Remove All Ads from XDA

[Official] HSG (X5A/X6) & Pandawill G11 rooting/dev thread (SetCPU & Root working!)

88 posts
Thanks Meter: 6
By Asure, Member on 18th August 2010, 08:28 AM
Post Reply Email Thread
Chinese-manufactured devices, with Korean cpu.. The midX5a / midx6 are both Telechips-based tablets. They're very similar to the Augen device, except they have the actual HDMI port, 300M /data, correct /cache size and a 3.5" headphone jack

The Pandawill G11 seems to be a rebranded version of this hardware using the same firmware(s).
Note: There are older versions of this hardware with no HOME/MENU/BACK buttons, running WinCE. These cannot be upgraded to Android as far as we know right now.

TODO / What's not working: (Updated 24/8/2010)
- Add more languages (like Dutch!)
- Cleanup included languages (Georg77cz is working on cz/cs translation.)
- Find out how to increase /data to the full 3.3GB that's available on internal NAND (hexedit LK.ROM?)
- SetCPU (fc's after moving slider) Working! See attachment![/strike]
- Can't seem to enter recovery by hardware buttons Working, connect USB and use Rom Manager to reboot into recovery!
- Unpack tcc_8900mtd files Naobsd figured it out, thanks!
- Unpack system.img Naobsd figured out to patch unyaffs!
- Repack system.img Naobsd released tools for this.
- Unpack boot IMG, figure out base & pagesizes (4096 page size, base 0x40000000)
- Custom recovery - We have Clockworkmod working as of 20-8!
- Can't boot into recovery from ADB - (From firmware #348 this is fixed..)
- Factory defaults (Works in #348 and wipes properly using the recovery reboot.)

What's working: (As of firmware release #348)
- Custom recovery (Clockworkmod)
- Calibration (You must hold the stylus at the spot for some time.)
- Rooted!
- Telechips FWDN firmware recovery (via WinXP/2K)
- Telechips USB host booting method with empty(!) nand
- Rotation with 'RotateD' from market
- YouTube HD (Just push the Evo4G Youtube.apk)

Note there are similar models. Visit the HSG website and note the right side button spacing/placement.
Link: HSG Website

The model this topic is about, has the buttons spaced across the right side.
The other model that is not from HSG appears to be non-available from China sellers right now, or not in production yet for unknown reason. (sensor rumours)

Another third model has popped up, it's basically the same hardware in APAD casing with metal back plate.

I moved this thread over here from Slatedroid since it got filled with non-dev talk, and thier hosting keeps going offline. I hate it when i can't backtrack to my own findings

- MIDX6 has on-board rotation sensor, but it's apparently not working in the firmware yet.
- MIDX6 has optional 3G / GPS inside
- MIDX5A is the basic model with no sensor/3G/GPS. (The rest is the same.)
- CPU Runs at 720Mhz stock
- Has HDMI port
- Has a normal 3.5" jack for headphones
- One speaker, and one microphone inside.
- Runs Android 2.1 eclair-update1
- No GPS/3G/Orientation sensor inside
- Linpack score around 4.9 with no mods / clean os.
- Metal top body, plastic bottom
- Mine came with 2x 1300mA battery inside!
- Battery lasts really long, i can run for ~6-7 hours at work with wifi on.

Quick review
I've used the device for about 3 days now with firmware #297, and it's very fast to use & works like a charm. It has a very solid build quality with a metal top on a thick plastic bottom, making it feel like a quality product. Market worked out-of-the-box with no fuss or hacks. Touchscreen is responsive, but resistive. If you want to slide, push down your finger first, then slide (don't hit-and-run or do a driveby with you finger on the screen).

Battery life is pretty damn good. I've been using it for at least 6-7 hours in one go, with wifi while debugging and ADB and such. The screen is nice & bright, and even if it's a resistive screen it works OK. The main reason for an initial slow reaction from the screen, is that the CPU is downclocked to 36Mhz when you are not doing anything. Edit: This is sorted with SetCPU 2.01! After the first wipe/slide it goes up to 720Mhz.(Yes, that's 120 Mhz more than the Augen!)

Note to posters: Please keep this thread clean. If it's not about rooting or dev, do not post it here please. Thank you!
Attached Files
File Type: zip - [Click for QR Code] (159.7 KB, 2196 views)
18th August 2010, 08:29 AM |#2  
OP Member
Thanks Meter: 6
Post reserved for updates:

Root updated (20-11-2010)
Updated One-click root for #348 and lower.
Download here
This also works with the newer revisions of this tablet with g-sensor

Recovery now working! (20-8-2010, requires #348)
See This Topic for working recovery files.

Steps for flashing with FWDN in USB mode (16-08-2010) (Thanks @fun_ & GeorgCZ for testing!)
(more details will follow)
- Figure out your device serial number and /data/softmac. Store it. (easiest to do, is flash same firmware, FWDN shows it)
- Option #1: You are on V7 (@205, #270, #297, #320) ? Use FWDN mode, and just flash it, format entire nand between different versions!
- Option #2: You are on V6 (WINCE) firmware ? Use use the internal switch to set USB host mode. Place tcBoot.rom in fwdnv7 folder
- When going from V6 to V7 firmware, you will need to erase the entire flash with the dropdown box.
- Plug in when asked, the device will boot with the USB boot mode. Then flash your firmware.
- It's almost impossible to kill the device. The CPU will boot in USB host boot mode if you erase the nand completely!

(In)Compatible USB devices (13-08-2010)
- Keyboards
- Mice
- Wifi USB/Keyboard (as long as they are USB HID devices with no drivers)
- CSR Bluetooth: Not working (no driver in kernel)
- UVC webcams: Not working (no driver in kernel)

SAFE MODE boot (12-08-2010)
This is a special mode if you screwed up something and can't get in the OS because of force-closes in an bad-behaving app that you installed..
- Ensure no power is plugged in
- Press the centre of the touchscreen, & keep it pressed.
- Power on the device as normal. Don't let go of the touchscreen..
- You're now in Safe mode! (a message should be in the bottom left corner stating so.)

Exact steps for flashing with FWDN (12-08-2010) (Thanks @fun_!)
- Power off the unit
- Unplug USB
- Plug in the AC adapter
- Firmly touch the touchscreen
- Power on the unit
After a while you'll notice it stays at the boot splash screen, then you can plug in the USB cable and fire up FWDN.

Google maps update failure fix (11-08-2010)
Connect using ADB and issue the following commands:
adb remount
busybox rm /system/app/Maps.apk
cd /system/bin
sh pm uninstall
Now you can install the new Google Maps version from the Market.
(If not, just reboot the device & try again.)

Extract kernel from boot.img (11-08-2010) (Thanks @geoRG77!)
You can extract the contents using (needs linux+perl installation.)
This also works on tcc8900_mtd.img, since boot.img is near the start of this file. Need to DD of some bytes
(Note that system.img and others are also inside this MTD dump, it's for flashing the whole nand area in one go in the FWDN software.)

Modified INF file for ADB driver:
How to:
- Enable USB debugging
- Install the driver from my (2k/xp/32 bits)
- Unzip into C:\rootfiles
- Start a command prompt and do cd /rootfiles, then root.bat
- You should get no errors, and after the reboot, your X5A should be rooted.
- Note, SetCPU does not seem to work properly.

Firmware layout #297 7-10-2010
Here's /proc/mtd output from #297 rom:
dev:    size   erasesize  name
mtd0: 80000000 00080000 "bootloader"
mtd1: 00a00000 00080000 "boot"
mtd2: 09600000 00080000 "system"
mtd3: 00400000 00080000 "splash"
mtd4: 01400000 00080000 "cache"
mtd5: 13b00000 00080000 "userdata"
mtd6: 00100000 00080000 "persist"
mtd7: 00a00000 00080000 "recovery"
mtd8: 00100000 00080000 "misc"
mtd9: 00100000 00080000 "tcc"
Firmware layout #348 7-10-2010
mtd0: 00a00000 00080000 "boot"
mtd1: 00500000 00080000 "kpanic"
mtd2: 09600000 00080000 "system"
mtd3: 00400000 00080000 "splash"
mtd4: 02800000 00080000 "cache"
mtd5: 12300000 00080000 "userdata"
mtd6: 00a00000 00080000 "recovery"
mtd7: 00100000 00080000 "misc"
mtd8: 00100000 00080000 "tcc"
Firmware layout #205 18-10-2010
mtd0: 80000000 00080000 "bootloader"
mtd1: 00500000 00080000 "boot"
mtd2: 09600000 00080000 "system"
mtd3: 00400000 00080000 "splash"
mtd4: 03200000 00080000 "cache"
mtd5: 12800000 00080000 "userdata"
mtd6: 00100000 00080000 "persist"
mtd7: 00500000 00080000 "recovery"
mtd8: 00100000 00080000 "misc"
18th August 2010, 08:30 AM |#3  
OP Member
Thanks Meter: 6
Warning: Each device has a unique serial. Do not select to overwrite it in the 'Tools - Options' menu!!
It is strongly advised to write down your serial after doing a basic FWDN flash, in case of emergency!

Below you'll find a fast mirror for the current firmwares:
(Do a Right-click, save as.. these are 7zip compressed, get it at

Firmware #205 (0730) - No market, pretty bland rom.
Firmware #297 (0803) - Works stable, has market.
Firmware #348 (0816) - First rom with recovery booting, but no keys work to select options

We don't know how to repack or unpack them yet. LK.rom seems to hold the MTD layout inside. If anyone figures out how to unpack/repack these files, please let us know.

19-8-2010: User fun_ figured out, we need to flash lk.rom as a single file, and then reboot to have new partitions used

Firmware Updating
There are two modes in which you can update the firmware.
The first mode is basic FWDN mode. The second mode with a blank nand is a factory USB host mode boot, that works even if the nand was completely erased by accident, or empty at the production line.

Warning: Each device has a unique serial. Do not select to overwrite it in the 'Tools - Options' menu!!
It is strongly advised to write down your serial after doing a basic FWDN flash, in case of emergency!

Basic FWDN is also outlined in the Chinese document: v1.01.pdf
Use it a basis for upgrading in this mode.

Basic FWDN mode
This is triggered by the following procedure, and the standard way to upgrade these devices:

Tablet side:
- Unplug tablet from the PC!
- Power off the tablet. Insert the power plug (required!)
- Press & hold finger on the touch screen, and then press & hold the powerbutton.
- The tablet powers up, and remains on the splash screen.

PC Side:
- Install the VTC drivers on your PC (tested OK on Win7 & WinXP 32 bit)
- Set up FWDN before plugging in the tablet
- Optional: Browse & add LK.ROM as a single file when coming from another partition layout, flash and reboot the tablet afterwards, then do the steps below. (You can skip this step, if you are staying on the same MTD layout i.e. flashing the same firmware revision you are on.)
- Browse & add the LK.ROM file.
- Browse & add the tcc8900_mtd.img file.
- Ensure no options are selected in the Tools - Options menu or you loose the mac/serial!
- Plug the tablet into USB
- Click the Nand area map and create a FAT partition for the remaining space.
- Yes, thats 'click on the square below the text' where it shows the block See this picture.
- If you're going to a different MTD layout, choose 'low format' in the dropdown.
- Click Start, and patiently wait.

USB Host boot mode
19-8-2010: No longer needed!
Fun_ figured out the LK.ROM holds the partition info. So if you're coming from another layout, simply flash LK.ROM first. The below procedure remains as a service for those that accidently bricked the device.

This mode is triggered when you erase the entire flash by accident, or when you put the switch on the mainboard inside your tablet to the other position.

You will need to add a bootrom to the FWDN folder where the .exe for FWDN resides. You can get that bootrom from here.

In this mode, the tablet will boot when connected by USB to the PC and init the cpu. After that, it can be flashed the same way as above. In this case you'll need to fiddle with the settings under 'Tools - Options' to set back the serial to what it was before the 'accident'.

If you desire, WinCE can be flashed in this way, if you kill the nand using flash_eraseall under Android..
The Following User Says Thank You to Asure For This Useful Post: [ View ] Gift Asure Ad-Free
18th August 2010, 12:32 PM |#4  
geoRG77's Avatar
Thanks Meter: 3
Uninstall Chinese apps (18-08-2010) (thanks to Asure)
adb pull /system/app/ ./app
adb shell rm /system/app/91pandaspace_v2.3.apk
adb shell rm /system/app/himarket.apk
adb shell rm -r /data/dalvik* 
adb shell sync
adb shell reboot
18th August 2010, 01:38 PM |#5  
xaueious's Avatar
Senior Member
Flag Toronto
Thanks Meter: 179
Official Firmware Download Link:

* * *

naobsd teardown:

* **

I can open up a forum for you at:

For now, it's a thread here

If a couple of you are up for it, that is. XDA is alright for dev talk though.

* * *

I repacked recovery.img earlier before:

I unpacked Asure's boot.img using instructions from here:

Then took the Augen Gentouch recovery, unpacked that as well to replace the ramdisk

The stock 297 recovery image is really large (10mb? Augen is 3mb with clockwork) and has a bunch of useless stuff in it.

So Asure, your recovery image didn't boot? I got all excited...

Edit: repacking doesn't work apparently.

I need to get myself one
18th August 2010, 02:07 PM |#6  
OP Member
Thanks Meter: 6
I tried to repack the recovery.img using all the methods outlined here:

They all produce an image that looks fine in a hex editor at first glance, but fails to boot on a real device (After flashing it with flash_image recovery /sdcard/recovery.img for example)

I'm pretty sure there's a TTL serial port in the device, but i'll need some time to sort that out. I asked Koush for help, perhaps he can see what is wrong with the image.
19th August 2010, 03:27 AM |#7  
helfrez's Avatar
Senior Member
Thanks Meter: 89
Root Holding...
I have the model similar to the Apad with the hardware buttons. The Augen root method worked fine and looks to be holding so far, no stability issues or lockups using SetCPU with 120/720 scaling . I can provide some assistance from the "third" model with direction as needed.

My device is actually showing #320. My partition layout is similar to #297.
19th August 2010, 10:14 AM |#8  
Junior Member
Thanks Meter: 0
Latest Firmware update failure
I tried to flash the new firmware from HSG (16-8-2010)
but everytime it failed with this error

[ERROR] The old version(=0x07000002) device can't support 'MTD' fwdn area image.

i followed the same steps when i did the 13-8 update.

Anybody tried to flash it with succes ?
What am i doing wrong this time?
19th August 2010, 10:45 AM |#9  
OP Member
Thanks Meter: 6
Please read & follow the steps in the second post. Low-format to get the new MTD layout.

Also, please keep this a dev topic. This is not HSG customer support
19th August 2010, 02:44 PM |#10  
OP Member
Thanks Meter: 6
First, credits to Koush for his amazing recovery, the Android scene would be completely different if it wasn't for you!

Second, i wonder who @google thought it would be a great idea to force a huge download of 4.5GB + apps needed to compile a 13kb mkbootimg.
Anyway, with some files from someone else's kitchen (only 15mb download) i managed to compile mkbootimg with the new --pagesize parameter from Koush.
(This recovery's kernel --base 40000000 and requires --pagesize 1000 to work properly.)

I've updated the second post with the working recovery.
Also the one-click root.bat is back.

Enjoy your weekend!
19th August 2010, 10:46 PM |#11  
OP Member
Thanks Meter: 6
Recovery is now working thanks to Georg77cz who provided unmissable help with testing this!
Check for some pics. I'll upload the recovery tomorrow. For now, only confirmed to work on #348 roms! (older roms don't honour adb shell reboot)
Post Reply Subscribe to Thread

hsg, recovery, root, tcc8902, telechips

Guest Quick Reply (no urls or BBcode)
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes