Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,781,459 Members 41,242 Now Online
XDA Developers Android and Mobile Development Forum

[TOOL] rkflashtool for Linux and rk2808, rk2818 and rk2918 based tablets

Tip us?
 
ivop
Old
(Last edited by ivop; 28th December 2011 at 11:56 PM.)
#1  
Junior Member - OP
Thanks Meter 16
Posts: 12
Join Date: Sep 2011
Default [TOOL] rkflashtool for Linux and rk2808, rk2818 and rk2918 based tablets

Hi,

Because I don't run Windows nor NetBSD, I rewrote rkflash from scratch with the use of libusb-1.0, so you can now read and write your rk2818-based tablet's flash memory under Linux (also w/o the need to root your tablet). Credit for reverse-engineering the protocol goes to the original author of rkflash (see source).

Small guide

- unzip the file
- compile

Linux (Debian, Ubuntu, ...)
Code:
sudo apt-get install libusb-1.0-0-dev
gcc -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall -s
Mac OS X (thanks to surfer63, binary here)
Code:
sudo port install libusb
gcc -I/opt/local/include -I/opt/local/include/libusb-1.0 \
-L/opt/local/lib -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall
Preparation
- powerdown your tablet
- disconnect all cables

To get into flash mode differs for many tablets. Google around or use trial and error

- insert the USB cable in computer
- hold vol+ (or put on/off/locked-switch in the locked position)
- insert the other end of your cable in the tablet
- wait a few seconds
- release vol+

Now if you run lsusb, the following line should appear:

Bus 001 Device 044: ID 2207:281a (290a for rk2918 based tablets)

Bus and device number may be different. The screen of your tablet stays black.

The USB device must be readable and writable for the user running rkflashtool. If that's not the case, you'll see an error like this:

Code:
$ ./rkflashtool b
libusb couldn't open USB device /dev/bus/usb/001/048: Permission denied.
libusb requires write access to USB device nodes.
rkflashtool: fatal: cannot open device
This can be fixed in several ways (chmod, run as root, udev rules) but that's beyond the scope of this posting. For now, chmod 666 the device mentioned in the error message.

Usage of rkflashtool

Code:
$ ./rkflashtool
rkflashtool: fatal: usage:
	rkflashtool b                   	reboot device
	rkflashtool r offset size >file 	read flash
	rkflashtool w offset size <file 	write flash

	offset and size are in units of 512 bytes
On my tablet, the boot partition starts at offset 0x8000 (in blocks of 512 bytes)
Its size is 0x2000 blocks
To backup the partition, issue:

Code:
$ ./rkflashtool r 0x8000 0x2000 >boot.img.backup
rkflashtool: info: interface claimed
rkflashtool: info: reading flash memory at offset 0x00008000
rkflashtool: info: reading flash memory at offset 0x00008020
.......
rkflashtool: info: reading flash memory at offset 0x00009fe0
To write a new boot.img or an old backup back to the device:

Code:
$ ./rkflashtool w 0x8000 0x2000 <boot.img.backup
rkflashtool: info: interface claimed
rkflashtool: info: writing flash memory at offset 0x00008000
rkflashtool: info: writing flash memory at offset 0x00008020
.......
rkflashtool: info: writing flash memory at offset 0x00009fe0
You can find a list of all partitions of your tablet in the HWDEF file, which is inside the update.img for your tablet. If no such file is available, you can also look at /proc/cmdline on a running device (either through adb or a terminal app running on the device itself). Depending on the tablet, you might need root access to view /proc/cmdline. Another option is dumping the first 0x2000 blocks of nand flash by issuing rkflashtool r 0x0000 0x2000 >parm. View the file with hexedit, xxd, or a similar program. The kernel parameters contain a description of several mtd partitions (sizes and offsets).

After reading and writing at will, you can reboot your tablet by issuing
./rkflashtool b

Note that if your tablet has an on/off/locked-switch and it is still in the locked position, rebooting won't work.

If the file you are writing is smaller than the specified size, the rest is padded with zeroes. If it's bigger, it will be truncated. This is different from rkflash, which will overwrite blocks beyond the partition size.
rkflashtool does not support flashing a new bootloader directly.
If you have a different tablet, please try rkflashtool b and r first before flashing (w) something new.
Standard DISCLAIMER with regard to bricking your tablet applies.

