[TOOL] rkDumper (utility for backup firmware of RockChip's devices)

Search This thread

t-mobile_mda

Senior Member
May 30, 2007
622
31
can i use dump for another same device..? another is dead becasuse of bad fw and i dont fin the correct fw.. but i have working device for recover it..

# This is only part of the command line generated by the utility rkDumper


CMDLINE: mtdparts=rk29xxnand:
0x00004000@0x00000000(EFI_part),
0x00002000@0x00004000(uboot),
0x00002000@0x00006000(trust),
0x00002000@0x00008000(misc),
0x00002000@0x0000a000(dtb),
0x00002000@0x0000c000(dtbo),
0x00000800@0x0000e000(vbmeta),
0x00010000@0x0000e800(boot),
0x00030000@0x0001e800(recovery),
0x00028000@0x0004e800(backup),
0x00002000@0x00076800(security),
0x00070000@0x00078800(cache),
0x00340000@0x000e8800(system),
0x00008000@0x00428800(metadata),
0x00070000@0x00430800(vendor),
0x00020000@0x004a0800(oem),
0x00000400@0x004c0800(frp),
0x0181f3df@0x004c0c00(userdata)


dump info;

Found: LOADER device (RK3308/RK3326/RK3388/PX30 2207:330d) #17

--- Firmware dumping ---


Found LOADER Rockchip device

First 0x0010 NAND blocks reading

"EFI PART" sign found (RKFP FW dump)


Configuration file for RKAndroidTool v.1.xx (8-bit) created
Configuration file for RKAndroidTool v.2.xx (16-bit) created
Partition "EFI_part" (0x00004000) saved (format: RockChip RKFP dump)
Partition "uboot" (0x00002000) saved (format: Rockchip uboot image file)
Partition "trust" (0x00002000) saved (format: unknown)
Partition "misc" (0x00002000) saved (format: unknown)
Partition "dtb" (0x00002000) saved (format: unknown)
Partition "dtbo" (0x00002000) saved (format: unknown)
Partition "vbmeta" (0x00000800) saved (format: unknown)
Partition "boot" (0x00010000) saved (format: Android boot image)
Partition "recovery" (0x00030000) saved (format: unknown)
Partition "backup" (0x00028000) saved (format: unknown)
Partition "security" (0x00002000) saved (format: unknown)
Partition "cache" (0x00070000) saved (format: unknown)
Partition "system" (0x00340000) saved (format: unknown)
Partition "metadata" (0x00008000) saved (format: unknown)
Partition "vendor" (0x00070000) saved (format: unknown)
Partition "oem" (0x00020000) saved (format: unknown)
Partition "frp" (0x00000400) saved (format: unknown)
Partition "userdata" (0x0181f3df) saved (format: unknown)

-- Rockchip device resetting --

Found LOADER Rockchip device

Command to reset sent successfully
 

RedScorpioXDA

Senior Member
Apr 6, 2012
488
302
can i use dump for another same device..? another is dead becasuse of bad fw and i dont fin the correct fw.. but i have working device for recover it..
It depends on many conditions
1. Was there the same firmware on the second device
2. Is the bootloader not corrupted on the second device
3. Is config.txt formed correctly
...
etc.

Of course, I can't give any guarantees (especially considering. that the device was flashed with the "wrong" firmware - most likely the bootloader is damaged).
 

roland deschan

Senior Member
Aug 19, 2012
124
24
POCO X3 GT (Redmi Note 10 Pro 5G)
Rockchip Andoer Z4 rk3368 dump ok. Tx..
 

Attachments

  • Screenshot_20230111_093532.png
    Screenshot_20230111_093532.png
    828.2 KB · Views: 143

seaky77

New member
Feb 23, 2023
2
0
Hi RS, I edited the inf file firstly by adding the required PID VID. This produced an error. So, I modified the line for an existing device (86 and 64) sections instead. this produced the same error. I note there is a security catalogue file. I can see the various PID and VIDs in it. I tried manually editing this as well but the same error occurs.

View attachment 5820529
On Windows 10 or above you can't simply install a modified driver beacuse all the driver has issuer signature protection so if you modify the driver you just brake the signature check.

