[TOOL] rkDumper (utility for backup firmware of RockChip's devices)

Search This thread
By:
Advanced…
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
rkDumper
Utility for backup firmware of RockChip's devices

Version 1.1.1.0 Windows

1. Makes dump of NAND by partitions according "parameter" information (RKFW/RKAF formats)
2. Creates config.cfg for RKAndroidTool (1.xx, 2.xx)

Notes:
1. All drivers must be installed
2. Administrator rights are required

Known bugs:
-
Old versions:
 

Attachments

  • rkDumper_1.1.1.0.zip
    69.5 KB · Views: 10,098
  • updater_1.0.0.4.zip
    317.3 KB · Views: 5,614
Last edited:
  • Like
Reactions: gl3nborj, roland deschan, drggong and 14 others
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
Tested on:
WinXP (32), WinVista (32), Win7 (32/64), Win10 (64)

0bb4:2910 MSC device (USB debug off)
0bb4:0c02 MSC device (USB debug on)

2207:0000 MSC device (USB debug off)
2207:0010 MSC device (USB debug on)

2207:350A RK3566 x88 Pro
2207:330D RK3308/RK3326/RK3388/PX30 Evoo EV-A-81-8-1
2207:330C RK3399/PX6 CSA96
2207:330A RK3368/PX5 Artway X6/HCT MTCD (Car head unit) SOM
2207:320C RK3318/RK3328/PX4 A5X Plus mini
2207:320B RK3229 MXQ 4K
2207:320A RK3288 Jesurun T034
2207:310D RK3126 Proscan PLT9650G
2207:310C RK3128 CS918-rk3128
2207:310B RK3188/PX3 PIPO Max M9 Pro
2207:301A RK3036 Wecast E8
2207:300B RK3168 Starmobile Engage7+
2207:300A RK3066/PX2 UG802
2207:292C RK3026/RK3028 ONYX BOOX C67SML COLUMBUS/?
2207:292A RK2928 Lexibook Tablet Master 2
2207:290A RK2906 TeXeT TB-138
2207:281A RK2818 ChinaLeap M3


If you have another Rockchip SoC send me result of "rkDumper scan" and name of device. I'II send you personal version for test
 
Last edited:
  • Like
Reactions: Flareonz, dijitalxyz, #Vangreen and 3 others
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
rkDumper
Utility for backup firmware of RockChip's devices

New version (0.92 Windows) ready

! pre-Release #2;
~ "4GB" bug fixed;
+ support of "USB debug on" mode added;
+ support of RK3026 added;
+ support of RK2906 added;
+ support of VID=0bb4 (HTC? Rockchip devices) added.
 
  • Like
Reactions: NEOCRIVI
N

nevoz

Member
Aug 10, 2010
15
2
Hello,

I have run your utility, but the file sizes of the output differ compared to when I use rktool 2.1 (with finless instructions).

Here's the scan..

Code: 
C:\temp\1>rkDumper.exe scan

        rkDumper (version 0.92)
        Utility for Rockchip's firmware backup

        (c) RedScorpio, Moscow, 2014
            RedScorpio@land.ru

        ==========================[ START ]==========================

        -- Devices emumerating --

        Devices table (found 8 USB devices):
        1       Device #0: USB Root Hub
        2       Device #1: USB Root Hub
        3       Device #2: USB Root Hub
        4       Device #3: USB Root Hub
        4.1     Device #4: BT-253
                VID = 0x0b05, PID = 0xb700
        5       Device #5: USB Root Hub
        5.2     Device #6: USB Composite Device
                VID = 0x2207, PID = 0x0010
                        Disk    #1
        5.8     Device #7: USB Composite Device
                VID = 0x04f2, PID = 0xb071

        ==========================[ STOP  ]==========================

Thank you.
 
W

wertzPH

Senior Member
May 27, 2012
166
28
here's is mine.

