[Official] HSG (X5A/X6) & Pandawill G11 rooting/dev thread (SetCPU & Root working!)

[Official] HSG (X5A/X6) & Pandawill G11 rooting/dev thread (SetCPU & Root working!)

Chinese-manufactured devices, with Korean cpu.. The midX5a / midx6 are both Telechips-based tablets. They're very similar to the Augen device, except they have the actual HDMI port, 300M /data, correct /cache size and a 3.5" headphone jack

The Pandawill G11 seems to be a rebranded version of this hardware using the same firmware(s).
Note: There are older versions of this hardware with no HOME/MENU/BACK buttons, running WinCE. These cannot be upgraded to Android as far as we know right now.

TODO / What's not working: (Updated 24/8/2010)
- Add more languages (like Dutch!)
- Cleanup included languages (Georg77cz is working on cz/cs translation.)
- Find out how to increase /data to the full 3.3GB that's available on internal NAND (hexedit LK.ROM?)
- SetCPU (fc's after moving slider) Working! See attachment![/strike]
- Can't seem to enter recovery by hardware buttons Working, connect USB and use Rom Manager to reboot into recovery!
- Unpack tcc_8900mtd files Naobsd figured it out, thanks!
- Unpack system.img Naobsd figured out to patch unyaffs!
- Repack system.img Naobsd released tools for this.
- Unpack boot IMG, figure out base & pagesizes (4096 page size, base 0x40000000)
- Custom recovery - We have Clockworkmod working as of 20-8!
- Can't boot into recovery from ADB - (From firmware #348 this is fixed..)
- Factory defaults (Works in #348 and wipes properly using the recovery reboot.)


What's working: (As of firmware release #348)
- Custom recovery (Clockworkmod)
- Calibration (You must hold the stylus at the spot for some time.)
- Rooted!
- Telechips FWDN firmware recovery (via WinXP/2K)
- Telechips USB host booting method with empty(!) nand
- Rotation with 'RotateD' from market
- YouTube HD (Just push the Evo4G Youtube.apk)


Note there are similar models. Visit the HSG website and note the right side button spacing/placement.
Link: HSG Website

The model this topic is about, has the buttons spaced across the right side.
The other model that is not from HSG appears to be non-available from China sellers right now, or not in production yet for unknown reason. (sensor rumours)

Another third model has popped up, it's basically the same hardware in APAD casing with metal back plate.

I moved this thread over here from Slatedroid since it got filled with non-dev talk, and thier hosting keeps going offline. I hate it when i can't backtrack to my own findings

Specs/Facts:
- MIDX6 has on-board rotation sensor, but it's apparently not working in the firmware yet.
- MIDX6 has optional 3G / GPS inside
- MIDX5A is the basic model with no sensor/3G/GPS. (The rest is the same.)
- CPU Runs at 720Mhz stock
- Has HDMI port
- Has a normal 3.5" jack for headphones
- One speaker, and one microphone inside.
- Runs Android 2.1 eclair-update1
- No GPS/3G/Orientation sensor inside
- Linpack score around 4.9 with no mods / clean os.
- Metal top body, plastic bottom
- Mine came with 2x 1300mA battery inside!
- Battery lasts really long, i can run for ~6-7 hours at work with wifi on.

Quick review
I've used the device for about 3 days now with firmware #297, and it's very fast to use & works like a charm. It has a very solid build quality with a metal top on a thick plastic bottom, making it feel like a quality product. Market worked out-of-the-box with no fuss or hacks. Touchscreen is responsive, but resistive. If you want to slide, push down your finger first, then slide (don't hit-and-run or do a driveby with you finger on the screen).

Battery life is pretty damn good. I've been using it for at least 6-7 hours in one go, with wifi while debugging and ADB and such. The screen is nice & bright, and even if it's a resistive screen it works OK. The main reason for an initial slow reaction from the screen, is that the CPU is downclocked to 36Mhz when you are not doing anything. Edit: This is sorted with SetCPU 2.01! After the first wipe/slide it goes up to 720Mhz.(Yes, that's 120 Mhz more than the Augen!)

Note to posters: Please keep this thread clean. If it's not about rooting or dev, do not post it here please. Thank you!

Post reserved for updates:

Root updated (20-11-2010)
Updated One-click root for #348 and lower.
Download here
This also works with the newer revisions of this tablet with g-sensor

Recovery now working! (20-8-2010, requires #348)
See This Topic for working recovery files.