You have to install it in special boot mode:
- press win+X navigate to "Shutdown" and "Shift+left click" on "restart" options
- in advanced boot menu select "Troubleshoot" option
- in Troubleshoot section select "Advanced options"
- and select "Start-up Settings"
- click restart

- In Startup Settings select "Disable driver signature enforcement" (F7)

Your system will boot into Windows and enables to install unsigned drivers such as this modified usb driver.

Notice:
Every reboot revert back to normal protected state so if you want to install a modified driver you have to boot into special mode as described above.

Good luck,

Seaky
 
Hi, I'm having some trouble extracting the flash contents from an RK3566 device. I've tried a few different versions of the Rockchip Driver Assistant: 4.5 (which did not recognize the RK3566), 4.8, 5.0, and 5.1.1. I'm using rkdumper 1.1.1.0. I've tried connecting to different USB ports on my PC and using different USB cables, but I always get the error "Command to read failed"
I'm attaching debug output from rkdumper as well as the serial console output from the device. Any assistance would be appreciated, thanks!
 

Attachments

  • bootlog.txt
    1.9 KB · Views: 24

RedScorpioXDA

Senior Member
Apr 6, 2012
488
302
Hi, I'm having some trouble extracting the flash contents from an RK3566 device. I've tried a few different versions of the Rockchip Driver Assistant: 4.5 (which did not recognize the RK3566), 4.8, 5.0, and 5.1
Variants:
1. Try adding to 4.5 drivers VID/PID for rk3566 (0x2207/0x350A, if I'm not mistaken). And you can also try a lower version of the drivers
2. If there is a root, try adbDumper (it should work flawlessly)
 
Edited the config.ini in the Rockchip_DriverAssistant_v4.5 folder to:
Code:
[System]
#自定义VendorID和ProductID,值十六进制表示,例:CUSTOM_VID=0x0BB4,CUSTOM_PID=0x0C01
CUSTOM_VID=0x2207
CUSTOM_PID=0x350A
ADVANCED_OPTION=

The board shows up as "Unknown Device" in Device Manager.
If I edit any of the .inf files then the driver won't install (likely due to failing signature checks).
This board is not running Android so I don't think adbDumper will work. For some reason the rkdumper.log file would not attach to my last post, here's the latest log using v4.5 of the driver.
Edit: Ok, it seems I can't attach that at all. Here it is in Pastebin: https://pastebin.com/Tq0qt6Ut
 

RedScorpioXDA

Senior Member
Apr 6, 2012
488
302
THX RedScorpio,
This version see my chip. Found: MASKROM device (RK3308B 2207:3330e)
Unfortunately, a message is: Rockchip device is not in MSC or Loader mode
The motherboard is from a Xiaomi vacuum cleaner, and the bootloader is locked
Option swt and rst not work
Alas, all the commands with which the utility works can be processed by the device only in the MSC or Loader modes
 

lenco2001

New member
Nov 5, 2010
4
0
Is there some other way to add the VID/PID pair to the Rockchip driver installer? Like I said, adding it to the config.ini file doesn't do anything, and editing the INFs prevents the driver from installing at all.
I first installed the 4.5 driver in win10, then on the unknown device I manually selected that modified file with added VID/PID. Got some warnings but installed. Rkdumper is dumping a rk3566 right now

Found: LOADER device (RK3566 2207:350a) #1

--- Firmware dumping ---


Found LOADER Rockchip device

First 0x0010 NAND blocks reading

"EFI PART" sign found (RKFP FW dump)


Configuration file for RKAndroidTool v.1.xx (8-bit) created
Configuration file for RKAndroidTool v.2.xx (16-bit) created
Partition "EFI_part" (0x00004000) saved (format: RockChip RKFP dump)
Partition "uboot" (0x00002000) saved (format: device tree blob DTB)
Partition "skyboot" (0x00100000) saved (format: ext4 image)
Partition "update" (0x00800000) saved (format: unknown)
Partition "rootfs" (0x06a33fdf)
 

Pandoriaantje

Senior Member
Dec 25, 2009
54
28
Samsung Galaxy S10+
Doesn't seem to work for me.
my device is some obscure android box.
Code:
Brand: HDD SAT
Model: HDK100

android reports RK23328, Android HW info app reports RK23318 SOC.
4GB ram 32GB flash.

USB ID from rkdump log:
Code:
2023.05.07 09:21:07    2.10.3    Device #12: Rockusb Device
2023.05.07 09:21:07        VID = 0x2207, PID = 0x320c, REV = 0x9999 (USB 2.0)
2023.05.07 09:21:07        .DEBUG.    SymLink        = "\\?\USB#VID_2207&PID_320C#EA4R1B8R7J#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
2023.05.07 09:21:07        .DEBUG.    DriverKeyName    = "{79dfc2a8-2574-493c-ae71-52958e41dd00}\0000"
2023.05.07 09:21:07        .DEBUG.    Driver version    = 5.11.0.0 (11-10-2020)

As you can see, I have RK drivers 5.11 installed.
AndroidTool/RKDevTool 2.84, will happily dump any range I give it, but rkDumper errors out:

Code:
2023.05.07 09:21:07    Found:    LOADER device (RK3318/RK3328/PX4 2207:320c) #12
2023.05.07 09:21:07    .ERROR.    Command to read failed

1MB RKDevTool 2.84 dump:


Chip info:


Flash ID:


Flash info


unfortunately RKDevTool 2.8.4.0 still hits the 32MB limit.
I'dd like to get a full backup of this device, before experimenting with it, upgrading to ATV 12 (factory is android 10) and sharing with the community, for preservation.
 
Last edited:

Pandoriaantje

Senior Member
Dec 25, 2009
54
28
Samsung Galaxy S10+
Use old version of drivers (4.5)
Thanks, but could you also explain why? Is there any difference in the driver? Will this also fix RKDevTool limitation? You'dd think an updated driver would offer more support, instead of les... why is RKDevTool working, and not rkdump?

It would be nice to actually get a technical explanation, if possible. No offence intended, just currious.

This is my first RK device.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    I presume I have to patch the uboot first for the dump to work, right?
    It is quite likely
  • 17
    rkDumper
    Utility for backup firmware of RockChip's devices


    Version 1.1.1.0 Windows

    1. Makes dump of NAND by partitions according "parameter" information (RKFW/RKAF formats)
    2. Creates config.cfg for RKAndroidTool (1.xx, 2.xx)

    Notes:
    1. All drivers must be installed
    2. Administrator rights are required


    Known bugs:
    -
    Old versions:
    6
    Tested on:
    WinXP (32), WinVista (32), Win7 (32/64), Win10 (64)

    0bb4:2910 MSC device (USB debug off)
    0bb4:0c02 MSC device (USB debug on)

    2207:0000 MSC device (USB debug off)
    2207:0010 MSC device (USB debug on)

    2207:350A RK3566 x88 Pro
    2207:330D RK3308/RK3326/RK3388/PX30 Evoo EV-A-81-8-1
    2207:330C RK3399/PX6 CSA96
    2207:330A RK3368/PX5 Artway X6/HCT MTCD (Car head unit) SOM
    2207:320C RK3318/RK3328/PX4 A5X Plus mini
    2207:320B RK3229 MXQ 4K
    2207:320A RK3288 Jesurun T034
    2207:310D RK3126 Proscan PLT9650G
    2207:310C RK3128 CS918-rk3128
    2207:310B RK3188/PX3 PIPO Max M9 Pro
    2207:301A RK3036 Wecast E8
    2207:300B RK3168 Starmobile Engage7+
    2207:300A RK3066/PX2 UG802
    2207:292C RK3026/RK3028 ONYX BOOX C67SML COLUMBUS/?
    2207:292A RK2928 Lexibook Tablet Master 2
    2207:290A RK2906 TeXeT TB-138
    2207:281A RK2818 ChinaLeap M3


    If you have another Rockchip SoC send me result of "rkDumper scan" and name of device. I'II send you personal version for test
    4
    Hi everyone!