C:\RKDumper>rkdumper scan

rkDumper (version 0.92)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014
RedScorpio@land.ru

==========================[ START ]==========================

-- Devices emumerating --

Devices table (found 7 USB devices):
1 Device #0: USB Root Hub
1.1 Device #1: USB Hub
VID = 0x8087, PID = 0x0024
1.1.1 Device #2: XBOX 360 Controller For Windows
VID = 0x045e, PID = 0x028e
1.1.2 Device #3: Rockusb Device
VID = 0x2207, PID = 0x300b
1.1.4 Device #4: USB Composite Device
VID = 0x09da, PID = 0x90a0
2 Device #5: USB Root Hub
2.1 Device #6: USB Hub
VID = 0x8087, PID = 0x0024

==========================[ STOP ]==========================
 
  • Like
Reactions: dijitalxyz
W

wertzPH

Senior Member
May 27, 2012
166
28

Attachments

  • 10559715_258587021003849_4518843307206375466_n.jpg
    10559715_258587021003849_4518843307206375466_n.jpg
    31.2 KB · Views: 4,281
  • Like
Reactions: RedScorpioXDA
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
rkDumper
Utility for backup firmware of RockChip's devices

New version (0.93 Windows) ready

! pre-Release #3;
+ support of RK3168 added;
+ administrator's rights checking added.
 
N

niabi

Senior Member
May 3, 2008
229
32
rkDumper (version 0.93)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014
RedScorpio@land.ru

==========================[ START ]==========================

-- Devices enumerating --

Devices table (found 10 USB devices):
1 Device #0: USB Root Hub
1.1 Device #1: USB Composite Device
VID = 0x045e, PID = 0x00db
1.2 Device #2: USB Input Device
VID = 0x046d, PID = 0xc05a
2 Device #3: USB Root Hub
3 Device #4: USB Root Hub
3.5 Device #5: Rockusb Device
VID = 0x2207, PID = 0x292c
4 Device #6: USB Root Hub
5 Device #7: USB Root Hub
6 Device #8: USB Root Hub
7 Device #9: USB Root Hub

==========================[ STOP ]==========================


this is mine, and when I try to do "dump" I get:

rkDumper (version 0.93)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014
RedScorpio@land.ru

==========================[ START ]==========================

--- Firmware dumping ---

The utility requires administrator rights

==========================[ STOP ]==========================

I am an administrator, and the device is a RK3026

also, is there a way to dump the loader of these tablets?

Thanks
 
N

nalor

New member
May 14, 2009
3
2
Kudos to RedScorpio!

Great work RedScorpio!
It never hasn't be that easy to create a dump for rockchip devices!

But I still see some room for improvements and also have some questions:
Can I create a full dump of a device including the user partition? I appreciate to create full dumps - so I can play with my devicesm flash different firmwares and finally I'm able to restore everything to the former state - in case it's not possible to create a full dump at the moment it would be great if you could add it!

Another great addition would be if you could simplify the installation of the drivers in windows 8.1 - please take a look at this post: http://xdaforums.com/showpost.php?p=55529498&postcount=56

Basically Microsoft decided to change the behaviour of the usb stack in windows 8.1 and so it's not possible to install the rockchip driver that easily - you need to figure out 3 details of your device and create an exception-rule in the windows registry so your device is handled as it has been with the previous usb stack.
To create this registry key you'll need VID, PID and REV from the usb device - maybe you can display REV also in your output of 'scan' ? (windows device manager don't even display those details...)
Finally it would be great if you could create this registry key automatically (or with another command) in case you notice that the os is windows 8.1 and the device isn't recognized properly - in my case I'll get the following output when I connect my rockchip device without the registry entry:

C:\Users\roland\Desktop\Rockchip Tools\rkDumper_093>rkDumper.exe scan

rkDumper (version 0.93)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014
RedScorpio@land.ru

==========================[ START ]==========================

-- Devices enumerating --

Devices table (found 11 USB devices):
1 Device #0: USB Root Hub
1.1 Device #1: USB Hub
VID = 0x8087, PID = 0x8009
2 Device #2: USB Root Hub
2.4 Device #3: USB Hub
VID = 0x0424, PID = 0x2514
2.4.1 Device #4: USB-Eingabegerät
VID = 0x1bcf, PID = 0x0005
2.4.2 Device #5: USB-Verbundgerät
VID = 0x045e, PID = 0x00db
2.11 Device #6: Unbekanntes USB-Gerät (Fehler beim Anfordern einer Gerätebeschreibung.)
VID = 0x2207, PID = 0x290a
2.14 Device #7: USB-Verbundgerät
VID = 0x041e, PID = 0x30df
2.15 Device #8:
3 Device #9: USB Root Hub
3.1 Device #10: USB Hub
VID = 0x8087, PID = 0x8001

==========================[ STOP ]==========================


I've also attached my debug-log so you can check how to identify a blocked device - the hardware id is displayed as 'USB\DEVICE_DESCRIPTOR_FAILURE' in device manager in windows.