Enjoy!


EDIT: better build instructions, clean up text
EDIT2: works on rk2918 tablets too (tested on Arnova 7 G2) if you change the USB product id from 0x281a to 0x290a before compilation
EDIT3: released version 2 of rkflashtool. now supports rk2918 tablets out of the box. if it doesn't find one, it falls back to rk2808/rk2818. also, updated the wording a bit.
EDIT4: new mac osx binary
EDIT5: more ways to find offsets and sizes of partitions on your tablet


EDIT6: small emphasis changes above and...

version 1 is here ONLY for archival purposes or if version 2 does not work on your rk28xx tablet. In all other cases, you need to download rkflashtool-v2.zip
Attached Files
File Type: zip rkflashtool.zip - [Click for QR Code] (2.4 KB, 3736 views)
File Type: zip rkflashtool-v2.zip - [Click for QR Code] (2.4 KB, 7529 views)
The Following 14 Users Say Thank You to ivop For This Useful Post: [ Click to Expand ]
 
surfer63
Old
#2  
Member
Thanks Meter 23
Posts: 87
Join Date: May 2010
Location: Zwolle
Thanks a lot for this flash tool. I'm on MacOSX and Ubuntu and don't have Windows either. I tried the original rkflash as well but couldn't get it to work. On my Ubuntu boxes your rkflashtool compiles and works fine.
My Archos 7 HT V2 presents itself also as:
Code:
Bus 002 Device 004: ID 2207:281a
Reading partitions works fine and so does writing.
I did a quick modification of a system.img (left some files out) of my custom froyo rom and wrote it to my tablet.
That works fine. As /data is a separate partition I even have all my downloaded apps, data, settings, etc. This makes modifying a new rom much faster then building a complete update.img, flashing it, restore some data and then start testing.

Nice work.
 
fun_
Old
(Last edited by fun_; 7th October 2011 at 02:06 AM.)
#3  
Senior Member
Thanks Meter 637
Posts: 2,376
Join Date: Aug 2010
great! finally I can remove one line from my todo list
thank you!

EDIT:
random notes (I don't see your code yet so it may be fixed, then sorry)
* I always specify b(reboot) for rk2818 tablets with my rkflash because it hanged easily if I try to write multiple times without b
* parameter file need to be converted with rkcrc -p. official RKAndroid tools flashed it 5 times with offsets. (read & check 1st 0x0-0x2000 block)
* I logged how to update bootloader, but it's complicated and I could not understand probably bootloader can be updated via misc partition. see update-script in update.img. (but not recommended/no reason to do it)

EDIT2:
there is libusb for Windows and OS X. rkflashtool may work on them.

on Windows, there is RKAndroidTool.exe (not batchupgrade). but "read" function in rkflash/rkflashtool may be useful on some case on Windows
The Following 2 Users Say Thank You to fun_ For This Useful Post: [ Click to Expand ]
 
ivop
Old
(Last edited by ivop; 9th October 2011 at 04:17 PM.)
#4  
Junior Member - OP
Thanks Meter 16
Posts: 12
Join Date: Sep 2011
Good to hear it works for others, too! I have not had a hanging tablet after several writes in one session, but this might depend on the tablet.

Thanks for mentioning that it should also work on other platforms supported by libusb. I'd forgotten to do that.

About using update.img to flash a new bootloader, this can be done, but if you brick the tablet by flashing a wrong/faulty bootloader, you can only unbrick it with the Windows tools

Which leads me to the question: could you send me the snooped log of updating the bootloader? Two people see more than one and perhaps we can eventually manage to do this through libusb too.
 
fun_
Old
#5  
Senior Member
Thanks Meter 637
Posts: 2,376
Join Date: Aug 2010
Quote:
Originally Posted by ivop View Post
About using update.img to flash a new bootloader, this can be done, but if you brick the tablet by flashing a wrong/faulty bootloader, you can only unbrick it with the Windows tools
probably you also need a needle to short pins of NAND chip
so I don't recommend to flash bootloader

