r offset size >file read flash rkflashtool w offset size <file write flash offset and size are in units of 512 bytes
Its size is 0x2000 blocks
To backup the partition, issue:
$ ./rkflashtool r 0x8000 0x2000 >boot.img.backup rkflashtool: info: interface claimed rkflashtool: info: reading flash memory at offset 0x00008000 rkflashtool: info: reading flash memory at offset 0x00008020 ....... rkflashtool: info: reading flash memory at offset 0x00009fe0
$ ./rkflashtool w 0x8000 0x2000 <boot.img.backup rkflashtool: info: interface claimed rkflashtool: info: writing flash memory at offset 0x00008000 rkflashtool: info: writing flash memory at offset 0x00008020 ....... rkflashtool: info: writing flash memory at offset 0x00009fe0
After reading and writing at will, you can reboot your tablet by issuing
Note that if your tablet has an on/off/locked-switch and it is still in the locked position, rebooting won't work.
If the file you are writing is smaller than the specified size, the rest is padded with zeroes. If it's bigger, it will be truncated. This is different from rkflash, which will overwrite blocks beyond the partition size.
rkflashtool does not support flashing a new bootloader directly.
If you have a different tablet, please try rkflashtool b and r first before flashing (w) something new.
Standard DISCLAIMER with regard to bricking your tablet applies.
EDIT: better build instructions, clean up text
EDIT2: works on rk2918 tablets too (tested on Arnova 7 G2) if you change the USB product id from 0x281a to 0x290a before compilation
EDIT3: released version 2 of rkflashtool. now supports rk2918 tablets out of the box. if it doesn't find one, it falls back to rk2808/rk2818. also, updated the wording a bit.
EDIT4: new mac osx binary
EDIT5: more ways to find offsets and sizes of partitions on your tablet
EDIT6: small emphasis changes above and...
version 1 is here ONLY for archival purposes or if version 2 does not work on your rk28xx tablet. In all other cases, you need to download rkflashtool-v2.zip