After creating the registry key as explained in the linked post above everything is working fine in windows 8.1, the drivers get installed and I can create a dump with your tool :good:

Finally it would great if you could add an automatic request for administrative permissions in your application - I think this would simplify the execution a little bit more.

Keep up the good work!
 

Attachments

  • rkDumper.txt
    27.2 KB · Views: 947
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
nalor said:
Can I create a full dump of a device including the user partition?
Click to expand...
Click to collapse
I still can't find a simple method of determining the full size of the NAND (it need to count user partition size)

nalor said:
To create this registry key you'll need VID, PID and REV from the usb device - maybe you can display REV also in your output of 'scan' ?
Click to expand...
Click to collapse
I have used USB_DEVICE_DESCRIPTOR for detection VID and PID:
Code: 
typedef struct _USB_DEVICE_DESCRIPTOR {
  UCHAR  bLength;
  UCHAR  bDescriptorType;
  USHORT bcdUSB;
  UCHAR  bDeviceClass;
  UCHAR  bDeviceSubClass;
  UCHAR  bDeviceProtocol;
  UCHAR  bMaxPacketSize0;
  USHORT idVendor;
  USHORT idProduct;
  USHORT bcdDevice;
  UCHAR  iManufacturer;
  UCHAR  iProduct;
  UCHAR  iSerialNumber;
  UCHAR  bNumConfigurations;
} USB_DEVICE_DESCRIPTOR, *PUSB_DEVICE_DESCRIPTOR;
So what is revision in this structure?

nalor said:
Finally it would great if you could add an automatic request for administrative permissions in your application
Click to expand...
Click to collapse

Sorry, I'm not a programmer. I can't find example for C (CodeBlocks + gcc)
 
Last edited:
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
rkDumper
Utility for backup firmware of RockChip's devices

New version (0.94 Windows) ready

! pre-Release #4;
+ support of RK3288 added;
+ manifest file added;
+ detection of device revision added;
~ administrator's rights checking algorithm changed.
 
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
rkDumper
Utility for backup firmware of RockChip's devices

New version (0.95 Windows) ready

! pre-Release #5;
+ support of RK3128 added;
+ /user key added;
+ ROM size/vendor/ID determinetion added ("info" command);
~ bug of incorrect determination of disks in multi-CD systems fixed.
 
Last edited:
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
307
rkDumper
Utility for backup firmware of RockChip's devices

New version (1.00 Windows) ready

! Release;
+ /incl key added;
+ /excl key added;
~ some algorithms improved.
 
You must log in or register to reply here.

Similar threads

B
[TUT]MTK Android (Sp flash tool ) tutorial
Replies
1K
Views
2M
tavoc
tavoc
R
[TOOL] imgRePackerRK (RockChip's firmware images unpacker/packer)
Replies
463
Views
320K
F
fedessgl
I
  • Locked
all in one sim unlock tool
Replies
1K
Views
1M
the-equinoxe
the-equinoxe
A
[Tool] SP Flash Tool New Version v5.1352.01
Replies
104
Views
655K
R
rxf2g
DR_MOOSAVI
[Tool]SP FlashTool ||MTK Android FLASHER
Replies
109
Views
667K
X
xchaoling

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 1
    R
    RedScorpioXDA
    mobifixit said:
    but all the partitions are filled with CC CC except BOOT ,UBOOT AND TRUST and i cant find that magic bytes to patch FD 7B BE A9 someone have a easier method?
    Click to expand...
    Click to collapse

    Pay attention to the message

    TBM 13 said:
    Then, I opened my stock uboot.bin in the hex editor, searched for `81 00 01 8B 24 00 02 8B 9F 40 40 F1 49 01 00 54` and in that sequence replaced `40 40` with `00 60`, saved, repacked, flashed and done! I don't know whether this sequence is present in most uboots or just mine. Maybe you could research this @RedScorpioXDA , because if that's the case you could maybe automate this process in your tool.

