[TOOL] rkflashtool for Linux and rk2808, rk2818 and rk2918 based tablets

Search This thread

mrgsm

Member
Apr 18, 2004
21
1
Indonesia
Need Helppp ... i tried upload Generic rk2918 using rrecovery_RKtool_win_v2 ,on my China TAB rk2918 based, it worked fine, and then suddenly i pressed 'Format' at recovery_RKtool_win_v2, now it cannot Boot. But still detected by software, but not detect by RKBatch15 (for flashing ROM).

pleaseee ...pleaseeee ...pleaseeee
 

Gilly10

Senior Member
Sep 22, 2012
566
340
I had a look at the RK29kitchen and pasted together one simple script that will backup all relevant partitions, it requires rkflashtool and mkkrnlimg in $PATH.

It is basically copied from Oleg's scripts from https://github.com/OlegKyiashko/RK29kitchen, I only added some extra sanity checks and made sure that everything is just in one script file (the original RK29kitchen script sources various plug-in scripts and that was too cumbersome for me).

It will first read and parse the partition table and then dump boot, kernel, misc, recovery, system, backup to your harddrive. Just to be clear, this functionality has already been available in RK29kitchen, I simply put some of the existing things together and modified them to my needs.

Thanks for this just dumped my RK3066 tablet, had no luck with getting firmware from the MFR so needed a way of getting something that I can hopefully use to recover, anyway I noticed it skips kpanic & cache, should it do that & will that affect any future recovery?

Thanks if anyone can answer ;)
 

ildar_prophet

Senior Member
Apr 20, 2011
275
39
johan-notes.blogspot.com
Thanks for this just dumped my RK3066 tablet, had no luck with getting firmware from the MFR so needed a way of getting something that I can hopefully use to recover, anyway I noticed it skips kpanic & cache, should it do that & will that affect any future recovery?

Thanks if anyone can answer ;)

Cache is cache so no valuable information there. Kpanic is a place to dump crash info for the Linux kernel. Both are autocreated, need no special handling.

Sent from my S3 using xda app-developers app

---------- Post added at 02:02 AM ---------- Previous post was at 01:34 AM ----------

rkflashtool: some blocks aren't flashed to RK3066

I successfully flashed kernel.img several times to my RK3066-based chineese tablet.
But when I tried to flash system.img, it didn't correctly flashed some blocks:
$ /tmp/android-command-line/rkflashtool/rkflashtool w 0x0061A000 0x0CA496 < system.img
...
GOOD
$ /tmp/android-command-line/rkflashtool/rkflashtool r 0x0061A000 0x03 | cmp - system.img
says that 1025'th byte is different
The result was partially flashed partition (corrupt filesystem).
I started to think that NAND is exhausted. But after that I successfully flashed the system.img with RKAndroidTool.exe in Windows. So it looks like the rkflashtool bug.
Ideas?
 

Astralix

Member
May 12, 2011
49
15
Cache is cache so no valuable information there. Kpanic is a place to dump crash info for the Linux kernel. Both are autocreated, need no special handling.

Sent from my S3 using xda app-developers app

---------- Post added at 02:02 AM ---------- Previous post was at 01:34 AM ----------

rkflashtool: some blocks aren't flashed to RK3066

I successfully flashed kernel.img several times to my RK3066-based chineese tablet.
But when I tried to flash system.img, it didn't correctly flashed some blocks:

The result was partially flashed partition (corrupt filesystem).
I started to think that NAND is exhausted. But after that I successfully flashed the system.img with RKAndroidTool.exe in Windows. So it looks like the rkflashtool bug.
Ideas?

AFAIK you cannot flash system.img with rkflashtool as system is under control of rkXXnand.ko driver and inherits wear-leveling algorithm. The windows tool seems to know that and adds or relocates data, crc, whatever according that driver.
There is still some 'magic' in the RockChip things...

But you can flash kernel, boot, recovery and misc with rkflashtool.

Regards
Astralix
 

ildar_prophet

Senior Member
Apr 20, 2011
275
39
johan-notes.blogspot.com
AFAIK you cannot flash system.img with rkflashtool as system is under control of rkXXnand.ko driver and inherits wear-leveling algorithm. The windows tool seems to know that and adds or relocates data, crc, whatever according that driver.
There is still some 'magic' in the RockChip things...

Astralix, thanks a lot for your answer.
But I strongly doubt that the RK-chip in flash mode has something to do with Linux kernel and hence rkXXnand.ko. I trust in your experience that RK somehow protects certain areas but that should be somewhere in the SRAM bootloader or such.
Anyway, thanks for clarification.
 

Astralix

Member
May 12, 2011
49
15
Astralix, thanks a lot for your answer.
But I strongly doubt that the RK-chip in flash mode has something to do with Linux kernel and hence rkXXnand.ko. I trust in your experience that RK somehow protects certain areas but that should be somewhere in the SRAM bootloader or such.
Anyway, thanks for clarification.

With the system.img It was just a proposal I made cause we had many troubles with flasing it while all other parts work fine.
There may be another trap you run into:
I got a new tablet based on RK3066, the Odys Xelio 10pro. In that one I tried to fetch the kernel from the flash but got only trash. We then found out that they followed the recommended way to give a separate kernel in boot.img and recovery.img. So you can flash into kernel.img whatever you like, it will not be started until you exchange boot.img with an image that doesn't contain a kernel.

ildar_prophet, are you inspecting the bootloader actually? So it would be very kind to keep me informed about any new information about it. I'd like to get some more infos about the IDB area and it's content. Further I rewrote some parts of the rkflashtool.c and collected all the different commands from different versions from it. And I added all known RockChips that should be supported by it here.
But still a work in progress and I only could verify it on RK2918 and RK3066.

Regards
Astralix
 
  • Like
Reactions: TiMiN8R

Originalas

Senior Member
Apr 28, 2010
279
70
Vilnius
www.topzone.lt
rkflash reads partitions fine, but doesn't write anything, just prints weird symbols in terminal.
Any ideas, where might be a problem?

9116909205_6eecc31513_b.jpg


And it worked a couple of weeks ago.
 
Last edited:

Originalas

Senior Member
Apr 28, 2010
279
70
Vilnius
www.topzone.lt
Sorry, your post is very informative.
Could you please write what command you launched, what you expected to see in the result etc...
I have made boot partition backup with command
sudo ./rkflashtool r 0x00008000 0x00008000 > boot.backup
everything went fine, rkflash made a good backup

Then i tried to flash different boot.img with command
sudo ./rkflashtool w 0x00008000 0x00008000 < boot.img
though after executing command terminal was flooded with weird symbols and rkflash didn't write anything to tablet.

LOL, I can see the problem now... I've used r parameter in write command. :)
 

yooyo3d

Senior Member
Jul 22, 2011
109
30
Belgrade
I have set top box rockchip device. Bad thing is this device does not have power and volume buttons and it dont have microUSB port. It have 4 regular USB ports, ethernet, HDMI, composite and audio out. There is no way to connect to computer. Its based on rk3066. Internal name is rk30sdk.

I managed to root device (it was shipped with su), so I just added busybox and superuser. Using teminal emulation I managed to dump first four partitions using dd. Two of them is almost identical. Both starts with ANDROID and have same size and lots of data is identical.

Using kitchen tools I managed to unpack one of those partitions and access to zImage and other stuff. Then I build new zImage based on AndrewDB rockchip 3066 kernel source, replace zImage and create new boot.img file.

Because there is no way to connect device to PC, I transferred new boot.img on device then use dd to directly write into partition... and device wont boot anymore. :(

Now.. big question is how to write original kernel images. I have dumps, but I cant connect device to PC (no microUSB port). I cant switch device in flash recovery mode because there is no buttons on device.

Is there any guide how to deal with this situation?
 

mitcoes

Member
Feb 3, 2011
11
1
I have just bricked my tablet asking for the SD recovery method

http://forum.xda-developers.com/showthread.php?t=2386997

My problem is that it does not boot but I will try to setup my SD to restore the system

How must I do to setup it?

Is it ok to put the original .img from the vendor - I have it - or any other you know can run better? My goal after repairing is trying again to put inside a CM JB rom - perhaps trying without changing the bootloader -

Thanks in advance

PS: ypur post is the most similar to my problem, and I am glad you solved it
 
Last edited:

th3f33

Member
Sep 11, 2013
22
9
Midgar: sector 7
http://forum.xda-developers.com/showthread.php?t=2386997

My problem is that it does not boot but I will try to setup my SD to restore the system

How must I do to setup it?

Is it ok to put the original .img from the vendor - I have it - or any other you know can run better? My goal after repairing is trying again to put inside a CM JB rom - perhaps trying without changing the bootloader -

Thanks in advance

PS: your post is the most similar to my problem, and I am glad you solved it

afaik... you can flash it back as long as you can still access bootloader/loader/flashmode for the rk device.. good thing you have an original firmware, now there are different types of firmware, i think, in the researches ive done here some types that i still remember are Zip (Edify), FW (uhm, Firmware? i think this is the true Firmware file), and Image/Images in IMG format, (multiple images. i think these are dump / backup files, and a Orig.img which is also flashable in batchtools, right?)

-if you have the original.img from the vendor (Image, if you can take a peek in the content, go check if it has something like a res folder or other imgs inside) you can just simply flash it back, as long as your device can boot to loader/flashmode. can be flashed by rkflash,rkbatch(not really sure), rkflash_tools or any other compatible flasher, double check the start address or device partition parameters in the flasher, if there was any, this was the first major error that i did to my tablet, flashed a wrong cwm recovery in the incorrect start address. rkbatchtool doesnot have these i think but rkflashtool does

-if you have the original.zip from the vendor, you can put this file in the root of a external or internal sd(Adb push to copy in the internal).. You must be able to access the recovery mode for your device. You can adb remount, adb push orig.zip /mnt/sdcard or external_sd or somewhere else where you can push file. then apply update or restore from zip package, to avoid errors and make a clean update/restore, wipe data and cache before doing the steps. more option / tools / command / advanced and much easier if you have already installed a WORKING CWM.

-- you can access recovery mode by adb , removing/clearing the system partition(Not really sure but happened to me, boot priorities of my device is system - recovery - bootloader/flash), or by button combination, which is usually the vol+ and power, must do the combination while the device is off and hold it for a few seconds...

-if you have an original.fw, use batchtools to flash it back, the most easiest way for me to flash a fw for a rk device, but also the most difficult to find rom compatible, Cant use backup.img or tar or dump.imgs here, it checks for a certain structure.

-if update.img or update.zip from the vendor, you can try pushing/copying it to the root folder of your sdcard or external_sd. push it in the /mnt folder

im currently on my 5th day in my android venture, and will be around, im still trying to fix some remaining errors in the dumps of my unpopular unsupported device. :) I will be around if i can help,

oh and if you cant detect your device, try these...
-double check then make a final check that you have installed the flash driver for your device, usually attached with the flashtools. and make sure that no unknown device or device with no drivers in windows.

-Reset button then plug, wait for a few seconds, scan hardware changes,,, if still not...

-Hold Reset Button, then plug it to computer, and if the device led is off or does not turn on, press/hold the power button, this will light up the leds, but if you dont release the reset button before you release the power, it will be turned off again.

-if all else fail, you will have to look for the nand chip, and pray that it is a hynix one, especially the h27ucg8t2atr or hynix 27 8gb, other variants or hynix nand can still be entered to mask rom mod. if you are lucky, you might find a jumper/switch on the board that will make it automatically a factory built device or masked rom mode,. This is how i revived my tablet, after fully bricking it by nand idb erase + flashing incorrect parameter
and leaving my device with no loader no recovery no system no kernel :))

EDIT:
i've just checked the link, and i saw that you are fully bricked unreadable, you might need to open up your tablet, try first some of what ive written, until you are 100% or almost 100% sure that you cannot detect the device in any way,

use an rk flashtool, especially made for rk29 devices i think, 1.37 is the highest version i've found but i am using a 1.35 moded by finless to flash.

extract you original fw, into multiple images,

most important parts are
Loader.bin
Parameter
kernel.img


i think even without these other images you can now start detecting your device in usb, reinstall the drivers, as it will be a fresh device out of the box after reloading the loader.bin find a compatible rk2918Loader.bin. use our bestfriend, google, :)

boot.img
recovery.img
system.img

my device are also detectable in dead/off state where the device is turned off, (android debug tool compat device)
i think you can adb reboot bootloader here

if you can open up and makesure that your nandchip is the same as what i am talking about in the previous step regarding the nand, You can follow finless steps in enteing masked rom, or follow these for a shorter (Actually these is pretty long already :) )


0 Press reset or make sure 100% that your device is turned off

1 remove any charger/usb connector first.

2 locate the nandchip, might be close to the processor chip or edge. You can find a HYNIX, if it is a hynix nand, and the h27-model id or hy/hc-model id

if the same chip with the h27ucg8t2atr (or chip with same hardware features, NOT SPECS)
just count 8 from the top of the legs/pins of the chip in the left, (UPPER LEFT IS 1), in the position where you can normally read the letters/numbers. A magnifying glass can surely help in this process, plus with an aid of assistant,

then after you located the 8th pin, connect it to pin 9, next pin below the 8th, with any metal or tools that can short circuit the two pins. In my case, ive used a flat end precision kit (size 2.0 flat) to short circuit it, it fits in the middle of the two leg so it will be mounted and can avoid misalignment while we do this

Hold the jumper tool or keep it short circuited then insert the cable to the PC, Call your assistant if you have one,

then once you see the masked rom mode, You can release the short circuit and start flashing.

some important Facts:

Run as admin the Tools in win vista or higher just to make sure it works 100%

advice,

For safety precaution, remove any other removable device (including lcds, connected with a flex cables and power cable, memory cards, etc.




If you did all that and still not able to revive your device, (ive done most of what i've typed and revived mine, WITHOUT ORIG FW from the Factory or any other firmware file for my device, CREDITS to LEONAS btw because he made a CWM recovery for my device from my dump of recovery.img and provided some assistance, i have 1 romdump and 1 nandroid/cwm backup from a working and a semi working state.)

last option, (based on my logic, just a simple theory,) Go buy a new compatible nand for your device, better yet, buy a similar and read the manual, especially the pin shorting if it has any way to fool your board & procie or cpu that you have no NAND installed. If no option to do that , might be able to do a workaround with unsoldering the nand, or power legs of nand, then make it get detected with no nand then Support it with you hand, to fully connect the legs, and make a flash to it... just hope that it works, didnt get to the point where i had to test my theory....

Hope you fix your tablet soon....

---------- Post added 2nd October 2013 at 12:20 AM ---------- Previous post was 1st October 2013 at 11:41 PM ----------

http://forum.xda-developers.com/showthread.php?t=2386997

My problem is that it does not boot but I will try to setup my SD to restore the system

How must I do to setup it?

Is it ok to put the original .img from the vendor - I have it - or any other you know can run better? My goal after repairing is trying again to put inside a CM JB rom - perhaps trying without changing the bootloader -

Thanks in advance

PS: ypur post is the most similar to my problem, and I am glad you solved it

ooops didnt notice that it is a month old unupdated thread but anyways this will be added to the search engines and will still be available if someone searched for the same keywords, hope that these infos help those who are in need.

---------- Post added at 12:32 AM ---------- Previous post was at 12:20 AM ----------

I have set top box rockchip device. Bad thing is this device does not have power and volume buttons and it dont have microUSB port. It have 4 regular USB ports, ethernet, HDMI, composite and audio out. There is no way to connect to computer. Its based on rk3066. Internal name is rk30sdk.

I managed to root device (it was shipped with su), so I just added busybox and superuser. Using teminal emulation I managed to dump first four partitions using dd. Two of them is almost identical. Both starts with ANDROID and have same size and lots of data is identical.

Using kitchen tools I managed to unpack one of those partitions and access to zImage and other stuff. Then I build new zImage based on AndrewDB rockchip 3066 kernel source, replace zImage and create new boot.img file.

Because there is no way to connect device to PC, I transferred new boot.img on device then use dd to directly write into partition... and device wont boot anymore. :(

Now.. big question is how to write original kernel images. I have dumps, but I cant connect device to PC (no microUSB port). I cant switch device in flash recovery mode because there is no buttons on device.

Is there any guide how to deal with this situation?



Try any ways to connect your device to the pc or any other android with usb on the go, or maybe yours have a usb on the go,

Then use adb tools

adb reboot bootloader,

or

if you had use a flasher, you can normally insert and turn on your device it will be pink in rkbatch tools or rock usb mass storage on rkflashtools then there is a button to reboot to flash mode

or

you can also connect to the pc and adb thru wifi,

or


i dont think you can flash it without making it connect to your pc in the most simple way, (wifi needs configs, cant flash thru wifi when bricked. Ethernet might work but may not too, just try anything and everything, )

you might be able to connect with ethernet, try adb listening to the port and ip of the device (Port is the allowed port for the device, specified in the system/build.prop if i am not mistaken, and you can also try default port. check in the router if any ip will be given for the device in the DHCP. ENABLE DHCP in the router first to make the device auto fetch ip from router, or if device have static ip , then try connecting thru it

you can try to look for a nand connector to pc, unsolder the nand from your device, connect to pc then mount it flash the rom, then resolder / remount it back to the device, (these are just my imagination i dont have any ideas how much fact is in there :) )


try usb M - usb M connector, i know that normal pc can communucate with that kind of cable, nor very sure though,
 
Last edited:

yooyo3d

Senior Member
Jul 22, 2011
109
30
Belgrade
Its fixed now. I have flash tool for Windows and crazy drivers (they won't install properly but forcing them to install works). Trick is to short connect recovery pins on board and turn on power. Connect device with USA A-A cable, using bottom left USB port on device. Then windows should detect rockchip class in device manager. Run flash tool, select firmware image and flash image.

Sent from my One using Tapatalk 4
 

mitcoes

Member
Feb 3, 2011
11
1
Thanks your post gave me some tricks to try - still bricked -

Thanks your post gave me some tricks to try - still bricked - I do use Manjaro Linux but I'll try with my old MS WOS 7 HDD I keep disconnected for rarities

afaik... you can flash it back as long as you can still access bootloader/loader/flashmode for the rk device.. good thing you have an original firmware, now there are different types of firmware, i think, in the researches ive done here some types that i still remember are Zip (Edify), FW (uhm, Firmware? i think this is the true Firmware file), and Image/Images in IMG format, (multiple images. i think these are dump / backup files, and a Orig.img which is also flashable in batchtools, right?)

-if you have the original.img from the vendor (Image, if you can take a peek in the content, go check if it has something like a res folder or other imgs inside) you can just simply flash it back, as long as your device can boot to loader/flashmode. can be flashed by rkflash,rkbatch(not really sure), rkflash_tools or any other compatible flasher, double check the start address or device partition parameters in the flasher, if there was any, this was the first major error that i did to my tablet, flashed a wrong cwm recovery in the incorrect start address. rkbatchtool doesnot have these i think but rkflashtool does

-if you have the original.zip from the vendor, you can put this file in the root of a external or internal sd(Adb push to copy in the internal).. You must be able to access the recovery mode for your device. You can adb remount, adb push orig.zip /mnt/sdcard or external_sd or somewhere else where you can push file. then apply update or restore from zip package, to avoid errors and make a clean update/restore, wipe data and cache before doing the steps. more option / tools / command / advanced and much easier if you have already installed a WORKING CWM.

-- you can access recovery mode by adb , removing/clearing the system partition(Not really sure but happened to me, boot priorities of my device is system - recovery - bootloader/flash), or by button combination, which is usually the vol+ and power, must do the combination while the device is off and hold it for a few seconds...

-if you have an original.fw, use batchtools to flash it back, the most easiest way for me to flash a fw for a rk device, but also the most difficult to find rom compatible, Cant use backup.img or tar or dump.imgs here, it checks for a certain structure.

-if update.img or update.zip from the vendor, you can try pushing/copying it to the root folder of your sdcard or external_sd. push it in the /mnt folder

im currently on my 5th day in my android venture, and will be around, im still trying to fix some remaining errors in the dumps of my unpopular unsupported device. :) I will be around if i can help,

oh and if you cant detect your device, try these...
-double check then make a final check that you have installed the flash driver for your device, usually attached with the flashtools. and make sure that no unknown device or device with no drivers in windows.

-Reset button then plug, wait for a few seconds, scan hardware changes,,, if still not...

-Hold Reset Button, then plug it to computer, and if the device led is off or does not turn on, press/hold the power button, this will light up the leds, but if you dont release the reset button before you release the power, it will be turned off again.

-if all else fail, you will have to look for the nand chip, and pray that it is a hynix one, especially the h27ucg8t2atr or hynix 27 8gb, other variants or hynix nand can still be entered to mask rom mod. if you are lucky, you might find a jumper/switch on the board that will make it automatically a factory built device or masked rom mode,. This is how i revived my tablet, after fully bricking it by nand idb erase + flashing incorrect parameter
and leaving my device with no loader no recovery no system no kernel :))

EDIT:
i've just checked the link, and i saw that you are fully bricked unreadable, you might need to open up your tablet, try first some of what ive written, until you are 100% or almost 100% sure that you cannot detect the device in any way,

use an rk flashtool, especially made for rk29 devices i think, 1.37 is the highest version i've found but i am using a 1.35 moded by finless to flash.

extract you original fw, into multiple images,

most important parts are
Loader.bin
Parameter
kernel.img


i think even without these other images you can now start detecting your device in usb, reinstall the drivers, as it will be a fresh device out of the box after reloading the loader.bin find a compatible rk2918Loader.bin. use our bestfriend, google, :)

boot.img
recovery.img
system.img

my device are also detectable in dead/off state where the device is turned off, (android debug tool compat device)
i think you can adb reboot bootloader here

if you can open up and makesure that your nandchip is the same as what i am talking about in the previous step regarding the nand, You can follow finless steps in enteing masked rom, or follow these for a shorter (Actually these is pretty long already :) )


0 Press reset or make sure 100% that your device is turned off

1 remove any charger/usb connector first.

2 locate the nandchip, might be close to the processor chip or edge. You can find a HYNIX, if it is a hynix nand, and the h27-model id or hy/hc-model id

if the same chip with the h27ucg8t2atr (or chip with same hardware features, NOT SPECS)
just count 8 from the top of the legs/pins of the chip in the left, (UPPER LEFT IS 1), in the position where you can normally read the letters/numbers. A magnifying glass can surely help in this process, plus with an aid of assistant,

then after you located the 8th pin, connect it to pin 9, next pin below the 8th, with any metal or tools that can short circuit the two pins. In my case, ive used a flat end precision kit (size 2.0 flat) to short circuit it, it fits in the middle of the two leg so it will be mounted and can avoid misalignment while we do this

Hold the jumper tool or keep it short circuited then insert the cable to the PC, Call your assistant if you have one,

then once you see the masked rom mode, You can release the short circuit and start flashing.

some important Facts:

Run as admin the Tools in win vista or higher just to make sure it works 100%

advice,

For safety precaution, remove any other removable device (including lcds, connected with a flex cables and power cable, memory cards, etc.




If you did all that and still not able to revive your device, (ive done most of what i've typed and revived mine, WITHOUT ORIG FW from the Factory or any other firmware file for my device, CREDITS to LEONAS btw because he made a CWM recovery for my device from my dump of recovery.img and provided some assistance, i have 1 romdump and 1 nandroid/cwm backup from a working and a semi working state.)

last option, (based on my logic, just a simple theory,) Go buy a new compatible nand for your device, better yet, buy a similar and read the manual, especially the pin shorting if it has any way to fool your board & procie or cpu that you have no NAND installed. If no option to do that , might be able to do a workaround with unsoldering the nand, or power legs of nand, then make it get detected with no nand then Support it with you hand, to fully connect the legs, and make a flash to it... just hope that it works, didnt get to the point where i had to test my theory....

Hope you fix your tablet soon....

---------- Post added 2nd October 2013 at 12:20 AM ---------- Previous post was 1st October 2013 at 11:41 PM ----------



ooops didnt notice that it is a month old unupdated thread but anyways this will be added to the search engines and will still be available if someone searched for the same keywords, hope that these infos help those who are in need.

---------- Post added at 12:32 AM ---------- Previous post was at 12:20 AM ----------





Try any ways to connect your device to the pc or any other android with usb on the go, or maybe yours have a usb on the go,

Then use adb tools

adb reboot bootloader,

or

if you had use a flasher, you can normally insert and turn on your device it will be pink in rkbatch tools or rock usb mass storage on rkflashtools then there is a button to reboot to flash mode

or

you can also connect to the pc and adb thru wifi,

or


i dont think you can flash it without making it connect to your pc in the most simple way, (wifi needs configs, cant flash thru wifi when bricked. Ethernet might work but may not too, just try anything and everything, )

you might be able to connect with ethernet, try adb listening to the port and ip of the device (Port is the allowed port for the device, specified in the system/build.prop if i am not mistaken, and you can also try default port. check in the router if any ip will be given for the device in the DHCP. ENABLE DHCP in the router first to make the device auto fetch ip from router, or if device have static ip , then try connecting thru it

you can try to look for a nand connector to pc, unsolder the nand from your device, connect to pc then mount it flash the rom, then resolder / remount it back to the device, (these are just my imagination i dont have any ideas how much fact is in there :) )


try usb M - usb M connector, i know that normal pc can communucate with that kind of cable, nor very sure though,
 

yooyo3d

Senior Member
Jul 22, 2011
109
30
Belgrade
Rockchip is unbrickable. All you need is:
- flash tool
- original image
- to put device in recovery mode (nand flash)
Last one is bit tricky and depends on device. I have set-top box based on rk3066 and it doesnt have any physical buttons. But, when I open it there is a pins on board marker with "recovery". So.. turn off your device, connect with PC using usb cable, connect recovery pins and connect charger. Keep recovery pin connected 5-10 sec. PC should detect device. On windows you need proper driver. On linux, im not sure.. I didnt try yet.
Then just flash device and after its finished device should start regular boot.
This is my experience based on settop box. I dont have any rk based tablet, but I think procedure is more or less same. Entering in recovery depends on manufacturer.
 

SpaceCaker

Senior Member
Mar 26, 2011
13,545
10,904
netherlands
www.youtube.com
Rockchip is unbrickable. All you need is:
- flash tool
- original image
- to put device in recovery mode (nand flash)
Last one is bit tricky and depends on device. I have set-top box based on rk3066 and it doesnt have any physical buttons. But, when I open it there is a pins on board marker with "recovery". So.. turn off your device, connect with PC using usb cable, connect recovery pins and connect charger. Keep recovery pin connected 5-10 sec. PC should detect device. On windows you need proper driver. On linux, im not sure.. I didnt try yet.
Then just flash device and after its finished device should start regular boot.
This is my experience based on settop box. I dont have any rk based tablet, but I think procedure is more or less same. Entering in recovery depends on manufacturer.

can u show a photo of recovery pin ?

Sent from my S500 using xda app-developers app
 

Top Liked Posts

  • There are no posts matching your filters.
  • 14
    Hi,

    Because I don't run Windows nor NetBSD, I rewrote rkflash from scratch with the use of libusb-1.0, so you can now read and write your rk2818-based tablet's flash memory under Linux (also w/o the need to root your tablet). Credit for reverse-engineering the protocol goes to the original author of rkflash (see source).

    Small guide

    - unzip the file
    - compile

    Linux (Debian, Ubuntu, ...)
    Code:
    sudo apt-get install libusb-1.0-0-dev
    gcc -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall -s

    Mac OS X (thanks to surfer63, binary here)
    Code:
    sudo port install libusb
    gcc -I/opt/local/include -I/opt/local/include/libusb-1.0 \
    -L/opt/local/lib -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall

    Preparation
    - powerdown your tablet
    - disconnect all cables

    To get into flash mode differs for many tablets. Google around or use trial and error :)

    - insert the USB cable in computer
    - hold vol+ (or put on/off/locked-switch in the locked position)
    - insert the other end of your cable in the tablet
    - wait a few seconds
    - release vol+

    Now if you run lsusb, the following line should appear:

    Bus 001 Device 044: ID 2207:281a (290a for rk2918 based tablets)

    Bus and device number may be different. The screen of your tablet stays black.

    The USB device must be readable and writable for the user running rkflashtool. If that's not the case, you'll see an error like this:

    Code:
    $ ./rkflashtool b
    libusb couldn't open USB device /dev/bus/usb/001/048: Permission denied.
    libusb requires write access to USB device nodes.
    rkflashtool: fatal: cannot open device

    This can be fixed in several ways (chmod, run as root, udev rules) but that's beyond the scope of this posting. For now, chmod 666 the device mentioned in the error message.

    Usage of rkflashtool

    Code:
    $ ./rkflashtool
    rkflashtool: fatal: usage:
    	rkflashtool b                   	reboot device
    	rkflashtool r offset size >file 	read flash
    	rkflashtool w offset size <file 	write flash
    
    	offset and size are in units of 512 bytes

    On my tablet, the boot partition starts at offset 0x8000 (in blocks of 512 bytes)
    Its size is 0x2000 blocks
    To backup the partition, issue:

    Code:
    $ ./rkflashtool r 0x8000 0x2000 >boot.img.backup
    rkflashtool: info: interface claimed
    rkflashtool: info: reading flash memory at offset 0x00008000
    rkflashtool: info: reading flash memory at offset 0x00008020
    .......
    rkflashtool: info: reading flash memory at offset 0x00009fe0

    To write a new boot.img or an old backup back to the device:

    Code:
    $ ./rkflashtool w 0x8000 0x2000 <boot.img.backup
    rkflashtool: info: interface claimed
    rkflashtool: info: writing flash memory at offset 0x00008000
    rkflashtool: info: writing flash memory at offset 0x00008020
    .......
    rkflashtool: info: writing flash memory at offset 0x00009fe0

    You can find a list of all partitions of your tablet in the HWDEF file, which is inside the update.img for your tablet. If no such file is available, you can also look at /proc/cmdline on a running device (either through adb or a terminal app running on the device itself). Depending on the tablet, you might need root access to view /proc/cmdline. Another option is dumping the first 0x2000 blocks of nand flash by issuing rkflashtool r 0x0000 0x2000 >parm. View the file with hexedit, xxd, or a similar program. The kernel parameters contain a description of several mtd partitions (sizes and offsets).

    After reading and writing at will, you can reboot your tablet by issuing
    ./rkflashtool b

    Note that if your tablet has an on/off/locked-switch and it is still in the locked position, rebooting won't work.

    If the file you are writing is smaller than the specified size, the rest is padded with zeroes. If it's bigger, it will be truncated. This is different from rkflash, which will overwrite blocks beyond the partition size.
    rkflashtool does not support flashing a new bootloader directly.
    If you have a different tablet, please try rkflashtool b and r first before flashing (w) something new.
    Standard DISCLAIMER with regard to bricking your tablet applies.

    Enjoy! :)


    EDIT: better build instructions, clean up text
    EDIT2: works on rk2918 tablets too (tested on Arnova 7 G2) if you change the USB product id from 0x281a to 0x290a before compilation
    EDIT3: released version 2 of rkflashtool. now supports rk2918 tablets out of the box. if it doesn't find one, it falls back to rk2808/rk2818. also, updated the wording a bit.
    EDIT4: new mac osx binary
    EDIT5: more ways to find offsets and sizes of partitions on your tablet


    EDIT6: small emphasis changes above and...

    version 1 is here ONLY for archival purposes or if version 2 does not work on your rk28xx tablet. In all other cases, you need to download rkflashtool-v2.zip
    3
    If you are on OSX and have macports installed, you can do the following to build rkflashtool.
    Install libusb from Macports:
    Code:
    sudo port install libusb

    cd into the folder where your rkflashtool.c is is and run the following command:
    Code:
    gcc -I/opt/local/include -I/opt/local/include/libusb-1.0 \
    -L/opt/local/lib -o rkflashtool rkflashtool.c -lusb-1.0 -W -Wall

    This will build rkflashtool for your native environment (OSX version, hardware and config).


    --- removed the rest of the post as well as the attachments. He/She who is interested in building a complete universal distributable rkflashtool can ask via this thread ---
    2
    great! finally I can remove one line from my todo list :)
    thank you!

    EDIT:
    random notes (I don't see your code yet so it may be fixed, then sorry)
    * I always specify b(reboot) for rk2818 tablets with my rkflash because it hanged easily if I try to write multiple times without b
    * parameter file need to be converted with rkcrc -p. official RKAndroid tools flashed it 5 times with offsets. (read & check 1st 0x0-0x2000 block)
    * I logged how to update bootloader, but it's complicated and I could not understand :( probably bootloader can be updated via misc partition. see update-script in update.img. (but not recommended/no reason to do it)

    EDIT2:
    there is libusb for Windows and OS X. rkflashtool may work on them.

    on Windows, there is RKAndroidTool.exe (not batchupgrade). but "read" function in rkflash/rkflashtool may be useful on some case on Windows :)
    2
    I pushed latest my rkutils to https://github.com/naobsd/rkutils

    rkunpack can unpack RKFW image used in RK2918 ROM, RKAF image (update.img), KRNL/PARM image used in some single partition image. unpack will be done recursively.

    rkcrc can make KRNL/PARM images with -k/-p.

    rkafpack can make RKAF image. (I need to write docs/howtos...)

    little off-topic,
    latest RK2918 ROMs which is based on "SDK2.0", new format for boot.img/recovery.img is introduced. it's almost same as common boot.img format for android. unpackbootimg/mkbootimg can be used to unpack/repack it with one exception...
    there is SHA1 hash value in header of boot.img (offset 0x240 bytes). Rockchip changes it by some unknown way. normal mkbootimg can't generate same hash value as Rockchip, so we can't make custom boot.img with new format :(
    fortunately, we can split new boot.img, and we can make separate kernel.img and boot.img(ramdisk) like as pre-SDK2.0 RK2918 ROMs, which is loadable with new bootloader in SDK2.0 ROMs.

    --
    btw I just found interesting one: https://github.com/jhonxie/rk2918_tools
    2
    can anyone tell me how to flash from unix device like ubuntu, .. using rkflashtool, .. how do i know that i have the correct size and offset?

    Ok, I try to explain. I done it with Jolicloud, which is based on some old ubuntu version, but it actually does not matter.

    First make sure you have connected the pad and put it into flashmode (like I had to press [volume down] while connecting usb cable)

    Best check with lsusb on command line.
    Try to read the flash header like:
    rkflashtool r 0x0000 0x2000 >header

    Have a look at this file with some hex tool (xxd) or just open it in a text editor (nano, vi). Quite at the beginning there should be something like
    CMDLINE: console=...

    Follow this text until you see some memory sizes and regions like 0x00002000 0x00002000(misc) and so on. Those are your offsets and sizes. Search for the (system) one. On my pad its 0x00080000 0x0000E000, where 0x00080000 is the size (256MB) and 0x0000E000 is the offset.

    Read system.img:
    rkflashtool r 0xE000 0x80000 >system.img

    Mount system.img to e.g. /mnt/system:
    mount -t cramfs -o loop system.img /mnt/system

    Copy contents to another dir
    mkdir /home/user/mysystem
    cp -rf /mnt/system/* /home/user/mysystem
    [EDIT]
    thanks to ivops follow-up post, you better use the -a option like this:
    cp -a /mnt/system/* /home/user/mysystem
    [/EDIT]
    chown and chmod mysystem
    chown root:root /home/user/mysystem
    chmod 777 /home/usr/mysystem

    do whatever you want to change in your system-dir (direct changes in cramfs are not possible, thats why you have to copy stuff in another dir!)
    Things you might want to change are:

    cp su /home/user/mysystem/bin
    chmod 6755 /home/user/mysystem/bin/su
    (roots your device :), make sure to have a proper su binary)

    then repack all the stuff:
    mkcramfs /home/user/mysystem newsystem.img

    and flash it back:
    rkflashtool w 0xE000 0x80000 <newsystem.img

    BE CAREFUL WITH TYPOS!

    Do not bother if the new system.img is much smaller than the one you read from flash. When reading from flash you read the whole 256MB, even if only 130MB are used. rkflashttool will take care of it and fill the rest up with ones or zeros :)

    Good luck.
    BTW: If you do something wrong, you always can reflash with an original update.img from your vendor.

    Questions?