[TOOL] rkDumper (utility for backup firmware of RockChip's devices)

Search This thread
By:
Advanced…
P

protectivedad

Senior Member
Jul 27, 2014
50
22
Is there an option to force using a specific VID/PID combo. It doesn't seem to recognized the newest 2207:310D combination.
Code: 
        rkDumper (version 1.00)
        Utility for Rockchip's firmware backup

        (c) RedScorpio, Moscow, 2014-2015
            [email]RedScorpio@land.ru[/email]

        ==========================[ START ]==========================

        -- Devices enumerating --

        Devices table (found 11 USB devices):
        1       Device #0: USB Root Hub
        1.1     Device #1: USB Hub
                VID = 0x8087, PID = 0x0024, REV = 0x0000
        1.1.5   Device #2: Microsoft Mouse and Keyboard Detection Driver (USB)
                VID = 0x045e, PID = 0x0745, REV = 0x0663
        1.1.6   Device #3: Rockusb Device
                VID = 0x2207, PID = 0x310d, REV = 0x0100
        2       Device #4: USB Root Hub
        3       Device #5: USB Root Hub
        4       Device #6: USB Root Hub
        4.1     Device #7: USB Hub
                VID = 0x8087, PID = 0x0024, REV = 0x0000
        4.1.2   Device #8: USB Printing Support
                VID = 0x04f9, PID = 0x0027, REV = 0x0100
        5       Device #9: USB Root Hub
        5.6     Device #10: USB Attached SCSI (UAS) Mass Storage Device
                VID = 0x0bc2, PID = 0xab24, REV = 0x0100

        Can't find RockChip device

        ==========================[ STOP  ]==========================
 
Last edited:
P

protectivedad

Senior Member
Jul 27, 2014
50
22
RedScorpioXDA said:
Please inform me the name of device and type of SoC
Click to expand...
Click to collapse

The device is a Proscan PLT9650G. From the box and looking at the running systems /proc/cpuinfo it says it's a RK3126. I've attached the devices parameters.txt file. The newest windows drivers from RockChip (Driver Assistant 4.3) have the PID listed (it took a while to find them).
 

Attachments

  • parameters.txt
    820 bytes · Views: 370
E

E--Man

Senior Member
May 1, 2012
526
74
protectivedad said:
The device is a Proscan PLT9650G. From the box and looking at the running systems /proc/cpuinfo it says it's a RK3126. I've attached the devices parameters.txt file. The newest windows drivers from RockChip (Driver Assistant 4.3) have the PID listed (it took a while to find them).
Click to expand...
Click to collapse

RedScorpioXDA said:
Please inform me the name of device and type of SoC
Click to expand...
Click to collapse

Greetings to all. I have a cheap Tablet that uses the same Hardware ID "USB\VID_2207&PID_310D" and I have already soft-bricked it once trying to install TWRP and had to go back to the store to exchange it. This time around, I would like to make a backup before flashing anything so that I can revert back.

RedScorpioXDA, thanks for your efforts on this project thus far. Is there any update on this new HardwareID addition? I would really like to root this device but also have the same Hardware ID as "protectivedad".

Thanks.

rkDumper (version 1.00)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014-2015
RedScorpio@land.ru

==========================[ START ]==========================

-- Devices enumerating --

Devices table (found 5 USB devices):
1 Device #0: USB Root Hub
1.1 Device #1: Rockusb Device
VID = 0x2207, PID = 0x310d, REV = 0x0100
2 Device #2: USB Root Hub
2.1 Device #3: USB Composite Device
VID = 0x0e0f, PID = 0x0003, REV = 0x0102
2.2 Device #4: USB Hub
VID = 0x0e0f, PID = 0x0002, REV = 0x0100

==========================[ STOP ]==========================
 
E

E--Man

Senior Member
May 1, 2012
526
74
E--Man said:
Greetings to all. I have a cheap Tablet that uses the same Hardware ID "USB\VID_2207&PID_310D" and I have already soft-bricked it once trying to install TWRP and had to go back to the store to exchange it. This time around, I would like to make a backup before flashing anything so that I can revert back.

RedScorpioXDA, thanks for your efforts on this project thus far. Is there any update on this new HardwareID addition? I would really like to root this device but also have the same Hardware ID as "protectivedad".

Thanks.

rkDumper (version 1.00)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014-2015
RedScorpio@land.ru

==========================[ START ]==========================

-- Devices enumerating --

Devices table (found 5 USB devices):
1 Device #0: USB Root Hub
1.1 Device #1: Rockusb Device
VID = 0x2207, PID = 0x310d, REV = 0x0100
2 Device #2: USB Root Hub
2.1 Device #3: USB Composite Device
VID = 0x0e0f, PID = 0x0003, REV = 0x0102
2.2 Device #4: USB Hub
VID = 0x0e0f, PID = 0x0002, REV = 0x0100

==========================[ STOP ]==========================
Click to expand...
Click to collapse
Anyone?
 
E

E--Man

Senior Member
May 1, 2012
526
74
RedScorpioXDA said:
protectivedad,
E--Man,
Please, try test version http://ge.tt/5JPvWCU2/v/0?c
Click to expand...
Click to collapse

@RedScorpioXDA, many thanks! Spaciba balchoi! It worked for me

Just to confirm, if I soft-brick this device by flashing TWRP, can I use what I just "dumped" to "load" back?

Best Regards,

E.

---------- Post added at 01:55 PM ---------- Previous post was at 01:53 PM ----------

Spoke too soon. I got a "Critical Error" "Data Reading Erro" while dumping "system.img". Here is the log:

C:\Users\User\Desktop\rkDumper_101g (1)>rkdumper dump

rkDumper (version 1.01g_test)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014-2015
RedScorpio@land.ru

==========================[ START ]==========================

!!! Test pos #0
--- Firmware dumping ---

-- Devices enumerating --

Devices table (found 5 USB devices):
1 Device #0: USB Root Hub
1.1 Device #1: Rockusb Device
VID = 0x2207, PID = 0x310d, REV = 0x0100
2 Device #2: USB Root Hub
2.1 Device #3: USB Composite Device
VID = 0x0e0f, PID = 0x0003, REV = 0x0102
2.2 Device #4: USB Hub
VID = 0x0e0f, PID = 0x0002, REV = 0x0100

Found: LOADER device (RK3126 2207:310d) #1

Found LOADER Rockchip device

PARM sign found

FlashInfo
Manufacturer: Hynix (0x02)
Flash size: 8480MB (0x01090000)
Full size: 8480MB (0x01090000)
Block size: 4096KB
Page size: 16KB
ECC bits: 40
Access time: 32
Flash CS: 0 (0x01)
CS0: ad de 14 a7 42

Partition "uboot" saved (format: unknown)
Partition "misc" saved (format: unknown)
Partition "resource" saved (format: Rockchip resources image
file)
Partition "kernel" saved (format: RockChip KRNL signed file
)
Partition "boot" saved (format: Android boot image)
Partition "recovery" saved (format: Android boot image)
Partition "backup" saved (format: unknown)
Partition "cache" saved (format: ext4 image)
Partition "metadata" saved (format: ext4 image)
Partition "kpanic" saved (format: unknown)
Partition "system" Data reading error
Critical error

==========================[ STOP ]==========================
!!! Test pos #6
!!! Test pos #9
!!! Test pos #11
!!! Test pos #12
!!! Test pos #13
!!! Test pos #14

C:\Users\User\Desktop\rkDumper_101g (1)>
 
E

E--Man

Senior Member
May 1, 2012
526
74
UPDATE:
Got it to work.

RedScorpio, here is some additional information to help you with your testing including your debuggers. After it failed, I tried again and it still failed with this:
Found LOADER Rockchip device
Data reading error
Critical error
!!! Test pos #11
!!! Test pos #12
!!! Test pos #13
!!! Test pos #14

On a hunch, I tried to reboot and go back into Bootloader mode and try again and it worked, so it looks like it might have to do with a timeout of some sort.