    I've made a breakthrough on dumping devices that have a 32mb limit or dump `CC` `CC` `CC`. It turns out this "read protect" function is actually implemented in uboot. The uboot partition is typically in the first 32mb, so you should have no problem dumping it and it is possible to edit out the 32mb limit and flash the uboot partition back.

    Here's how I did it:

    First of all, I could not have figured this out if it weren't for DorianRudolph on github, who documented installing linux on a PineNote, which happens to have the same RK3566 chip I've been struggling with. They figured out where in the source code rockchip implements this, so they unpack the uboot.bin from uboot.img, disassemble it, and find that function. They patche it to always jump to a certain location instead of spitting out `CC`. The result is the chip behaves like all rockchip socs before it.

    After looking at my uboot.bin versus theirs, I figured out we're running different versions of uboot, and I couldn't use their uboot image, or their scripts without modification. I dumped as much as I could with rkdumper, then took uboot.img, edited uboot_img.py to point to my img file and ran it. It spit out uboot.bin.

    I downloaded and installed ghidra, created a project, imported uboot.bin, set its language as AARCH64 V8A little-endian. Double click to decompile, then go looking for something that looks like this picture, or in my case, like this. Then patch the `b.ls` instruction to be a `b` instruction. I found the easiest way to find the correct function was to search for `FD 7B BE A9 FD 03 00 91 ?? 18`. There were a ton of functions that started with the same 8 btes, which is probably like "push the stack" or something, but there were only two that used `0x18` as the parameter for the `ldr` instruction.

    After patching it with ghidra I took the uboot.img, put it in a directory with uboot_img.py, edited it to comment out `check_hash_and_dump()` and run patch();, edit lines 29 and 30 to match the size and positon of uboot.bin. The `sz` is the size in bytes, in hex. The `pos` can be found by running `dtc -I dtb -O dts uboot.img`

    That's pretty much it. I used RkDevTool to flash the modified uboot, by right clicking the first screen, hitting load config, choose the config output by rkDumper, hit dev partition, then check the checkbox to the left of uboot, click the blank space to the right of uboot, choose your uboot.img, and hit Run.

    Next time you boot into LOADER mode, you'll be able to dump all partitions!
    4
    This happens as a result of "unsure" reading.
    Try
    - change the cable (preferably short and thick)
    - exclude USB hubs (if used)
    - change the USB socket (preferably on the back of the computer)
    - change the USB version (2.0 instead of 3.0)
    - use a different computer

    No

    Hi @RedScorpioXDA,
    Thanks again for your reply.

    I have confirmed the issue is not hardware, the issue is rkdumper is incompatible with rockchip driver greater than 4.5 - 4.91 is latest as of writing.


    • By installing driver version 4.3. - Rockchip_DriverAssistant_v4.3 - was able to dump images with rkdumper v1.08.
    • Just to clarify - Rockchip Driver assistant version 4.5 on do not work with Rkdumper.

    This was first identified by @nalor in post 85 (thanks @nalor!) here: https://xdaforums.com/showpost.php?p=78805354&postcount=85

    Would you please update your first post with this information - known bugs?
    2
    Hi! Just tried to backup my new Onyx Boox Poke Pro and failed at the beginning with the following message:

    Code:
            Found:  LOADER device (RK3288 2207:320a) #5
    
            --- Firmware dumping ---
    
    
            Found LOADER Rockchip device
    
            First 0x0010 NAND blocks reading
    
            Command to read failed
    
            -- Rockchip device resetting --
    
            Found LOADER Rockchip device
    
            Command to reset failed

    I'm using Windows 10 x64 as operating system.

    Finally I noticed the problem came from the used driver - I used the most recent 'Driver Assistant 4.7' directly from the github rockchip site and it's not working with this one.
    I tried all 'Driver Assistant 4.x' beginning with 4.1 and the backup is working without problems up to DriverAssistant 4.5 - but beginning with DriverAssistant 4.6 it's failing with the error message above.

    I don't know if this problem also occurs for other devices and or chipsets, but at least my device with the Rockchip RK3288 requires to downgrade to 'Driver Assistant 4.5' or lower.

    Maybe it would be a good idea to include the driver-version into the output of rkDumper?