Steps for flashing with FWDN in USB mode (16-08-2010) (Thanks @fun_ & GeorgCZ for testing!)
(more details will follow)
- Figure out your device serial number and /data/softmac. Store it. (easiest to do, is flash same firmware, FWDN shows it)
- Option #1: You are on V7 (@205, #270, #297, #320) ? Use FWDN mode, and just flash it, format entire nand between different versions!
- Option #2: You are on V6 (WINCE) firmware ? Use use the internal switch to set USB host mode. Place tcBoot.rom in fwdnv7 folder
- When going from V6 to V7 firmware, you will need to erase the entire flash with the dropdown box.
- Plug in when asked, the device will boot with the USB boot mode. Then flash your firmware.
- It's almost impossible to kill the device. The CPU will boot in USB host boot mode if you erase the nand completely!


(In)Compatible USB devices (13-08-2010)
- Keyboards
- Mice
- Wifi USB/Keyboard (as long as they are USB HID devices with no drivers)
- CSR Bluetooth: Not working (no driver in kernel)
- UVC webcams: Not working (no driver in kernel)


SAFE MODE boot (12-08-2010)
This is a special mode if you screwed up something and can't get in the OS because of force-closes in an bad-behaving app that you installed..
- Ensure no power is plugged in
- Press the centre of the touchscreen, & keep it pressed.
- Power on the device as normal. Don't let go of the touchscreen..
- You're now in Safe mode! (a message should be in the bottom left corner stating so.)

Exact steps for flashing with FWDN (12-08-2010) (Thanks @fun_!)
- Power off the unit
- Unplug USB
- Plug in the AC adapter
- Firmly touch the touchscreen
- Power on the unit
After a while you'll notice it stays at the boot splash screen, then you can plug in the USB cable and fire up FWDN.

Google maps update failure fix (11-08-2010)
Connect using ADB and issue the following commands:
Now you can install the new Google Maps version from the Market.
(If not, just reboot the device & try again.)

Extract kernel from boot.img (11-08-2010) (Thanks @geoRG77!)
You can extract the contents using split_bootimg.pl (needs linux+perl installation.)
http://android-dls.com/files/linux/split_bootimg.zip
This also works on tcc8900_mtd.img, since boot.img is near the start of this file. Need to DD of some bytes
(Note that system.img and others are also inside this MTD dump, it's for flashing the whole nand area in one go in the FWDN software.)

Modified INF file for ADB driver:
]usb_inf_X5A.zip
How to:
- Enable USB debugging
- Install the driver from my usb_inf_X5A.zip (2k/xp/32 bits)
- Unzip root_setcpu_X5A.zip into C:\rootfiles
- Start a command prompt and do cd /rootfiles, then root.bat
- You should get no errors, and after the reboot, your X5A should be rooted.
- Note, SetCPU does not seem to work properly.

Firmware layout #297 7-10-2010
Here's /proc/mtd output from #297 rom:

Firmware layout #348 7-10-2010
Firmware layout #205 18-10-2010

Warning: Each device has a unique serial. Do not select to overwrite it in the 'Tools - Options' menu!!
It is strongly advised to write down your serial after doing a basic FWDN flash, in case of emergency!

Firmwares
Below you'll find a fast mirror for the current firmwares:
(Do a Right-click, save as.. these are 7zip compressed, get it at www.7zip.com)

Firmware #205 (0730) - No market, pretty bland rom.
Firmware #297 (0803) - Works stable, has market.
Firmware #348 (0816) - First rom with recovery booting, but no keys work to select options

We don't know how to repack or unpack them yet. LK.rom seems to hold the MTD layout inside. If anyone figures out how to unpack/repack these files, please let us know.

19-8-2010: User fun_ figured out, we need to flash lk.rom as a single file, and then reboot to have new partitions used


Firmware Updating
There are two modes in which you can update the firmware.
The first mode is basic FWDN mode. The second mode with a blank nand is a factory USB host mode boot, that works even if the nand was completely erased by accident, or empty at the production line.

Warning: Each device has a unique serial. Do not select to overwrite it in the 'Tools - Options' menu!!
It is strongly advised to write down your serial after doing a basic FWDN flash, in case of emergency!

Basic FWDN is also outlined in the Chinese document:
http://www.zonko.nl/files/tcc/CBS7001 Android Instructions v1.01.pdf
Use it a basis for upgrading in this mode.

Basic FWDN mode
This is triggered by the following procedure, and the standard way to upgrade these devices:

Tablet side:
- Unplug tablet from the PC!
- Power off the tablet. Insert the power plug (required!)
- Press & hold finger on the touch screen, and then press & hold the powerbutton.
- The tablet powers up, and remains on the splash screen.

PC Side:
- Install the VTC drivers on your PC (tested OK on Win7 & WinXP 32 bit)
- Set up FWDN before plugging in the tablet
- Optional: Browse & add LK.ROM as a single file when coming from another partition layout, flash and reboot the tablet afterwards, then do the steps below. (You can skip this step, if you are staying on the same MTD layout i.e. flashing the same firmware revision you are on.)
- Browse & add the LK.ROM file.
- Browse & add the tcc8900_mtd.img file.
- Ensure no options are selected in the Tools - Options menu or you loose the mac/serial!
- Plug the tablet into USB
- Click the Nand area map and create a FAT partition for the remaining space.
- Yes, thats 'click on the square below the text' where it shows the block See this picture.
- If you're going to a different MTD layout, choose 'low format' in the dropdown.
- Click Start, and patiently wait.

USB Host boot mode
19-8-2010: No longer needed!
Fun_ figured out the LK.ROM holds the partition info. So if you're coming from another layout, simply flash LK.ROM first. The below procedure remains as a service for those that accidently bricked the device.

This mode is triggered when you erase the entire flash by accident, or when you put the switch on the mainboard inside your tablet to the other position.

You will need to add a bootrom to the FWDN folder where the .exe for FWDN resides. You can get that bootrom from here.

In this mode, the tablet will boot when connected by USB to the PC and init the cpu. After that, it can be flashed the same way as above. In this case you'll need to fiddle with the settings under 'Tools - Options' to set back the serial to what it was before the 'accident'.

If you desire, WinCE can be flashed in this way, if you kill the nand using flash_eraseall under Android..

I tried to repack the recovery.img using all the methods outlined here:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

They all produce an image that looks fine in a hex editor at first glance, but fails to boot on a real device (After flashing it with flash_image recovery /sdcard/recovery.img for example)

I'm pretty sure there's a TTL serial port in the device, but i'll need some time to sort that out. I asked Koush for help, perhaps he can see what is wrong with the image.

Please read & follow the steps in the second post. Low-format to get the new MTD layout.

Also, please keep this a dev topic. This is not HSG customer support

First, credits to Koush for his amazing recovery, the Android scene would be completely different if it wasn't for you!

Second, i wonder who @google thought it would be a great idea to force a huge download of 4.5GB + apps needed to compile a 13kb mkbootimg.
Anyway, with some files from someone else's kitchen (only 15mb download) i managed to compile mkbootimg with the new --pagesize parameter from Koush.
(This recovery's kernel --base 40000000 and requires --pagesize 1000 to work properly.)

I've updated the second post with the working recovery.
Also the one-click root.bat is back.

Enjoy your weekend!

Recovery is now working thanks to Georg77cz who provided unmissable help with testing this!
Check http://twitter.com/Asure007 for some pics. I'll upload the recovery tomorrow. For now, only confirmed to work on #348 roms! (older roms don't honour adb shell reboot)

So, now that we can do custom roms/updates/zips, does anyone have Dutch strings.xml for Settings.apk and SettingsProvider.apk from a Android 2.1 release ? HSG did not include this language as an option in any of the stuff on the tablet..

Edit: Never mind, i've pulled them off the emulator and added the sections that were missing (HDMI Output selection and such.)

I would suggest to ensure you have a working flash to go back to. From tests we did with #320 on HSG x5a the video is not working (white screen). ADB still works and we could flash_image back a #297 kernel(boot.img) into it to get video back & working.

If you really want to try something, try Clockwork Recovery for #320 tablets: http://bit.ly/aA06cY and let me know if it works

You can use ADB to get into recovery: adb shell reboot recovery
Or, if you're a windows user, install Droid Explorer, and use the option in the menu.
Or, if you want, install Rom manager from market, or reboot control widget. Plenty of options

Edit: Also, no need to wait for your supplier, i've put #320 here:
http://www.zonko.nl/files/tcc/Haina.android.320.7z

helfrez said:

Is there an easy way to modify the size of the data partition. The default images only give 256MB for apps, which seems a bit small considering all of the devices have 2/4GB internal memory.

Click to expand...

Click to collapse

As far as i know, the MTD partitioning is done inside LK.ROM.

You can try to change it in a hex editor, and see if that works. I'm not sure if the CRC changes, and it we can even raw hex edit it.. (200+mb for /data is already pretty good..)
Suggested steps:
- Using a hexeditor on lk.rom you can do a search for 'BMPG'
- Around 0x4d350 you should find the mtd table.
- You can see the partition names, and sizes.
- For example, in '#297' LK.ROM, this is at 350Mbytes (00 00 00 D1 00 00 00)
- Try to change to 00 00 00 FF 00 00 00, see what happens

(If this works it's for all TCC related devices, and we can get an even huger /data partition hehehe.)