Android Tablets Forum banner

Brainstorming Let's Defeat the Batch 3 Lockdown

5K views 22 replies 4 participants last post by  fuser-invent 
#1 ·
Hello all. I'd like to gather all information into one place concerning the batch 3 Crystal 7. The goal is to eventually completely unlock this thing & have the low level hardware knowledge to make it completely customizable, & unbrickable. I'm still somewhat of a beginner myself, & my knowledge is a bit low, but I'd like to help contribute to this in any way I can. I'll start by posting all that I've found so far.

Anyone & everyone, please post here any knowledge you may have that would help to break into & reverse engineer this device, whether it be pictures, or whole schematics of the CPU & board. Such things from other, similar devices should be good to. Anything we can come up with here will likely carry over to other, similar devices as well, & vice versa.

(The following is all cut & paste from other posts I made)

Novo7Crystal
  • SN: 121208G19016
  • Android Version: 4.1.1
  • Build Number: 20121218
  • Completely Stock / Untouched

Kernel version
3.0.8-gcda87f3-dirty
chengnan.tan@droid07-sz))
#8 SMP PREEMPT Tue Dec 18 11:06:45 CST 2012

OUTPUT OF "DF"
/*16GB microSD card currently installed*/

root@android:/ # df
Filesystem Size Used Free Blksize
/dev 439M 64K 439M 4096
/mnt/asec 439M 0K 439M 4096
/mnt/obb 439M 0K 439M 4096
/system 910M 283M 627M 4096
/data 910M 27M 883M 4096
/cache 255M 18M 237M 4096
/storage/sdcard0 5G 462M 4G 4096
/mnt/secure/asec 5G 462M 4G 4096
/storage/sdcard0/external_sdcard 14G 96K 14G 32768
root@android:/ #

OUTPUT OF "MOUNT"

root@android:/ # mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
ubi0_0 /system ubifs ro,relatime 0 0
ubi1_0 /data ubifs rw,nosuid,nodev,relatime 0 0
/dev/block/mtdblock6 /cache yaffs2 rw,nosuid,nodev,relatime 0 0
none /proc/bus/usb usbfs rw,relatime 0 0
/dev/block/vold/250:33 /storage/sdcard0 vfat rw,dirsync,nosuid,nodev,noexec,relatime,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/250:33 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /storage/sdcard0/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/vold/253:1 /storage/sdcard0/external_sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
root@android:/ #

I pulled the entire system folder using adb pull, & other files & folders as well. I wanted to do this before I attempt flashing clockworkmod. For now, I uploaded whatever files I thought might be important ones. Included are build.prop, fstab, & plenty of others. Everything's on my Google Drive, public for all to download. It might be easier to just download the entire folder. If there are any other files you need, please feel free to let me know. Please keep in mind that I took all these off of the running system with adb pull. Next, I'll delve into flashing clockworkmod for backups.

https://docs.google....VYxcWhVSm8/edit

Here are images of the bootloader, recovery, & boot partitions.
These files were all pulled from /dev/mtd/

-aml_logo.img
-boot.img
-bootloader.img
-logo.img
-recovery.img

They were pulled with the dd command as follows:

dd if=/dev/mtd/mtd0 of=/storage/sdcard0/external_sdcard/bootloader.img
dd if=/dev/mtd/mtd1 of=/storage/sdcard0/external_sdcard/logo.img
dd if=/dev/mtd/mtd2 of=/storage/sdcard0/external_sdcard/aml_logo.img
dd if=/dev/mtd/mtd3 of=/storage/sdcard0/external_sdcard/recovery.img
dd if=/dev/mtd/mtd4 of=/storage/sdcard0/external_sdcard/boot.img

The logos are unimportant, but I pulled them anyway.

I didn't pull the system or data partitions because they are mounted. The stock recovery does not allow adb to function, & there is no fastboot. As a side note, I found that you CANNOT boot into the stock recovery while the USB cable is plugged in. It only works when the device is unplugged.

https://docs.google....DBIYVpqS0k/edit
 
See less See more
#2 · (Edited by Moderator)
(More cut & paste)

Internal Pics.

[hr]

Passive circuit component Circuit component Hardware programmer Computer hardware Electronic engineering

Tab opened up.

[hr]
Handwriting Rectangle Font Asphalt Tints and shades

HRX07009024A 2012-11-18

[hr]
Water Hand Liquid Blue Azure

FPC-T70P13V2 2012-09-17-GR

[hr]
Liquid Blue Azure Fluid Rectangle

HOTATOUCH C186116A1-PG FPC635DR

[hr]
Rectangle Font Circuit component Electronic device Composite material

Battery & camera.

[hr]
Circuit component Passive circuit component Hardware programmer Amber Electronic engineering

Board = AINOL_NOVO703AC-E2_V01 2012/07/11

[hr]
 

Attachments

#3 ·
More pics.

[hr]

Passive circuit component Circuit component Black Hardware programmer Computer


Screen connectors.

[hr]
Circuit component Passive circuit component Hardware programmer Electronic engineering Electronic component



FT5206GE1 Multi-Touch Capacitive Touch Panel Controller

WM8960G 29AFDPR Codec with Class D Speaker Driver (Thanks Tzul)


[hr]
Passive circuit component Circuit component Black Hardware programmer Electronic component


CPU is covered.