    Also please note that if you use Rockchip's AndroidTool to dump, use an old version like v2.38 as newer ones also deny dumping after 32 MB.
    In case it's helpful to anyone, I'm documenting the research of my Rockchip device on GitHub
    Click to expand...
    Click to collapse
    View
    1
    R
    RedScorpioXDA
    blakegriplingph said:
    If I unpack uboot.img using your tool it spits out a uboot.bin and two other blank files named uboot_1.bin and uboot_3.bin
    Click to expand...
    Click to collapse
    I don't know which version of imgRePackerRK you are using. I'm using the latest test version 1.0.7.7
    At the same time, there are no additional files
    blakegriplingph said:
    but if I repack it, the uboot image isn't packed in the same way as stock and thus my tablet either hangs up on the logo or refuses to power on at all unless I force it into maskrom mode and flash the stock uboot back.
    Click to expand...
    Click to collapse
    Quite a likely result, 4 bytes appeared in the boot header, the purpose of which is unknown to me (perhaps it does not matter). Therefore, the reverse packaging does not give an exact match (the difference is just for these 4 bytes).

    The sequence "81 00 01 8B 24 00 02 8B 9F 40 40 F1 49 01 00 54" is located at 0xfbfc of uboot.bin
    View
    1
    R
    RedScorpioXDA
    blakegriplingph said:
    If you compare the stock uboot to a repack of it the other copies of uboot are missing on the repack hence why they're quite different
    Click to expand...
    Click to collapse
    ==>
    RedScorpioXDA said:
    Quite a likely result, 4 bytes appeared in the boot header, the purpose of which is unknown to me (perhaps it does not matter). Therefore, the reverse packaging does not give an exact match (the difference is just for these 4 bytes).
    Click to expand...
    Click to collapse
    View
    1
    R
    RedScorpioXDA
    blakegriplingph said:
    Alright, I can confirm that repacking uboot using the latest test version only results in changing just the four bytes you mentioned. To be doubly sure I also tried hex-editing uboot.bin and repacking it, and it all turned out good. ;)
    Click to expand...
    Click to collapse
    Is the device being downloaded? Is the firmware being dumped?
    View
  • 17
    R
    RedScorpioXDA
    rkDumper
    Utility for backup firmware of RockChip's devices

    Version 1.1.1.0 Windows

    1. Makes dump of NAND by partitions according "parameter" information (RKFW/RKAF formats)
    2. Creates config.cfg for RKAndroidTool (1.xx, 2.xx)

    Notes:
    1. All drivers must be installed
    2. Administrator rights are required

    Known bugs:
    -
    Old versions:
    View
    6
    R
    RedScorpioXDA
    Tested on:
    WinXP (32), WinVista (32), Win7 (32/64), Win10 (64)

    0bb4:2910 MSC device (USB debug off)
    0bb4:0c02 MSC device (USB debug on)

    2207:0000 MSC device (USB debug off)
    2207:0010 MSC device (USB debug on)

    2207:350A RK3566 x88 Pro
    2207:330D RK3308/RK3326/RK3388/PX30 Evoo EV-A-81-8-1
    2207:330C RK3399/PX6 CSA96
    2207:330A RK3368/PX5 Artway X6/HCT MTCD (Car head unit) SOM
    2207:320C RK3318/RK3328/PX4 A5X Plus mini
    2207:320B RK3229 MXQ 4K
    2207:320A RK3288 Jesurun T034
    2207:310D RK3126 Proscan PLT9650G
    2207:310C RK3128 CS918-rk3128
    2207:310B RK3188/PX3 PIPO Max M9 Pro
    2207:301A RK3036 Wecast E8
    2207:300B RK3168 Starmobile Engage7+
    2207:300A RK3066/PX2 UG802
    2207:292C RK3026/RK3028 ONYX BOOX C67SML COLUMBUS/?
    2207:292A RK2928 Lexibook Tablet Master 2
    2207:290A RK2906 TeXeT TB-138
    2207:281A RK2818 ChinaLeap M3


    If you have another Rockchip SoC send me result of "rkDumper scan" and name of device. I'II send you personal version for test
    View
    6
    P
    pseudolobster
    Hi everyone!

