Difference between revisions of "Hack A10 devices"
(→Get a console) |
(→Get a console) |
||
Line 60: | Line 60: | ||
== Get a console == | == Get a console == | ||
− | Allwinner uses a config file for hardware configuration, a config file is a Windows ini file, you can download the config file for novo7 advanced [http://goo.gl/QKXn6 | + | Allwinner uses a config file for hardware configuration, a config file is a Windows ini file, you can download the config file for novo7 advanced [http://goo.gl/QKXn6 sys_config1.fex], which is something like this. |
<pre> | <pre> | ||
[uart_para] | [uart_para] | ||
Line 114: | Line 114: | ||
</pre> | </pre> | ||
− | To get the param working you need | + | To get the param working you need a pc tool, download the linux version [http://goo.gl/Zwhbk script]. This tool parses the ini file, and write the data to a bin file. Execute the downloaded program on your desktop |
+ | <pre> | ||
+ | $./script sys_config1.fex | ||
+ | argc = 2 | ||
+ | input name sys_config1.fex | ||
+ | Script 1 source file Path=/tmp/sys_config1.fex | ||
+ | Script 1 bin file Path=/tmp/sys_config1.bin | ||
+ | parser 1 file ok | ||
+ | </pre> | ||
+ | you will get a file called sys_config1.bin. |
Revision as of 23:10, 25 December 2011
Hack A10 Devices
This page describe how to hack a A10 powered tablet and let a custom kernel to run on the tablet. The work was done on an Ainol Novo 7 Advanced tablet. But should be working on all A10 based tablet. Since A10 can boot from usb, never worry about bricking your device.
First sight
The stock firmware in my Novo7 is android 2.3.4. With android adb i can log into the device and take a look at inside.
# mkdir /sdcard/nanda # mount -t vfat /dev/block/nanda /sdcard/nanda # ls /sdcard/nanda boot.axf boot.ini drv_de.drv font24.sft font32.sft linux os_show script.bin script0.bin sprite sprite.axf magic.bin
# ls /sdcard/nanda/linux bImage linux.ini params paramsr recovery.ini
# cat /sdcard/nanda/linux/linux.ini [segment] img_name = c:\linux\bImage img_size = 0x2000000 img_base = 0x40008000 [segment] img_name = c:\linux\params img_size = 0x100 img_base = 0x40000100 [script_info] script_base = 0x43000000 script_size = 0x10000 [logo_info] logo_name = c:\linux\android.bmp logo_address = 0x48000000 logo_show = 1
As you can see the linux/bImage is our kernel, and the linux/linux.ini is a config file that some loader reads, and load the file bImage to 0x40008000 address. And the file linux/params is the kernel cmdline.
# cat /sdcard/nanda/linux/params console=ttyS0,115200 root=/dev/nandb rw init=/init fbmem=32M@0x5a000000 loglevel=8;
And recovery.ini and paramsr is for android recovery boot and cmdline.
Get a console
Allwinner uses a config file for hardware configuration, a config file is a Windows ini file, you can download the config file for novo7 advanced sys_config1.fex, which is something like this.
[uart_para] uart_debug_port = 0 uart_debug_tx =port:PB22<2> uart_debug_rx =port:PB23<2>
The A10 uart rx and tx pin can be configured by software, usually PB22 and PB23 are for uart rx and tx, PF2 and PF4 for sdcard. But software can change this, let PF2 and PF4 be the uart rx and tx and disable sdcard, thus the usual sdcard clock pin and data3 pin is uart rx and tx. So with a TTL serial to USB cable, you can get a console from the sdcard slot.
change the following two places in the sys_config1.fex
[uart_para] uart_debug_port = 0 uart_debug_tx =port:PB22<2> uart_debug_rx =port:PB23<2>
[uart_para0] uart_used = 1 uart_port = 0 uart_type = 2 uart_tx =port:PB22<2> uart_rx =port:PB23<2>
[mmc0_para] sdc_used =1 sdc_detmode = 1 bus_width = 4
to
[uart_para] uart_debug_port = 0 uart_debug_tx = port:PF2<2> uart_debug_rx = port:PF4<2>
[uart_para0] uart_used = 1 uart_port = 0 uart_type = 2 uart_tx = port:PF2<2> uart_rx = port:PF4<2>
(disable sdcard0)
[mmc0_para] sdc_used = 0 sdc_detmode = 1 bus_width = 4
To get the param working you need a pc tool, download the linux version script. This tool parses the ini file, and write the data to a bin file. Execute the downloaded program on your desktop
$./script sys_config1.fex argc = 2 input name sys_config1.fex Script 1 source file Path=/tmp/sys_config1.fex Script 1 bin file Path=/tmp/sys_config1.bin parser 1 file ok
you will get a file called sys_config1.bin.