[hr]
Passive circuit component Circuit component Hardware programmer Microcontroller Electronic component



REALTEK RTL8188EUS WIFI Module IEEE 802.11b/g/n compatible WLAN

AXP202 Single Cell Li-Battery PWM Charger and Power System Management IC

(I see some JTAG ports GND TX RX)


[hr]
Passive circuit component Circuit component Hardware programmer Electronic engineering Microcontroller



AML8726-MX CPU

hynix H5TQ2G83CFR DDR3 SDRAM

29F64G08CBABA MLC Flash Memory Chips from Micron, Single Piece 8GB

(I see the rest of the JTAG ports TMS TCK TDO TDI)

[hr]
All pics high quality & full resolution available here:

https://docs.google....k4yU1I1aTA/edit
 

Attachments

#5 ·
Now, I've been trying to mess around with the image files a bit. boot.img is the only one I've really been concentrating on. Still learning. Here's what I got so far...

RECOVERY.IMG

[root@3ndymion-laptop HACK]# file recovery.img
recovery.img: u-boot legacy uImage, Linux-3.0.8-gcda87f3-dirty, Linux/ARM, OS Kernel Image (lzma), 3794709 bytes, Tue Dec 18 03:05:40 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x8D17698A, Data CRC: 0x619CF221
[root@3ndymion-laptop HACK]#
[root@3ndymion-laptop HACK]# hexdump -C recovery.img > recovery_hexdump.txt
[root@3ndymion-laptop HACK]#

https://docs.google....jk2ckwzUzQ/edit
 
#6 ·
BOOTLOADER.IMG

[root@3ndymion-laptop HACK]# file bootloader.img
bootloader.img: x86 boot sector; partition 1: ID=0xb, starthead 0, startsector 16065, 7711200 sectors, code offset 0x0, OEM-ID "\352`\361\237\345`\361\237", Bytes/sector 24805, sectors/cluster 241, reserved sectors 58783, FATs 96, root entries 40945, sectors 24805 (volumes <=32 MB) , Media descriptor 0xf1, sectors/FAT 58783, heads 159, hidden sectors 3852464480, sectors 3852403044 (volumes > 32 MB) , reserved 0x10, dos < 4.0 BootSector (0xa0)
[root@3ndymion-laptop HACK]#
[root@3ndymion-laptop HACK]# hexdump -C bootloader.img > bootloader_hexdump.txt
[root@3ndymion-laptop HACK]#

(The data in here is very small. It's basically 8MB of zeros. I think the answers may lie in here.)

https://docs.google....1ZLanJGXzA/edit
 
#7 ·
BOOT.IMG

I could be wrong, but from what I know, a boot.img usually consists of a header, the kernel, & the ramdisk. Supposedly, the kernel & ramdisk are packed together with gzip or something like that, & then packed again with cpio. I have seen from google searching that it's possible to unzip them, & then un-cpio them, to get the fully extracted kernel & init ramdisk files. I have also seen that it's then possible to actually mount the kernel's filesystem onto your current, running hard drive & mess around with the folders & files in there. Then, you can save it, unmount, cpio them, re-zip them, & pack them all together again.

Unfortunately, my mind is blown right now. : P If anyone out there knows how to do this, please help. Or if you don't have the resources to do it, then please tell me or anyone else what to do. I'm stuck here, & quite a bit confused too.

[root@3ndymion-laptop HACK]# file boot.img
boot.img: u-boot legacy uImage, Linux-3.0.8-gcda87f3-dirty, Linux/ARM, OS Kernel Image (lzma), 3609713 bytes, Tue Dec 18 03:07:02 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x59593760, Data CRC: 0x21149493
[root@3ndymion-laptop HACK]#

[root@3ndymion-laptop HACK]# binwalk boot.img

DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x59593760, created: Tue Dec 18 03:07:02 2012, image size: 3609713 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x21149493, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: lzma, image name: Linux-3.0.8-gcda87f3-dirty

[root@3ndymion-laptop HACK]#
[root@3ndymion-laptop HACK]# hexdump -C boot.img > boot_hexdump.txt
[root@3ndymion-laptop HACK]#

https://docs.google....EJtUGJBbms/edit

###Looks like this has a header that's 64 bytes long, & is packed with lzma, but I only see the kernel. Only one file packed in here???
###Let's strip the header off...

[root@3ndymion-laptop HACK]# dd if=boot.img of=header bs=1 count=64
64+0 records in
64+0 records out
64 bytes (64
copied, 0.000695789 s, 92.0 kB/s
[root@3ndymion-laptop HACK]#

https://docs.google....FIyNWpPNFk/edit

###Now let's strip all the data after the header... (is this where I'm going wrong???)

[root@3ndymion-laptop HACK]# dd if=boot.img of=kernel.lzma bs=1 skip=64 count=3609713
3609713+0 records in
3609713+0 records out
3609713 bytes (3.6 MB) copied, 8.85686 s, 408 kB/s
[root@3ndymion-laptop HACK]#
[root@3ndymion-laptop HACK]# lzma -d kernel.lzma
[root@3ndymion-laptop HACK]# file kernel
kernel: data
[root@3ndymion-laptop HACK]#

###Hmmmm...