    I've made a breakthrough on dumping devices that have a 32mb limit or dump `CC` `CC` `CC`. It turns out this "read protect" function is actually implemented in uboot. The uboot partition is typically in the first 32mb, so you should have no problem dumping it and it is possible to edit out the 32mb limit and flash the uboot partition back.

    Here's how I did it:

    First of all, I could not have figured this out if it weren't for DorianRudolph on github, who documented installing linux on a PineNote, which happens to have the same RK3566 chip I've been struggling with. They figured out where in the source code rockchip implements this, so they unpack the uboot.bin from uboot.img, disassemble it, and find that function. They patche it to always jump to a certain location instead of spitting out `CC`. The result is the chip behaves like all rockchip socs before it.

    After looking at my uboot.bin versus theirs, I figured out we're running different versions of uboot, and I couldn't use their uboot image, or their scripts without modification. I dumped as much as I could with rkdumper, then took uboot.img, edited uboot_img.py to point to my img file and ran it. It spit out uboot.bin.

    I downloaded and installed ghidra, created a project, imported uboot.bin, set its language as AARCH64 V8A little-endian. Double click to decompile, then go looking for something that looks like this picture, or in my case, like this. Then patch the `b.ls` instruction to be a `b` instruction. I found the easiest way to find the correct function was to search for `FD 7B BE A9 FD 03 00 91 ?? 18`. There were a ton of functions that started with the same 8 btes, which is probably like "push the stack" or something, but there were only two that used `0x18` as the parameter for the `ldr` instruction.

    After patching it with ghidra I took the uboot.img, put it in a directory with uboot_img.py, edited it to comment out `check_hash_and_dump()` and run patch();, edit lines 29 and 30 to match the size and positon of uboot.bin. The `sz` is the size in bytes, in hex. The `pos` can be found by running `dtc -I dtb -O dts uboot.img`

    That's pretty much it. I used RkDevTool to flash the modified uboot, by right clicking the first screen, hitting load config, choose the config output by rkDumper, hit dev partition, then check the checkbox to the left of uboot, click the blank space to the right of uboot, choose your uboot.img, and hit Run.

    Next time you boot into LOADER mode, you'll be able to dump all partitions!
    View
    4
    marchnz
    marchnz
    RedScorpioXDA said:
    This happens as a result of "unsure" reading.
    Try
    - change the cable (preferably short and thick)
    - exclude USB hubs (if used)
    - change the USB socket (preferably on the back of the computer)
    - change the USB version (2.0 instead of 3.0)
    - use a different computer

    No
    Click to expand...
    Click to collapse

    Hi @RedScorpioXDA,
    Thanks again for your reply.

    I have confirmed the issue is not hardware, the issue is rkdumper is incompatible with rockchip driver greater than 4.5 - 4.91 is latest as of writing.


    • By installing driver version 4.3. - Rockchip_DriverAssistant_v4.3 - was able to dump images with rkdumper v1.08.
    • Just to clarify - Rockchip Driver assistant version 4.5 on do not work with Rkdumper.

    This was first identified by @nalor in post 85 (thanks @nalor!) here: https://xdaforums.com/showpost.php?p=78805354&postcount=85

    Would you please update your first post with this information - known bugs?
    View
    2
    N
    nalor
    Hi! Just tried to backup my new Onyx Boox Poke Pro and failed at the beginning with the following message:

    Code: 
            Found:  LOADER device (RK3288 2207:320a) #5

        --- Firmware dumping ---


        Found LOADER Rockchip device

        First 0x0010 NAND blocks reading

        Command to read failed

        -- Rockchip device resetting --

        Found LOADER Rockchip device

        Command to reset failed

    I'm using Windows 10 x64 as operating system.

    Finally I noticed the problem came from the used driver - I used the most recent 'Driver Assistant 4.7' directly from the github rockchip site and it's not working with this one.
    I tried all 'Driver Assistant 4.x' beginning with 4.1 and the backup is working without problems up to DriverAssistant 4.5 - but beginning with DriverAssistant 4.6 it's failing with the error message above.

    I don't know if this problem also occurs for other devices and or chipsets, but at least my device with the Rockchip RK3288 requires to downgrade to 'Driver Assistant 4.5' or lower.

    Maybe it would be a good idea to include the driver-version into the output of rkDumper?
    View

New posts