Here is the success log:
==========================[ START ]==========================

!!! Test pos #0
--- Firmware dumping ---

-- Devices enumerating --

Devices table (found 5 USB devices):
1 Device #0: USB Root Hub
1.1 Device #1: Rockusb Device
VID = 0x2207, PID = 0x310d, REV = 0x0100
2 Device #2: USB Root Hub
2.1 Device #3: USB Composite Device
VID = 0x0e0f, PID = 0x0003, REV = 0x0102
2.2 Device #4: USB Hub
VID = 0x0e0f, PID = 0x0002, REV = 0x0100

Found: LOADER device (RK3126 2207:310d) #1

Found LOADER Rockchip device

PARM sign found

FlashInfo
Manufacturer: Hynix (0x02)
Flash size: 8480MB (0x01090000)
Full size: 8480MB (0x01090000)
Block size: 4096KB
Page size: 16KB
ECC bits: 40
Access time: 32
Flash CS: 0 (0x01)
CS0: ad de 14 a7 42

Partition "uboot" saved (format: unknown)
Partition "misc" saved (format: unknown)
Partition "resource" saved (format: Rockchip resources image
file)
Partition "kernel" saved (format: RockChip KRNL signed fil
)
Partition "boot" saved (format: Android boot image)
Partition "recovery" saved (format: Android boot image)
Partition "backup" saved (format: unknown)
Partition "cache" saved (format: ext4 image)
Partition "metadata" saved (format: ext4 image)
Partition "kpanic" saved (format: unknown)
Partition "system" saved (format: ext4 image)
Partition "radical_update" saved (format: unknown)
Partition "userdata" skipped

-- Rockchip LOADER device resetting --

Found LOADER Rockchip device

Command to reset sent successfully
Command to reset confirmed

!!! Test pos #1
Configuration file for RKAndroidTool v.1.xx (8-bit) created
!!! Test pos #2
Configuration file for RKAndroidTool v.2.xx (16-bit) created
!!! Test pos #3
!!! Test pos #4
!!! Test pos #5

==========================[ STOP ]==========================
!!! Test pos #6
!!! Test pos #9
!!! Test pos #10
!!! Test pos #11
!!! Test pos #12
!!! Test pos #13
!!! Test pos #14
!!! Test pos #15

RedScorpio, if you want more logging verbosity, let me know and I will PM you.


Just a couple of quick questions:
1) if I soft-brick this device by flashing TWRP, can I use what I just "dumped" to "load" back?
2) Why was the "userdata" partition skipped? Do I need this if I will need to revert back? If this is the standard /data partition, then I think I would want to dump this as well. Is it possible? Edit: I tried using the "/user" option using "rkDumper /user dump" but it still skipped dumping the user partition. Not sure if this is an issue or if I am doing something wrong.
3. If I want to revert and load only 1 partition, can I do that or is it all or nothing?

Thanks.

Best Regards,

E.
 
Last edited:
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
308
E--Man said:
1) if I soft-brick this device by flashing TWRP, can I use what I just "dumped" to "load" back?
Click to expand...
Click to collapse
Yes
E--Man said:
2) Why was the "userdata" partition skipped? Do I need this if I will need to revert back? If this is the standard /data partition, then I think I would want to dump this as well. Is it possible? Edit: I tried using the "/user" option using "rkDumper /user dump" but it still skipped dumping the user partition. Not sure if this is an issue or if I am doing something wrong.
Click to expand...
Click to collapse
I need full log-file with /dump option to check
E--Man said:
3. If I want to revert and load only 1 partition, can I do that or is it all or nothing?
Click to expand...
Click to collapse
You can use checkboxes in RKAndroidTool to choose partition
 
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
308
rkDumper
Utility for backup firmware of RockChip's devices

New version (1.01 Windows) ready

! Release;
+ support of RK2928 added;
+ support of RK3126 added;
+ support of RK3368 added;
+ detection of MTP&PTP modes added;
~ some algorithms improved.
 
  • Like
Reactions: Oma7144
R

RedScorpioXDA

Senior Member
Apr 6, 2012
497
308
rkDumper
Utility for backup firmware of RockChip's devices

New version (1.02 Windows) ready

~ /user key logic changed;
~ errors handling changed;
+ parm mode added;
+ /pfile key added.
 
  • Like
Reactions: Oma7144
U

ultradj83

Senior Member
Jun 2, 2008
677
33
Milan
Images to update.img

Dears,
once all .img files have been dumped (including user), how to create a single update.img?

Thanks a lot.
 
N

NEOCRIVI

Member
May 4, 2009
17
0
Hi
Thanks for the dumper tool,
I try dump fw of eStar 9 Zoom QC MID9054 rk3126 :
c:\rkdumper102>rkdumper dump

rkDumper (version 1.02)
Utility for Rockchip's firmware backup

(c) RedScorpio, Moscow, 2014-2016
RedScorpio@land.ru

==========================[ START ]==========================

--- Firmware dumping ---

-- Devices enumerating --

Devices table (found 8 USB devices):
3.3 Device #5: Rockusb Device
VID = 0x2207, PID = 0x310d, REV = 0x0100

Found: LOADER device (RK3126 2207:310d) #5

Found LOADER Rockchip device

First 0x0008 NAND blocks reading

PARM sign found

Begin of partition "user" don't matched end of partition "radical_update
"
FlashInfo
Manufacturer: Hynix (0x02)
Flash size: 8528MB (0x010a8000)
Full size: 8528MB (0x010a8000)
Block size: 4096KB
Page size: 16KB
ECC bits: 40
Access time: 32
Flash CS: 0 (0x01)

Partition "uboot" saved (format: Rockchip uboot image file
)
Partition "misc" saved (format: unknown)
Partition "resource" saved (format: Rockchip resources image
file)
Partition "kernel" saved (format: RockChip KRNL signed file
)
Partition "boot" saved (format: Android boot image)
Partition "recovery" saved (format: Android boot image)
Partition "backup" saved (format: unknown)
Partition "cache" saved (format: ext4 image)
Partition "userdata" saved (format: ext4 image)
Partition "metadata" saved (format: ext4 image)
Partition "kpanic" saved (format: unknown)
Partition "system" saved (format: ext4 image)
Partition "radical_update" saved (format: unknown)
Partition "user" skipped

-- Rockchip LOADER device resetting --

Found LOADER Rockchip device

Command to reset sent successfully
Command to reset confirmed

Configuration file for RKAndroidTool v.1.xx (8-bit) created
Configuration file for RKAndroidTool v.2.xx (16-bit) created

==========================[ STOP ]==========================

c:\rkdumper102>
Click to expand...
Click to collapse

Can this tool flash this backup in dead device?

Thanks and best regards!
 
Last edited:
You must log in or register to reply here.

Similar threads

B
[TUT]MTK Android (Sp flash tool ) tutorial
Replies
1K
Views
2M
tavoc
tavoc
R
[TOOL] imgRePackerRK (RockChip's firmware images unpacker/packer)
Replies
464
Views
320K
blakegriplingph
blakegriplingph
I
  • Locked
all in one sim unlock tool
Replies
1K
Views
1M
the-equinoxe
the-equinoxe
A
[Tool] SP Flash Tool New Version v5.1352.01
Replies
104
Views
655K
R
rxf2g
DR_MOOSAVI
[Tool]SP FlashTool ||MTK Android FLASHER
Replies
109
Views
667K
X
xchaoling

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 1
    R
    RedScorpioXDA
    mobifixit said:
    but all the partitions are filled with CC CC except BOOT ,UBOOT AND TRUST and i cant find that magic bytes to patch FD 7B BE A9 someone have a easier method?
    Click to expand...
    Click to collapse

    Pay attention to the message

    TBM 13 said:
    Then, I opened my stock uboot.bin in the hex editor, searched for `81 00 01 8B 24 00 02 8B 9F 40 40 F1 49 01 00 54` and in that sequence replaced `40 40` with `00 60`, saved, repacked, flashed and done! I don't know whether this sequence is present in most uboots or just mine. Maybe you could research this @RedScorpioXDA , because if that's the case you could maybe automate this process in your tool.

    Also please note that if you use Rockchip's AndroidTool to dump, use an old version like v2.38 as newer ones also deny dumping after 32 MB.
    In case it's helpful to anyone, I'm documenting the research of my Rockchip device on GitHub
    Click to expand...
    Click to collapse
    View
    1
    R
    RedScorpioXDA
    blakegriplingph said:
    If I unpack uboot.img using your tool it spits out a uboot.bin and two other blank files named uboot_1.bin and uboot_3.bin
    Click to expand...
    Click to collapse
    I don't know which version of imgRePackerRK you are using. I'm using the latest test version 1.0.7.7
    At the same time, there are no additional files
    blakegriplingph said:
    but if I repack it, the uboot image isn't packed in the same way as stock and thus my tablet either hangs up on the logo or refuses to power on at all unless I force it into maskrom mode and flash the stock uboot back.
    Click to expand...
    Click to collapse
    Quite a likely result, 4 bytes appeared in the boot header, the purpose of which is unknown to me (perhaps it does not matter). Therefore, the reverse packaging does not give an exact match (the difference is just for these 4 bytes).

    The sequence "81 00 01 8B 24 00 02 8B 9F 40 40 F1 49 01 00 54" is located at 0xfbfc of uboot.bin
    View
    1
    R
    RedScorpioXDA
    blakegriplingph said:
    If you compare the stock uboot to a repack of it the other copies of uboot are missing on the repack hence why they're quite different
    Click to expand...
    Click to collapse
    ==>
    RedScorpioXDA said:
    Quite a likely result, 4 bytes appeared in the boot header, the purpose of which is unknown to me (perhaps it does not matter). Therefore, the reverse packaging does not give an exact match (the difference is just for these 4 bytes).
    Click to expand...
    Click to collapse
    View
    1
    R
    RedScorpioXDA
    blakegriplingph said:
    Alright, I can confirm that repacking uboot using the latest test version only results in changing just the four bytes you mentioned. To be doubly sure I also tried hex-editing uboot.bin and repacking it, and it all turned out good. ;)
    Click to expand...
    Click to collapse
    Is the device being downloaded? Is the firmware being dumped?
    View
    1
    R
    RedScorpioXDA
    mobifixit said:
    sir Any progress yet ?
    Click to expand...
    Click to collapse
    And where is the dump of your device?
    uboot is needed
    View
  • 17
    R
    RedScorpioXDA
    rkDumper
    Utility for backup firmware of RockChip's devices

    Version 1.1.1.0 Windows

    1. Makes dump of NAND by partitions according "parameter" information (RKFW/RKAF formats)
    2. Creates config.cfg for RKAndroidTool (1.xx, 2.xx)

    Notes:
    1. All drivers must be installed
    2. Administrator rights are required

    Known bugs:
    -
    Old versions:
    View
    6
    R
    RedScorpioXDA
    Tested on:
    WinXP (32), WinVista (32), Win7 (32/64), Win10 (64)

    0bb4:2910 MSC device (USB debug off)
    0bb4:0c02 MSC device (USB debug on)

    2207:0000 MSC device (USB debug off)
    2207:0010 MSC device (USB debug on)

    2207:350A RK3566 x88 Pro
    2207:330D RK3308/RK3326/RK3388/PX30 Evoo EV-A-81-8-1
    2207:330C RK3399/PX6 CSA96
    2207:330A RK3368/PX5 Artway X6/HCT MTCD (Car head unit) SOM
    2207:320C RK3318/RK3328/PX4 A5X Plus mini
    2207:320B RK3229 MXQ 4K
    2207:320A RK3288 Jesurun T034
    2207:310D RK3126 Proscan PLT9650G
    2207:310C RK3128 CS918-rk3128
    2207:310B RK3188/PX3 PIPO Max M9 Pro
    2207:301A RK3036 Wecast E8
    2207:300B RK3168 Starmobile Engage7+
    2207:300A RK3066/PX2 UG802
    2207:292C RK3026/RK3028 ONYX BOOX C67SML COLUMBUS/?
    2207:292A RK2928 Lexibook Tablet Master 2
    2207:290A RK2906 TeXeT TB-138
    2207:281A RK2818 ChinaLeap M3


    If you have another Rockchip SoC send me result of "rkDumper scan" and name of device. I'II send you personal version for test
    View
    6
    P
    pseudolobster
    Hi everyone!

    I've made a breakthrough on dumping devices that have a 32mb limit or dump `CC` `CC` `CC`. It turns out this "read protect" function is actually implemented in uboot. The uboot partition is typically in the first 32mb, so you should have no problem dumping it and it is possible to edit out the 32mb limit and flash the uboot partition back.

    Here's how I did it:

    First of all, I could not have figured this out if it weren't for DorianRudolph on github, who documented installing linux on a PineNote, which happens to have the same RK3566 chip I've been struggling with. They figured out where in the source code rockchip implements this, so they unpack the uboot.bin from uboot.img, disassemble it, and find that function. They patche it to always jump to a certain location instead of spitting out `CC`. The result is the chip behaves like all rockchip socs before it.

    After looking at my uboot.bin versus theirs, I figured out we're running different versions of uboot, and I couldn't use their uboot image, or their scripts without modification. I dumped as much as I could with rkdumper, then took uboot.img, edited uboot_img.py to point to my img file and ran it. It spit out uboot.bin.

    I downloaded and installed ghidra, created a project, imported uboot.bin, set its language as AARCH64 V8A little-endian. Double click to decompile, then go looking for something that looks like this picture, or in my case, like this. Then patch the `b.ls` instruction to be a `b` instruction. I found the easiest way to find the correct function was to search for `FD 7B BE A9 FD 03 00 91 ?? 18`. There were a ton of functions that started with the same 8 btes, which is probably like "push the stack" or something, but there were only two that used `0x18` as the parameter for the `ldr` instruction.

    After patching it with ghidra I took the uboot.img, put it in a directory with uboot_img.py, edited it to comment out `check_hash_and_dump()` and run patch();, edit lines 29 and 30 to match the size and positon of uboot.bin. The `sz` is the size in bytes, in hex. The `pos` can be found by running `dtc -I dtb -O dts uboot.img`

    That's pretty much it. I used RkDevTool to flash the modified uboot, by right clicking the first screen, hitting load config, choose the config output by rkDumper, hit dev partition, then check the checkbox to the left of uboot, click the blank space to the right of uboot, choose your uboot.img, and hit Run.

    Next time you boot into LOADER mode, you'll be able to dump all partitions!
    View
    4
    marchnz
    marchnz
    RedScorpioXDA said:
    This happens as a result of "unsure" reading.
    Try
    - change the cable (preferably short and thick)
    - exclude USB hubs (if used)
    - change the USB socket (preferably on the back of the computer)
    - change the USB version (2.0 instead of 3.0)
    - use a different computer

    No
    Click to expand...
    Click to collapse

    Hi @RedScorpioXDA,
    Thanks again for your reply.

    I have confirmed the issue is not hardware, the issue is rkdumper is incompatible with rockchip driver greater than 4.5 - 4.91 is latest as of writing.


    • By installing driver version 4.3. - Rockchip_DriverAssistant_v4.3 - was able to dump images with rkdumper v1.08.
    • Just to clarify - Rockchip Driver assistant version 4.5 on do not work with Rkdumper.

    This was first identified by @nalor in post 85 (thanks @nalor!) here: https://xdaforums.com/showpost.php?p=78805354&postcount=85

    Would you please update your first post with this information - known bugs?
    View
    2
    N
    nalor
    Hi! Just tried to backup my new Onyx Boox Poke Pro and failed at the beginning with the following message:

    Code: 
            Found:  LOADER device (RK3288 2207:320a) #5

        --- Firmware dumping ---


        Found LOADER Rockchip device

        First 0x0010 NAND blocks reading

        Command to read failed

        -- Rockchip device resetting --

        Found LOADER Rockchip device

        Command to reset failed

    I'm using Windows 10 x64 as operating system.

    Finally I noticed the problem came from the used driver - I used the most recent 'Driver Assistant 4.7' directly from the github rockchip site and it's not working with this one.
    I tried all 'Driver Assistant 4.x' beginning with 4.1 and the backup is working without problems up to DriverAssistant 4.5 - but beginning with DriverAssistant 4.6 it's failing with the error message above.

    I don't know if this problem also occurs for other devices and or chipsets, but at least my device with the Rockchip RK3288 requires to downgrade to 'Driver Assistant 4.5' or lower.

    Maybe it would be a good idea to include the driver-version into the output of rkDumper?
    View

New posts