[root@3ndymion-laptop HACK]# binwalk kernel

DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
169120 0x294A0 ELF 32-bit LSB executable, ARM, version 1 (SYSV)
310024 0x4BB08 LZMA compressed data, properties: 0x82, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes
310104 0x4BB58 LZMA compressed data, properties: 0x8D, dictionary size: 16777216 bytes, uncompressed size: 805306368 bytes
310184 0x4BBA8 LZMA compressed data, properties: 0xAD, dictionary size: 50331648 bytes, uncompressed size: 7340032 bytes
374308 0x5B624 ELF 32-bit LSB relocatable, ARM, version 1 (SYSV)
482222 0x75BAE JFFS2 filesystem data big endian, JFFS node length: 3621
500137 0x7A1A9 JFFS2 filesystem (old) data big endian, JFFS node length: 131084
h633584 0x9AAF0 LZMA compressed data, properties: 0xD0, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
633777 0x9ABB1 LZMA compressed data, properties: 0xCB, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
633796 0x9ABC4 LZMA compressed data, properties: 0xB0, dictionary size: 50331648 bytes, uncompressed size: 101479424 bytes
633817 0x9ABD9 LZMA compressed data, properties: 0xB0, dictionary size: 33554432 bytes, uncompressed size: 10432512 bytes
633837 0x9ABED LZMA compressed data, properties: 0xBF, dictionary size: 33554432 bytes, uncompressed size: 816128 bytes
633931 0x9AC4B LZMA compressed data, properties: 0xDF, dictionary size: 33554432 bytes, uncompressed size: 816128 bytes
635550 0x9B29E LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
635580 0x9B2BC LZMA compressed data, properties: 0x8C, dictionary size: 16777216 bytes, uncompressed size: 20736 bytes
635610 0x9B2DA LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
635629 0x9B2ED LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
635767 0x9B377 LZMA compressed data, properties: 0xCC, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
m641762 0x9CAE2 LZMA compressed data, properties: 0xA0, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
643088 0x9D010 LZMA compressed data, properties: 0xE0, dictionary size: 33554432 bytes, uncompressed size: 1604864 bytes
643342 0x9D10E LZMA compressed data, properties: 0xCC, dictionary size: 33554432 bytes, uncompressed size: 10435584 bytes
643459 0x9D183 LZMA compressed data, properties: 0xCB, dictionary size: 16777216 bytes, uncompressed size: 21248 bytes
643478 0x9D196 LZMA compressed data, properties: 0xCC, dictionary size: 33554432 bytes, uncompressed size: 10435584 bytes
m646987 0x9DF4B LZMA compressed data, properties: 0xA4, dictionary size: 33554432 bytes, uncompressed size: 2129152 bytes
647018 0x9DF6A LZMA compressed data, properties: 0xA4, dictionary size: 16777216 bytes, uncompressed size: 23040 bytes
647068 0x9DF9C LZMA compressed data, properties: 0xA4, dictionary size: 16777216 bytes, uncompressed size: 22784 bytes
647119 0x9DFCF LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
647151 0x9DFEF LZMA compressed data, properties: 0xDF, dictionary size: 16777216 bytes, uncompressed size: 21248 bytes
647170 0x9E002 LZMA compressed data, properties: 0xD4, dictionary size: 50331648 bytes, uncompressed size: 13660160 bytes
647191 0x9E017 LZMA compressed data, properties: 0xD4, dictionary size: 33554432 bytes, uncompressed size: 10432768 bytes
648519 0x9E547 LZMA compressed data, properties: 0xDC, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
648550 0x9E566 LZMA compressed data, properties: 0xDC, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
648580 0x9E584 LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 20736 bytes
648610 0x9E5A2 LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
648641 0x9E5C1 LZMA compressed data, properties: 0xB4, dictionary size: 33554432 bytes, uncompressed size: 10432512 bytes
649953 0x9EAE1 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
649972 0x9EAF4 LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
681584 0xA6670 LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
681624 0xA6698 LZMA compressed data, properties: 0x97, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes
681704 0xA66E8 LZMA compressed data, properties: 0xA1, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes
681864 0xA6788 LZMA compressed data, properties: 0xCA, dictionary size: 134217728 bytes, uncompressed size: 50331648 bytes
681944 0xA67D8 LZMA compressed data, properties: 0xDF, dictionary size: 16777216 bytes, uncompressed size: 805306368 bytes
769412 0xBBD84 ELF 32-bit LSB relocatable, ARM, version 1 (SYSV)
1013941 0xF78B5 JFFS2 filesystem (old) data big endian, JFFS node length: 140032
1109357 0x10ED6D JFFS2 filesystem (old) data big endian, JFFS node length: 547
1145642 0x117B2A JFFS2 filesystem (old) data big endian, JFFS node length: 547
1289922 0x13AEC2 JFFS2 filesystem data big endian, JFFS node length: 2
1415140 0x1597E4 JFFS2 filesystem (old) data little endian, JFFS node length: 59444
1415168 0x159800 JFFS2 filesystem (old) data little endian, JFFS node length: 59680
1415196 0x15981C JFFS2 filesystem (old) data little endian, JFFS node length: 60036
1415232 0x159840 JFFS2 filesystem (old) data little endian, JFFS node length: 60284
1415256 0x159858 JFFS2 filesystem (old) data little endian, JFFS node length: 60316
1415284 0x159874 JFFS2 filesystem (old) data little endian, JFFS node length: 60524
1415316 0x159894 JFFS2 filesystem (old) data little endian, JFFS node length: 61028
1415348 0x1598B4 JFFS2 filesystem (old) data little endian, JFFS node length: 61332
1415376 0x1598D0 JFFS2 filesystem (old) data little endian, JFFS node length: 61588
1415404 0x1598EC JFFS2 filesystem (old) data little endian, JFFS node length: 61820
1415432 0x159908 JFFS2 filesystem (old) data little endian, JFFS node length: 62260
1415456 0x159920 JFFS2 filesystem (old) data little endian, JFFS node length: 62376
1415480 0x159938 JFFS2 filesystem (old) data little endian, JFFS node length: 62500
1415508 0x159954 JFFS2 filesystem (old) data little endian, JFFS node length: 63116
1415544 0x159978 JFFS2 filesystem (old) data little endian, JFFS node length: 63520
1663135 0x19609F LZMA compressed data, properties: 0xB4, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
1663185 0x1960D1 LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1663215 0x1960EF LZMA compressed data, properties: 0xB4, dictionary size: 33554432 bytes, uncompressed size: 7115008 bytes
1663259 0x19611B LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1666912 0x196F60 LZMA compressed data, properties: 0x8C, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
1666943 0x196F7F LZMA compressed data, properties: 0x8C, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1666962 0x196F92 LZMA compressed data, properties: 0x8B, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
1666981 0x196FA5 LZMA compressed data, properties: 0x8B, dictionary size: 83886080 bytes, uncompressed size: 768 bytes
1667004 0x196FBC LZMA compressed data, properties: 0x8B, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
1667035 0x196FDB LZMA compressed data, properties: 0xD4, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
1667066 0x196FFA LZMA compressed data, properties: 0xD4, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1667085 0x19700D LZMA compressed data, properties: 0xD3, dictionary size: 33554432 bytes, uncompressed size: 1602560 bytes
1667105 0x197021 LZMA compressed data, properties: 0xD3, dictionary size: 33554432 bytes, uncompressed size: 1864704 bytes
1667325 0x1970FD LZMA compressed data, properties: 0x90, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
1667356 0x19711C LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1667481 0x197199 LZMA compressed data, properties: 0x8C, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1667552 0x1971E0 LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 23808 bytes
1667601 0x197211 LZMA compressed data, properties: 0x88, dictionary size: 33554432 bytes, uncompressed size: 10434560 bytes
1667621 0x197225 LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 23808 bytes
1667987 0x197393 LZMA compressed data, properties: 0xDC, dictionary size: 16777216 bytes, uncompressed size: 22272 bytes
1668006 0x1973A6 LZMA compressed data, properties: 0xDC, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1682727 0x19AD27 LZMA compressed data, properties: 0xB4, dictionary size: 33554432 bytes, uncompressed size: 10432512 bytes
1686120 0x19BA68 LZMA compressed data, properties: 0xD4, dictionary size: 16777216 bytes, uncompressed size: 22272 bytes
1686162 0x19BA92 LZMA compressed data, properties: 0xD4, dictionary size: 16777216 bytes, uncompressed size: 22528 bytes
1686181 0x19BAA5 LZMA compressed data, properties: 0xA8, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1690619 0x19CBFB LZMA compressed data, properties: 0x88, dictionary size: 100663296 bytes, uncompressed size: 2083 bytes
1692968 0x19D528 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1695119 0x19DD8F LZMA compressed data, properties: 0x90, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1695150 0x19DDAE LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1695257 0x19DE19 LZMA compressed data, properties: 0x90, dictionary size: 33554432 bytes, uncompressed size: 10432512 bytes
1695339 0x19DE6B LZMA compressed data, properties: 0xCC, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1697307 0x19E61B LZMA compressed data, properties: 0xCC, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
1697338 0x19E63A LZMA compressed data, properties: 0xCC, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1699810 0x19EFE2 LZMA compressed data, properties: 0xCC, dictionary size: 33554432 bytes, uncompressed size: 1602560 bytes
1705623 0x1A0697 JFFS2 filesystem (old) data little endian, JFFS node length: 6620
1706284 0x1A092C LZMA compressed data, properties: 0x98, dictionary size: 33554432 bytes, uncompressed size: 2126848 bytes
1706304 0x1A0940 LZMA compressed data, properties: 0x98, dictionary size: 33554432 bytes, uncompressed size: 1864704 bytes
1713564 0x1A259C LZMA compressed data, properties: 0x9C, dictionary size: 33554432 bytes, uncompressed size: 1604864 bytes
1713595 0x1A25BB LZMA compressed data, properties: 0x9C, dictionary size: 16777216 bytes, uncompressed size: 22272 bytes
1713625 0x1A25D9 LZMA compressed data, properties: 0x9C, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1713655 0x1A25F7 LZMA compressed data, properties: 0x9C, dictionary size: 16777216 bytes, uncompressed size: 22016 bytes
1713685 0x1A2615 LZMA compressed data, properties: 0x9C, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1713715 0x1A2633 LZMA compressed data, properties: 0x94, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1713734 0x1A2646 LZMA compressed data, properties: 0x9F, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1719140 0x1A3B64 LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
1719171 0x1A3B83 LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 22016 bytes
1719224 0x1A3BB8 LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 10432512 bytes
1719244 0x1A3BCC LZMA compressed data, properties: 0xC4, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1720103 0x1A3F27 LZMA compressed data, properties: 0xAC, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1720134 0x1A3F46 LZMA compressed data, properties: 0xAC, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1723867 0x1A4DDB LZMA compressed data, properties: 0x90, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1727864 0x1A5D78 LZMA compressed data, properties: 0xC4, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1727895 0x1A5D97 LZMA compressed data, properties: 0xC4, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1727925 0x1A5DB5 LZMA compressed data, properties: 0xC4, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1729223 0x1A62C7 LZMA compressed data, properties: 0x94, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1729242 0x1A62DA LZMA compressed data, properties: 0x94, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1729288 0x1A6308 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 22272 bytes
1729324 0x1A632C LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 22016 bytes
1729761 0x1A64E1 LZMA compressed data, properties: 0x8C, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1729812 0x1A6514 LZMA compressed data, properties: 0xD0, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1729887 0x1A655F LZMA compressed data, properties: 0xD0, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1730012 0x1A65DC LZMA compressed data, properties: 0xC0, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1730043 0x1A65FB LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1730137 0x1A6659 LZMA compressed data, properties: 0x9C, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1731294 0x1A6ADE LZMA compressed data, properties: 0xB0, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
1731551 0x1A6BDF LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1731570 0x1A6BF2 LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1733514 0x1A738A LZMA compressed data, properties: 0xA0, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1733546 0x1A73AA LZMA compressed data, properties: 0xA0, dictionary size: 33554432 bytes, uncompressed size: 10432512 bytes
1733986 0x1A7562 LZMA compressed data, properties: 0xAC, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1734017 0x1A7581 LZMA compressed data, properties: 0xAC, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1734068 0x1A75B4 LZMA compressed data, properties: 0xD0, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1738049 0x1A8541 LZMA compressed data, properties: 0x84, dictionary size: 33554432 bytes, uncompressed size: 556288 bytes
1738305 0x1A8641 LZMA compressed data, properties: 0xCC, dictionary size: 16777216 bytes, uncompressed size: 22016 bytes
1739589 0x1A8B45 LZMA compressed data, properties: 0xBC, dictionary size: 33554432 bytes, uncompressed size: 1080576 bytes
1739620 0x1A8B64 LZMA compressed data, properties: 0xBC, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1739672 0x1A8B98 LZMA compressed data, properties: 0xBC, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1740053 0x1A8D15 LZMA compressed data, properties: 0xB4, dictionary size: 33554432 bytes, uncompressed size: 2129152 bytes
1740084 0x1A8D34 LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1740114 0x1A8D52 LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1740166 0x1A8D86 LZMA compressed data, properties: 0x94, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1740215 0x1A8DB7 LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1740275 0x1A8DF3 LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
1740294 0x1A8E06 LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1740376 0x1A8E58 LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1740395 0x1A8E6B LZMA compressed data, properties: 0xD7, dictionary size: 16777216 bytes, uncompressed size: 20736 bytes
1743175 0x1A9947 LZMA compressed data, properties: 0xC0, dictionary size: 50331648 bytes, uncompressed size: 13139200 bytes
1743207 0x1A9967 LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1743237 0x1A9985 LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1743290 0x1A99BA LZMA compressed data, properties: 0xB3, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1743382 0x1A9A16 LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1743412 0x1A9A34 LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 23808 bytes
1743457 0x1A9A61 LZMA compressed data, properties: 0xAC, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1743487 0x1A9A7F LZMA compressed data, properties: 0xB0, dictionary size: 16777216 bytes, uncompressed size: 23808 bytes
1743517 0x1A9A9D LZMA compressed data, properties: 0xB0, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1743547 0x1A9ABB LZMA compressed data, properties: 0xA3, dictionary size: 16777216 bytes, uncompressed size: 21248 bytes
1744422 0x1A9E26 LZMA compressed data, properties: 0x88, dictionary size: 50331648 bytes, uncompressed size: 47742208 bytes
1744454 0x1A9E46 LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1744484 0x1A9E64 LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 20736 bytes
1744674 0x1A9F22 LZMA compressed data, properties: 0xE0, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1744734 0x1A9F5E LZMA compressed data, properties: 0xD7, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1744753 0x1A9F71 LZMA compressed data, properties: 0xD4, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
1744791 0x1A9F97 LZMA compressed data, properties: 0xC8, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1745379 0x1AA1E3 LZMA compressed data, properties: 0x84, dictionary size: 33554432 bytes, uncompressed size: 2129152 bytes
1745440 0x1AA220 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 21504 bytes
1745489 0x1AA251 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1745530 0x1AA27A LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
1745560 0x1AA298 LZMA compressed data, properties: 0x80, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1745601 0x1AA2C1 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 20992 bytes
1745620 0x1AA2D4 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 21760 bytes
1745650 0x1AA2F2 LZMA compressed data, properties: 0x80, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1745688 0x1AA318 LZMA compressed data, properties: 0x84, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1745771 0x1AA36B LZMA compressed data, properties: 0x94, dictionary size: 16777216 bytes, uncompressed size: 20480 bytes
1746745 0x1AA739 LZMA compressed data, properties: 0xCC, dictionary size: 16777216 bytes, uncompressed size: 23040 bytes
1746764 0x1AA74C LZMA compressed data, properties: 0xCC, dictionary size: 16777216 bytes, uncompressed size: 22528 bytes
1746783 0x1AA75F LZMA compressed data, properties: 0xCC, dictionary size: 16777216 bytes, uncompressed size: 22016 bytes
1845086 0x1C275E LZMA compressed data, properties: 0xCC, dictionary size: 1543503872 bytes, uncompressed size: 1 bytes
1845126 0x1C2786 LZMA compressed data, properties: 0xCC, dictionary size: 1543503872 bytes, uncompressed size: 1 bytes
1852200 0x1C4328 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
1852400 0x1C43F0 LZMA compressed data, properties: 0x9B, dictionary size: 16777216 bytes, uncompressed size: 838860800 bytes
1852440 0x1C4418 LZMA compressed data, properties: 0xAA, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
1852480 0x1C4440 LZMA compressed data, properties: 0xB3, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
1852520 0x1C4468 LZMA compressed data, properties: 0xC9, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
1852600 0x1C44B8 LZMA compressed data, properties: 0xD1, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
1852640 0x1C44E0 LZMA compressed data, properties: 0xE0, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes
1892304 0x1CDFD0 JFFS2 filesystem (old) data little endian, JFFS node length: 485148
1954752 0x1DD3C0 JFFS2 filesystem data little endian, JFFS node length: 6914
2143592 0x20B568 LZMA compressed data, properties: 0xC4, dictionary size: 33554432 bytes, uncompressed size: 704643328 bytes
2171722 0x21234A Linux Journalled Flash filesystem, little endian
2191360 0x217000 ELF 32-bit LSB executable, ARM, version 1 (SYSV)
2305436 0x232D9C JFFS2 filesystem data little endian, JFFS node length: 89
2308684 0x233A4C LZMA compressed data, properties: 0x82, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes
2308764 0x233A9C LZMA compressed data, properties: 0x8D, dictionary size: 16777216 bytes, uncompressed size: 805306368 bytes
2308844 0x233AEC LZMA compressed data, properties: 0xAD, dictionary size: 50331648 bytes, uncompressed size: 7340032 bytes
6855655 0x689BE7 JFFS2 filesystem data little endian, JFFS node length: 10890
7246402 0x6E9242 JFFS2 filesystem (old) data little endian, JFFS node length: 596735
7794641 0x76EFD1 LZMA compressed data, properties: 0xA1, dictionary size: 1876951040 bytes, uncompressed size: 49271 bytes
7800144 0x770550 LZMA compressed data, properties: 0xBF, dictionary size: 335544320 bytes, uncompressed size: 12595927 bytes
7813640 0x773A08 JFFS2 filesystem (old) data little endian, JFFS node length: 24
7995999 0x7A025F LZMA compressed data, properties: 0xA6, dictionary size: 1151664128 bytes, uncompressed size: 25801 bytes
8000617 0x7A1469 LZMA compressed data, properties: 0xA3, dictionary size: 2108096512 bytes, uncompressed size: 43722 bytes
8004741 0x7A2485 LZMA compressed data, properties: 0xB1, dictionary size: 1942290432 bytes, uncompressed size: 55543 bytes
8005869 0x7A28ED LZMA compressed data, properties: 0xCC, dictionary size: 2126249984 bytes, uncompressed size: 31205 bytes
8015299 0x7A4DC3 LZMA compressed data, properties: 0xCF, dictionary size: 1521418240 bytes, uncompressed size: 23727 bytes
8017495 0x7A5657 LZMA compressed data, properties: 0xDC, dictionary size: 2125398016 bytes, uncompressed size: 31663 bytes
8018535 0x7A5A67 LZMA compressed data, properties: 0x5D, dictionary size: 1522335744 bytes, uncompressed size: 23741 bytes
8031071 0x7A8B5F LZMA compressed data, properties: 0xD7, dictionary size: 1337851904 bytes, uncompressed size: 22206 bytes
8075078 0x7B3746 LZMA compressed data, properties: 0x80, dictionary size: 67108864 bytes, uncompressed size: 4224 bytes
8075142 0x7B3786 LZMA compressed data, properties: 0x80, dictionary size: 67371008 bytes, uncompressed size: 12416 bytes
8075590 0x7B3946 LZMA compressed data, properties: 0x80, dictionary size: 67239936 bytes, uncompressed size: 134221952 bytes
8075654 0x7B3986 LZMA compressed data, properties: 0x80, dictionary size: 67502080 bytes, uncompressed size: 134230144 bytes
8120924 0x7BEA5C LZMA compressed data, properties: 0x80, dictionary size: 67108864 bytes, uncompressed size: 50331648 bytes
8121804 0x7BEDCC LZMA compressed data, properties: 0x80, dictionary size: 671088640 bytes, uncompressed size: 201326592 bytes
8122044 0x7BEEBC LZMA compressed data, properties: 0xC0, dictionary size: 50331648 bytes, uncompressed size: 50331648 bytes
8122084 0x7BEEE4 LZMA compressed data, properties: 0xB8, dictionary size: 939524096 bytes, uncompressed size: 536870913 bytes
8122436 0x7BF044 LZMA compressed data, properties: 0xA0, dictionary size: 50331648 bytes, uncompressed size: 50331648 bytes
8122492 0x7BF07C LZMA compressed data, properties: 0xC0, dictionary size: 50331648 bytes, uncompressed size: 50331648 bytes
8122548 0x7BF0B4 LZMA compressed data, properties: 0xB0, dictionary size: 100663296 bytes, uncompressed size: 50331648 bytes
8122604 0x7BF0EC LZMA compressed data, properties: 0xC0, dictionary size: 50331648 bytes, uncompressed size: 50331648 bytes
8122716 0x7BF15C LZMA compressed data, properties: 0xC0, dictionary size: 50331648 bytes, uncompressed size: 50331648 bytes
8122772 0x7BF194 LZMA compressed data, properties: 0xC0, dictionary size: 50331648 bytes, uncompressed size: 50331648 bytes
8123500 0x7BF46C LZMA compressed data, properties: 0xD0, dictionary size: 50331648 bytes, uncompressed size: 50331648 bytes
8123556 0x7BF4A4 LZMA compressed data, properties: 0x88, dictionary size: 100663296 bytes, uncompressed size: 50331648 bytes
8170532 0x7CAC24 LZMA compressed data, properties: 0x93, dictionary size: 1006632960 bytes, uncompressed size: 46173934 bytes
8170736 0x7CACF0 LZMA compressed data, properties: 0xBF, dictionary size: 536870912 bytes, uncompressed size: 130060015 bytes
8186061 0x7CE8CD LZMA compressed data, properties: 0x1B, dictionary size: 8388608 bytes, uncompressed size: 463994880 bytes
8187941 0x7CF025 LZMA compressed data, properties: 0x1B, dictionary size: 8388608 bytes, uncompressed size: 464191488 bytes
8195669 0x7D0E55 LZMA compressed data, properties: 0x1B, dictionary size: 8388608 bytes, uncompressed size: 463142912 bytes
8195765 0x7D0EB5 LZMA compressed data, properties: 0x1B, dictionary size: 8388608 bytes, uncompressed size: 463994880 bytes
8197069 0x7D13CD LZMA compressed data, properties: 0x1B, dictionary size: 8388608 bytes, uncompressed size: 464191488 bytes
8390793 0x800889 LZMA compressed data, properties: 0xBB, dictionary size: 131072 bytes, uncompressed size: 131072 bytes
8390857 0x8008C9 LZMA compressed data, properties: 0xBB, dictionary size: 131072 bytes, uncompressed size: 131072 bytes
8397847 0x802417 LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 1 bytes
8411988 0x805B54 LZMA compressed data, properties: 0x90, dictionary size: 67108864 bytes, uncompressed size: 67108864 bytes
8427477 0x8097D5 LZMA compressed data, properties: 0x9C, dictionary size: 39321600 bytes, uncompressed size: 131072000 bytes
9923928 0x976D58 LZMA compressed data, properties: 0x80, dictionary size: 738197504 bytes, uncompressed size: 12618610 bytes
9924652 0x97702C LZMA compressed data, properties: 0xC0, dictionary size: 134217728 bytes, uncompressed size: 12602373 bytes
10079844 0x99CE64 LZMA compressed data, properties: 0xA4, dictionary size: 1409286144 bytes, uncompressed size: 184549376 bytes
10097704 0x9A1428 LZMA compressed data, properties: 0x9B, dictionary size: 1962934272 bytes, uncompressed size: 1 bytes
10117365 0x9A60F5 LZMA compressed data, properties: 0xC3, dictionary size: 536870912 bytes, uncompressed size: 268435456 bytes
10117509 0x9A6185 LZMA compressed data, properties: 0xC4, dictionary size: 536870912 bytes, uncompressed size: 536870912 bytes
10118949 0x9A6725 LZMA compressed data, properties: 0xC4, dictionary size: 536870912 bytes, uncompressed size: 536870912 bytes
10232751 0x9C23AF LZMA compressed data, properties: 0xC0, dictionary size: 524288 bytes, uncompressed size: 720896 bytes

[root@3ndymion-laptop HACK]# !!!

###!!!ZOMG!!! >: O What the hell am I supposed to do with all that!?!?!? Maybe binwalk's just not getting the right readings???
###It looks like the JFFS2 file system is used. I'd like to mount it, but I can't even make sense of all this.

[root@3ndymion-laptop HACK]# hexdump -C kernel > kernel_hexdump.txt
[root@3ndymion-laptop HACK]#

https://docs.google....m5YZXQ2NHc/edit

###You can clearly see all the files & data in the hexdump file. But now what??? My brain is blown. Someone please help!!!
 
#8 ·
I have made a recovery packet from your files, here:
http://www.slatedroid.com/topic/41478-how-to-unbrick-your-ainol-crystal/page__view__findpost__p__525682

Only file that I removed was su because it is not in batch2...


I tested the first method with my batch2 using its files, and it worked fine.
I have not tested of the second one (making a image etc.) but it should work I think.

To make ImageBurningTool work probably a new u-boot-orig.bin (and usb_spl.bin) are needed.
You could dump them with update.exe and post them here, or this other thread:
http://www.slatedroid.com/topic/42916-all-who-have-a-bricked-crystal/page__view__findpost__p__527154

update.exe read 0x80000 0x8f800000>u-boot-orig.bin_dump.txt
update.exe read 0x4820 0xd9000000>usb_spl.bin_dump.txt

I can make the conversion then - if needed...

wondering why my usb_spl.bin is smaller, maybe it is corrupted??
 
#9 ·
I have made a recovery packet from your files, here:
http://www.slatedroi...post__p__525682

Only file that I removed was su because it is not in batch2...


I tested the first method with my batch2 using its files, and it worked fine.
I have not tested of the second one (making a image etc.) but it should work I think.

To make ImageBurningTool work probably a new u-boot-orig.bin (and usb_spl.bin) are needed.
You could dump them with update.exe and post them here, or this other thread:
http://www.slatedroi...post__p__527154

update.exe read 0x80000 0x8f800000>u-boot-orig.bin_dump.txt
update.exe read 0x4820 0xd9000000>usb_spl.bin_dump.txt

I can make the conversion then - if needed...

wondering why my usb_spl.bin is smaller, maybe it is corrupted??
Cool. Thanks for that. I'm dead tired & my mind is out right now... Please help me...

-Where do I get this update.exe from???
-Is this done in the stock recovery???
-It simply reads the memory location & dumps data???

I guess I'll have to break out my Windows drive for this one... I'll see if I can get to it in the next day or two. It looks fairly simple.
 
#10 ·
#11 ·
update.exe comes with the ImageBurnTool, it uses same drivers
http://www.lokumrom.com/index.php/Using_AML_Flash

yep, it simply reads the memory location & dumps data, the output:

### It will operate the dev0(first valid device) 0x00000000 ####
b0 0f 10 ee 03 00 00 e2 c4 30 9f e5 00 20 a0 e3 00 21 83 e7
aml_close_logfile

the other thread looks promising...

though it would be nice to make it work with the "original" files...
 
#12 · (Edited by Moderator)
Lots of good info. The boot.img pack/re-pack scripts are here. You can extract the ramdisk and make changes but you can't fully extract the kernel. If you want to make changes to the kernel, you need to build your own from source.

Also here is all the documentation I have.
 
#14 ·
Wow. Thanks so much for all that. Those documents & schematics are EXACTLY what I was hoping to see. I couldn't find much of it myself. Thanks again. I'm gonna spend a lot of time studying & going through everything now. boot.img pack/re-pack scripts??? So those are exactly what I was trying to do up above??? I'm definitely gonna check those out too. But you say they can't fully extract the kernel??? I'm gonna dig deep into this. Maybe I'll actually find something. We'll see...
 
#16 ·
@ 3ndymion - I'm like 99% sure that you can not decompile a kernel, you have to build it from source. You can unpack a uImage or boot.img and edit the ramdisk though. If you find out otherwise let me know.

@ cxz - The tablet doesn't have to be in M3 mode. I have no idea why DarkLotus was unable to unbrick his tablet but I've unbricked from M3 and M6 mode. I think during the last round tigger-gg unbricked 7 different tablets without a problem as well, some of which required the AML software.
 
#21 ·
@ 3ndymion - I'm like 99% sure that you can not decompile a kernel, you have to build it from source. You can unpack a uImage or boot.img and edit the ramdisk though. If you find out otherwise let me know.
With all the studying I've been doing, I understand why you say that now. Too bad we don't have the source code yet. If we were to take the kernel source code from one of the other similar tabs, extract the proprietary drivers from the batch 3, & compile them, that should work, & even solve the problem of the screen, g-sensor, & camera, no???
 
#19 ·
fuser:
I'm just talking about dumping here, not unbricking...
The idea of dumping these from an unbroken tablet was nice though...


fldc:
Great job! I wish I had a bricked batch3 just to test your work...

Still wondering though why some don't have any problems when using those original files of Fire...
 
#20 ·
fldc:
Great job! I wish I had a bricked batch3 just to test your work...

Still wondering though why some don't have any problems when using those original files of Fire...
It's pretty clear actually, I have two devices, the only difference is the nand chip(s) used, I've tried booting older kernels on the device which this doesn't work on, it just doesn't find any nand, so the problem here is it needs an updated driver.
 
#23 ·
I think your description of the bootloader makes sense. You can use the ELF2 Kernel source code to compile a kernel for the Crystal, it just takes some work.
 
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top