Quote:
Originally Posted by ivop View Post
Which leads me to the question: could you send me the snooped log of updating the bootloader? Two people see more than one and perhaps we can eventually manage to do this through libusb too.
I made that log several months ago with another windows machine which is not used lately. I'm not sure log is still exist... if I find it, I'll send it to you (but please don't expect)

probably you may also get log on Windows on VM on Linux. it seems VMware has log function (refer http://vusb-analyzer.sourceforge.net/tutorial.html) or there is "usbmon" function in Linux.

actually I didn't try this way myself so it may be wrong, sorry.
 
tomaszwiniarski
Old
#6  
Junior Member
Thanks Meter 0
Posts: 6
Join Date: Aug 2008
I've tryed a couple of firmwares, cooking my own.
Every time after flashing, tablet shows boot animation and after few seconds display becomes dark.
My investigation led me to following:

Log shows:
Code:
ERROR/Lights(865): write_int failed to open /sys/class/backlight/rk28_button_light/brightness
in /sys/class/backlight I found symlink (rk28_bl):
rk28_bl -> ../../devices/platform/rk28_backlight/backlight/rk28_bl

Shouldn't be there another symlink named r28_button_light ?

I'm using MANTA MID001 from Poland.
 
surfer63
Old
#7  
Member
Thanks Meter 23
Posts: 87
Join Date: May 2010
Location: Zwolle
Quote:
Originally Posted by fun_ View Post
EDIT2:
there is libusb for Windows and OS X. rkflashtool may work on them.
Quote:
Originally Posted by ivop View Post
Good to hear it works for others, too! I have not had a hanging tablet after several writes in one session, but this might depend on the tablet.
I did a couple of successive writes as well from ubuntu.

Quote:
Originally Posted by ivop View Post
Thanks for mentioning that it should also work on other platforms supported by libusb. I'd forgotten to do that.
My main platform is OSX and I immediately added libusb. So far I have not been able to compile rkflashtool despite declaring all kind of CFLAGS, CXXFLAGS and/or LDFLAGS.
Trying a little bit more.
 
ivop
Old
#8  
Junior Member - OP
Thanks Meter 16
Posts: 12
Join Date: Sep 2011
Could you post the compiler warnings/errors here? I might be able to help out.
 
surfer63
Old
(Last edited by surfer63; 16th October 2011 at 02:47 PM.) Reason: attachment missing after preview
#9  
Member
Thanks Meter 23
Posts: 87
Join Date: May 2010
Location: Zwolle
Quote:
Originally Posted by ivop View Post
Could you post the compiler warnings/errors here? I might be able to help out.
I managed to compile it. It took a lot of hurdles. I used the build environment I also use for Hugin for which I'm the OSX maintainer.
I now built a single combined 32/64bit (i386/x86_64) rkflashtool that will run on 10.4.x/10.5.x/10.6.x/10.7.x (building multi-architecture, multi-version binaries/libraries in one binary/library is possible on OSX. I'm not going to explain that here but it's a feature of OSX).

The compiled version is attached. You can also attach it to your first post if you like.
It works fine. I did some reading/writing of images without issues.
Attached Files
File Type: zip rkflashtoolOSX.zip - [Click for QR Code] (60.3 KB, 620 views)
The Following User Says Thank You to surfer63 For This Useful Post: [ Click to Expand ]
 
surfer63
Old
(Last edited by surfer63; 10th December 2011 at 01:46 PM.)
#10  
Member
Thanks Meter 23
Posts: 87
Join Date: May 2010
Location: Zwolle
If you are on OSX and have macports installed, you can do the following to build rkflashtool.
Install libusb from Macports:
Code:
sudo port install libusb
cd into the folder where your rkflashtool.c is is and run the following command:
Code:
gcc -I/opt/local/include -I/opt/local/include/libusb-1.0 \
-L/opt/local/lib -o rkflashtool rkflashtool.c -lusb-1.0 -W -Wall
This will build rkflashtool for your native environment (OSX version, hardware and config).


--- removed the rest of the post as well as the attachments. He/She who is interested in building a complete universal distributable rkflashtool can ask via this thread ---

The Following 3 Users Say Thank You to surfer63 For This Useful Post: [ Click to Expand ]
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes