Difference between revisions of "Hack A10 devices"
(→Get a console) |
(→Get a console) |
||
Line 124: | Line 124: | ||
</pre> | </pre> | ||
you will get a file called sys_config1.bin. | you will get a file called sys_config1.bin. | ||
+ | Now push it to the device | ||
+ | <pre> | ||
+ | $adb push sys_config1.bin /sdcard/nanda | ||
+ | 3819 KB/s (40648 bytes in 0.010s) | ||
+ | $adb shell | ||
+ | #cd /sdcard/nanda | ||
+ | #ls | ||
+ | boot.axf | ||
+ | boot.ini | ||
+ | drv_de.drv | ||
+ | font24.sft | ||
+ | font32.sft | ||
+ | linux | ||
+ | os_show | ||
+ | script.bin | ||
+ | script0.bin | ||
+ | sprite | ||
+ | sprite.axf | ||
+ | magic.bin | ||
+ | sys_config1.bin | ||
+ | </pre> |
Revision as of 23:17, 25 December 2011
Hack A10 Devices
This page describe how to hack a A10 powered tablet and let a custom kernel to run on the tablet. The work was done on an Ainol Novo 7 Advanced tablet. But should be working on all A10 based tablet. Since A10 can boot from usb, never worry about bricking your device.
First sight
The stock firmware in my Novo7 is android 2.3.4. With android adb i can log into the device and take a look at inside.
# mkdir /sdcard/nanda # mount -t vfat /dev/block/nanda /sdcard/nanda # ls /sdcard/nanda boot.axf boot.ini drv_de.drv font24.sft font32.sft linux os_show script.bin script0.bin sprite sprite.axf magic.bin
# ls /sdcard/nanda/linux bImage linux.ini params paramsr recovery.ini
# cat /sdcard/nanda/linux/linux.ini [segment] img_name = c:\linux\bImage img_size = 0x2000000 img_base = 0x40008000 [segment] img_name = c:\linux\params img_size = 0x100 img_base = 0x40000100 [script_info] script_base = 0x43000000 script_size = 0x10000 [logo_info] logo_name = c:\linux\android.bmp logo_address = 0x48000000 logo_show = 1
As you can see the linux/bImage is our kernel, and the linux/linux.ini is a config file that some loader reads, and load the file bImage to 0x40008000 address. And the file linux/params is the kernel cmdline.
# cat /sdcard/nanda/linux/params console=ttyS0,115200 root=/dev/nandb rw init=/init fbmem=32M@0x5a000000 loglevel=8;
And recovery.ini and paramsr is for android recovery boot and cmdline.
Get a console
Allwinner uses a config file for hardware configuration, a config file is a Windows ini file, you can download the config file for novo7 advanced sys_config1.fex, which is something like this.
[uart_para] uart_debug_port = 0 uart_debug_tx =port:PB22<2> uart_debug_rx =port:PB23<2>
The A10 uart rx and tx pin can be configured by software, usually PB22 and PB23 are for uart rx and tx, PF2 and PF4 for sdcard. But software can change this, let PF2 and PF4 be the uart rx and tx and disable sdcard, thus the usual sdcard clock pin and data3 pin is uart rx and tx. So with a TTL serial to USB cable, you can get a console from the sdcard slot.
change the following two places in the sys_config1.fex
[uart_para] uart_debug_port = 0 uart_debug_tx =port:PB22<2> uart_debug_rx =port:PB23<2>
[uart_para0] uart_used = 1 uart_port = 0 uart_type = 2 uart_tx =port:PB22<2> uart_rx =port:PB23<2>
[mmc0_para] sdc_used =1 sdc_detmode = 1 bus_width = 4
to
[uart_para] uart_debug_port = 0 uart_debug_tx = port:PF2<2> uart_debug_rx = port:PF4<2>
[uart_para0] uart_used = 1 uart_port = 0 uart_type = 2 uart_tx = port:PF2<2> uart_rx = port:PF4<2>
(disable sdcard0)
[mmc0_para] sdc_used = 0 sdc_detmode = 1 bus_width = 4
To get the param working you need a pc tool, download the linux version script. This tool parses the ini file, and write the data to a bin file. Execute the downloaded program on your desktop
$./script sys_config1.fex argc = 2 input name sys_config1.fex Script 1 source file Path=/tmp/sys_config1.fex Script 1 bin file Path=/tmp/sys_config1.bin parser 1 file ok
you will get a file called sys_config1.bin. Now push it to the device
$adb push sys_config1.bin /sdcard/nanda 3819 KB/s (40648 bytes in 0.010s) $adb shell #cd /sdcard/nanda #ls boot.axf boot.ini drv_de.drv font24.sft font32.sft linux os_show script.bin script0.bin sprite sprite.axf magic.bin sys_config1.bin