[cxz]

Nope. My tablet is serioux S704 and my firmware is quadra 7 slim.
I used also Ainol Novo ... my touch doesnt work.

I assume you used it in stock then. I asked because that zip
if flashed using TWRP recovery will get stuck because the touch
module is loaded... (detecting can also take some time)

Do you have a link to the firmware you now use?
Some other s704 users might need it too...

 

[valg70]

Sure CXZ .. i've already posted up .. http://www.pentagram.pl/quadra-ultra-slim.

I didn;t used TWRP .. should i )) i just used the recovery menu.

I'll try now TWRP

 

[cxz]

Sure CXZ .. i've already posted up .. http://www.pentagram.pl/quadra-ultra-slim.
I didn;t used TWRP .. should i )) i just used the recovery menu.
I'll try now TWRP

Do not try the TWRP if not meant for your device! The touch might break!

The portable version is safe to test but that module detector doesn't work
if touch module is loaded so the stock recovery is what you should use for it.

 

[mixailo]

Hi!

Where can I get PAD modify tool v1.16 or newer?

 

[cxz]

Hi!

Where can I get PAD modify tool v1.16 or newer?

You just install 1.13 and then update it using the button with a note that says "Newer version".

 

[qUE-ARM]

I've had success with these tools on a ATM7021/GS702C device.

Tried to build a bootable SD but I can't seem to get my Tablet to boot from SD. Changed the AFI.CFG in the Firmware Modifier as mentioned in the post, but no luck, infact it seems to stop the flash completing so I can only assume INF_AFI_DEF_BYTE = 0x08, is relevant to the flashing process, maybe a reboot to upload partitions?.

Tried building a sunxi spl and u-boot card placing the spl in the same place as sdboot.bin from the hero2 pack with the Pad Card Writer, but no joy.

I've been trying to work out what the boot process looks for or what sectors are read into RAM for execution.

I noticed the actual boot partition files (which are encoded into the .fw file) are kept in temp.img in the firmware modifier's program directory. I've tried mounting temp.img but the files inside seem scrambled (encrypted or compressed) somehow. Running a watch process on the Pad Tool, it accesses a DLL called DskImage to access the img file.

Are there any tools to unpack/repack the files in the .fw or temp.img?

Is there a method with windows to transfer the AFINFO, VMLINUX, etc. or even run binaries over ADFU manually? (this would be ideal)

Edit;

I just tried the ExtractFWData utility, had to create the destination directory first, but it didn't put anything in the directory.

 

[valg70]

It did't briked my touch ... but also didn't worked out ... is freezing on detecting modules.

I didn't understand what do you mean - a stock version? I don't have Serioux S704 stock firmware.

Quadra firmware i installed is a stock firmare. Some how i think Quadra is using another type for 3g sensor.

I tried many aplications - sensor is entirely missing (giroscope, accelerometer, gravitation, etc - all parts.

I instaled Pad Tool - developer option ... to tricky for me )

By the way ... i remembered that on the initial briked device (with the factory firmware) i used clock word mod.

I found the files that i managed to recover :

boot.vfat.tar

boot.vfat.tar.a

recovery.vfat.tar

recovery.vfat.tar.a

boot.vfat.dup

recovery.vfat.dup

.default_backup_format

.recovery_version

Can i used something from this file?

I have also a txt file with :

Starting recovery on Wed Nov 30 04:35:18 2011
framebuffer: fd 4 (800 x 1280)
CWM-based Recovery v6.0.3.3 by Boyd M. for ATM7029
recovery filesystem table
=========================
0 /tmp ramdisk (null) (null) 0
1 /emmc vfat /dev/block/actj (null) 0
2 /system ext4 /dev/block/actc (null) 0
3 /cache ext4 /dev/block/acte (null) 0
4 /data ext4 /dev/block/actd (null) 0
5 /boot vfat /dev/block/actb (null) 0
6 /recovery vfat /dev/block/acta (null) 0
7 /sdcard vfat /dev/block/mmcblk0p1 /dev/block/mmcblk0 0

W:Unable to get recovery.fstab info for /datadata during fstab generation!
W:Unable to get recovery.fstab info for /sd-ext during fstab generation!
W:Unable to get recovery.fstab info for /external_sd during fstab generation!
I:Completed outputting fstab.
Irocessing arguments.
I:Checking arguments.
Warning: No file_contexts
I:device_recovery_start()
Command: "/sbin/recovery"

ro.boot.mode=recovery1
ro.boot.serialno=A071A591D8B61D83
ro.serialno=A071A591D8B61D83
ro.bootmode=recovery1
ro.baseband=unknown
ro.bootloader=unknown
ro.hardware=gs702a
ro.revision=0
ro.factorytest=0
ro.secure=1
ro.debuggable=1
ro.setupwizard.mode=DISABLE
persist.sys.timezone=Asia/Shanghai
persist.sys.strictmode.disable=true
wifi.supplicant_scan_interval=120
wifi.interface=wlan0
ro.allow.mock.location=0
persist.sys.usb.config=mass_storage,adb
ro.build.id=JRO03C
ro.build.display.id=full_gs702a-userdebug 4.1.1 JRO03C eng.root.20130906.185532 test-keys
ro.build.version.incremental=eng.root.20130906.185532
ro.build.version.sdk=16
ro.build.version.codename=REL
ro.build.version.release=4.1.1
ro.build.date=Fri Sep 6 18:56:03 HKT 2013
ro.build.date.utc=1378464963
ro.build.type=userdebug
ro.build.user=root
ro.build.host=WSSERVER2
ro.build.tags=test-keys
ro.product.model=Full AOSP on Leopard SOC
ro.product.brand=Android
ro.product.name=full_gs702a
ro.product.device=gs702a
ro.product.board=full_gs702a
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=unknown
ro.wifi.channels=
ro.board.platform=ATM702X
ro.build.product=gs702a
ro.build.description=full_gs702a-userdebug 4.1.1 JRO03C eng.root.20130906.185532 test-keys
ro.build.fingerprint=Android/full_gs702a/gs702a:4.1.1/JRO03C/eng.root.20130906.185532:userdebug/test-keys
ro.build.characteristics=tablet
ro.sf.lcd_density=160
ro.opengles.version=131072
ro.config.softopengles=0
ro.config.used_hw_vsync=0
ro.launcher.swipe=disable
ro.settings.config.hdmi=off
ro.soundrecorder.format=amr
ro.systemui.volumekey=enable
ro.systemui.capture=enable
ro.launcher.config.cling=enable
ro.launcher.hideAPP=disable
ro.launcher.hideactivity=disable
ro.launcher.allapp.landX=0
ro.launcher.allapp.landY=0
ro.launcher.allapp.portX=0
ro.launcher.allapp.portY=0
ro.launcher.workspace.landX=0
ro.launcher.workspace.landY=0
ro.launcher.workspace.portX=0
ro.launcher.workspace.portY=0
launcher.force_enable_rotation=true
ro.product.usbdevice.VID=10d6
ro.product.usbdevice.PID=fffe
ro.product.mtpdevice.PID=4e41
ro.product.ptpdevice.PID=4e43
ro.shutmenu.recovery=disable
ro.shutmenu.planemode=disable
ro.shutmenu.restart=enable
ro.usb.descriptor=actions,leopard,3.00
ro.usbdevice.volumelabel=GS702A
ro.config.quickboot=0
ro.im.keysounddefenable=true
ro.support.gpswithwifi=1
ro.wifi.signal.level.1=-70
ro.wifi.signal.level.2=-65
ro.wifi.signal.level.3=-60
ro.wifi.signal.level.4=-55
ro.product.pribrand=actions
ro.product.primodel=owlx1
ro.ota.autorecovery=enable
ro.device.model=unknown
ro.recovery.wipe=false
ro.sf.triplebuffer=0
ro.com.android.dateformat=MM-dd-yyyy
ro.config.ringtone=Orion.ogg
ro.config.notification_sound=Adara.ogg
ro.config.alarm_alert=Cesium.ogg
ro.carrier=unknown
hwui.render_dirty_regions=false
ro.product.locale.language=zh
ro.product.locale.region=CN
dalvik.vm.dexopt-flags=v=n,o=v
dalvik.vm.checkjni=false
dalvik.vm.heapstartsize=8m
dalvik.vm.heapgrowthlimit=64m
dalvik.vm.heapsize=384m
dalvik.vm.lockprof.threshold=500
net.bt.name=Android
net.change=net.bt.name
dalvik.vm.stack-trace-file=/data/anr/traces.txt
init.svc.ueventd=running
system.ram.total=1024
init.svc.recovery=running
init.svc.adbd=running
sys.usb.state=mass_storage,adb
service.adb.root=1

I:Checking for extendedcommand...
I:Skipping execution of extendedcommand, file not found...
E:Can't open /cache/recovery/log
E:Can't open /cache/recovery/log
E:Can't open /cache/recovery/last_log
E:Can't open /cache/recovery/last_log
W:Can't unlink /cache/recovery/command
I:Can't format unknown volume: /external_sd
W:failed to mount /dev/block/actc (Invalid argument)
Fixing permissions...
sh: fix_permissions: not found
Done!
E:unknown volume for path [/sd-ext]
rm: can't remove '/data/dalvik-cache': No such file or directory
rm: can't remove '/cache/dalvik-cache': No such file or directory
rm: can't remove '/sd-ext/dalvik-cache': No such file or directory
Dalvik Cache wiped.
Outputting key codes.
Go back to end debugging.
Key: 114
Key: 114
Key: 115
Key: 116
Key: 114
Starting recovery on Wed Nov 30 04:36:16 2011
framebuffer: fd 4 (800 x 1280)
CWM-based Recovery v6.0.3.3 by Boyd M. for ATM7029
recovery filesystem table
=========================
0 /tmp ramdisk (null) (null) 0
1 /emmc vfat /dev/block/actj (null) 0
2 /system ext4 /dev/block/actc (null) 0
3 /cache ext4 /dev/block/acte (null) 0
4 /data ext4 /dev/block/actd (null) 0
5 /boot vfat /dev/block/actb (null) 0
6 /recovery vfat /dev/block/acta (null) 0
7 /sdcard vfat /dev/block/mmcblk0p1 /dev/block/mmcblk0 0

W:Unable to get recovery.fstab info for /datadata during fstab generation!
W:Unable to get recovery.fstab info for /sd-ext during fstab generation!
W:Unable to get recovery.fstab info for /external_sd during fstab generation!
I:Completed outputting fstab.
Irocessing arguments.
I:Checking arguments.
Warning: No file_contexts
I:device_recovery_start()
Command: "/sbin/recovery"

ro.boot.mode=recovery1
ro.boot.serialno=A071A591D8B61D83
ro.serialno=A071A591D8B61D83
ro.bootmode=recovery1
ro.baseband=unknown
ro.bootloader=unknown
ro.hardware=gs702a
ro.revision=0
ro.factorytest=0
ro.secure=1
ro.debuggable=1
ro.setupwizard.mode=DISABLE
persist.sys.timezone=Asia/Shanghai
persist.sys.strictmode.disable=true
wifi.supplicant_scan_interval=120
wifi.interface=wlan0
ro.allow.mock.location=0
persist.sys.usb.config=mass_storage,adb
ro.build.id=JRO03C
ro.build.display.id=full_gs702a-userdebug 4.1.1 JRO03C eng.root.20130906.185532 test-keys
ro.build.version.incremental=eng.root.20130906.185532
ro.build.version.sdk=16
ro.build.version.codename=REL
ro.build.version.release=4.1.1
ro.build.date=Fri Sep 6 18:56:03 HKT 2013
ro.build.date.utc=1378464963
ro.build.type=userdebug
ro.build.user=root
ro.build.host=WSSERVER2
ro.build.tags=test-keys
ro.product.model=Full AOSP on Leopard SOC
ro.product.brand=Android
ro.product.name=full_gs702a
ro.product.device=gs702a
ro.product.board=full_gs702a
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=unknown
ro.wifi.channels=
ro.board.platform=ATM702X
ro.build.product=gs702a
ro.build.description=full_gs702a-userdebug 4.1.1 JRO03C eng.root.20130906.185532 test-keys
ro.build.fingerprint=Android/full_gs702a/gs702a:4.1.1/JRO03C/eng.root.20130906.185532:userdebug/test-keys
ro.build.characteristics=tablet
ro.sf.lcd_density=160
ro.opengles.version=131072
ro.config.softopengles=0
ro.config.used_hw_vsync=0
ro.launcher.swipe=disable
ro.settings.config.hdmi=off
ro.soundrecorder.format=amr
ro.systemui.volumekey=enable
ro.systemui.capture=enable
ro.launcher.config.cling=enable
ro.launcher.hideAPP=disable
ro.launcher.hideactivity=disable
ro.launcher.allapp.landX=0
ro.launcher.allapp.landY=0
ro.launcher.allapp.portX=0
ro.launcher.allapp.portY=0
ro.launcher.workspace.landX=0
ro.launcher.workspace.landY=0
ro.launcher.workspace.portX=0
ro.launcher.workspace.portY=0
launcher.force_enable_rotation=true
ro.product.usbdevice.VID=10d6
ro.product.usbdevice.PID=fffe
ro.product.mtpdevice.PID=4e41
ro.product.ptpdevice.PID=4e43
ro.shutmenu.recovery=disable
ro.shutmenu.planemode=disable
ro.shutmenu.restart=enable
ro.usb.descriptor=actions,leopard,3.00
ro.usbdevice.volumelabel=GS702A
ro.config.quickboot=0
ro.im.keysounddefenable=true
ro.support.gpswithwifi=1
ro.wifi.signal.level.1=-70
ro.wifi.signal.level.2=-65
ro.wifi.signal.level.3=-60
ro.wifi.signal.level.4=-55
ro.product.pribrand=actions
ro.product.primodel=owlx1
ro.ota.autorecovery=enable
ro.device.model=unknown
ro.recovery.wipe=false
ro.sf.triplebuffer=0
ro.com.android.dateformat=MM-dd-yyyy
ro.config.ringtone=Orion.ogg
ro.config.notification_sound=Adara.ogg
ro.config.alarm_alert=Cesium.ogg
ro.carrier=unknown
hwui.render_dirty_regions=false
ro.product.locale.language=zh
ro.product.locale.region=CN
dalvik.vm.dexopt-flags=v=n,o=v
dalvik.vm.checkjni=false
dalvik.vm.heapstartsize=8m
dalvik.vm.heapgrowthlimit=64m
dalvik.vm.heapsize=384m
dalvik.vm.lockprof.threshold=500
net.bt.name=Android
net.change=net.bt.name
dalvik.vm.stack-trace-file=/data/anr/traces.txt
init.svc.ueventd=running
system.ram.total=1024
init.svc.recovery=running
init.svc.adbd=running
sys.usb.state=mass_storage,adb
service.adb.root=1

I:Checking for extendedcommand...
I:Skipping execution of extendedcommand, file not found...
E:Can't open /cache/recovery/log
E:Can't open /cache/recovery/log
E:Can't open /cache/recovery/last_log
E:Can't open /cache/recovery/last_log
W:Can't unlink /cache/recovery/command
I:Can't format unknown volume: /external_sd
W:failed to mount /dev/block/mmcblk0p1 (No such file or directory)

 

[cxz]

By the way ... i remembered that on the initial briked device (with the factory firmware) i used clock word mod.
I found the files that i managed to recover :
boot.vfat.tar
boot.vfat.tar.a
recovery.vfat.tar
recovery.vfat.tar.a
boot.vfat.dup
recovery.vfat.dup
.default_backup_format
.recovery_version
Can i used something from this file?
I have also a txt file with :

IF you have the boot backed up and a firmware that almost works,
I would say that you shouldn't have nothing to worry about.

Just install CWM or portable and using advanced options
restore the boot partition. If doesn't boot after that
(black screen) take the misc/boot_lcd.bin file from Quadra
and place it to its folder. That many times does the trick.

 

[cxz]

I've had success with these tools on a ATM7021/GS702C device.

Tried to build a bootable SD but I can't seem to get my Tablet to boot from SD. Changed the AFI.CFG in the Firmware Modifier as mentioned in the post, but no luck, infact it seems to stop the flash completing so I can only assume INF_AFI_DEF_BYTE = 0x08, is relevant to the flashing process, maybe a reboot to upload partitions?.
Tried building a sunxi spl and u-boot card placing the spl in the same place as sdboot.bin from the hero2 pack with the Pad Card Writer, but no joy.

I've been trying to work out what the boot process looks for or what sectors are read into RAM for execution.
I noticed the actual boot partition files (which are encoded into the .fw file) are kept in temp.img in the firmware modifier's program directory. I've tried mounting temp.img but the files inside seem scrambled (encrypted or compressed) somehow. Running a watch process on the Pad Tool, it accesses a DLL called DskImage to access the img file.

Are there any tools to unpack/repack the files in the .fw or temp.img?
Is there a method with windows to transfer the AFINFO, VMLINUX, etc. or even run binaries over ADFU manually? (this would be ideal)

Edit;
I just tried the ExtractFWData utility, had to create the destination directory first, but it didn't put anything in the directory.

Booting form a sd card... Nice project - that I myself eventually abandoned.
There are certain files that one have to modify for that to work.
That afi.cfg tip should be ok for 7021 too. But what else is needed. is everything told?
The source code packages usually include a folder for factory test from sd card.
But not for the whole system... So some comparing etc. maybe needed.

So for "ExtractFWData" this doesn't work for you?
http://www.slatedroid.com/topic/94521-actions-tablet-tools/?p=1243114
If so check the new command line using taskmgr or some other tool.
(edit: Command line is the same. You probably tried to use with a smaller fw file? It's not for them.)

The plain *.fw file (small, if biggie see C:\ProgramData\PadModify\TMP\FW\PAD.fw) consists of
16 bytes of some default data (etc.) + encrypted database + encrypted files in a fat image.
To decrypt the files just rename them using the names that Modify Tool agrees to decrypt.

Then by examining the py files one can see what is possible and what is not.
Also by editing probatch.img affecting the adfu process is possible...

Before playing around with adfu mode modifications make sure
that you have a factory firmware for your device!
(== Product Tool flashable firmware)

 

[PROFETA]

HI, I NEED THE FIRMWARE FOR A HISHIMOTO STRONG ATM 7021 A, I CAN´T FIND IT ANYWHERE. IN ABIDU IT IS IN CHINESE, SO IA DONT UNDERSTAND NOTHING, SOME IDEA? IT´S URGENT, I´M BECOMING INSANE. tHANK YOU

 

[qUE-ARM]

Profeta, try checking the Mapan website for the firmware, the 923 one worked on my generic 9.7" dual core tablet.

CXZ, some update on what has happened since my last post. I really tried to pry into the bootloader but it's really locked away from modification, basically I couldn't find anyway to unpack the firmware to get to the actual bootloader binary let alone find a way to write it back. I also had a quick look at the ADFU testing thing as that uploads a binary through the ADFU directly to the device and runs it, but that also has the binary packed into the program and it's process is done at runtime. Running things post VMLINUX is a no no for me since it locks down the MMU page map and CPU permissions.

The only way I can see that could possibly allow for a raw binary to be run on the device is to reverse engineer the ADFU protocol, but it's really extreme and I personally just don't have the time to do it

 

[cxz]

Profeta, try checking the Mapan website for the firmware, the 923 one worked on my generic 9.7" dual core tablet.

CXZ, some update on what has happened since my last post. I really tried to pry into the bootloader but it's really locked away from modification, basically I couldn't find anyway to unpack the firmware to get to the actual bootloader binary let alone find a way to write it back. I also had a quick look at the ADFU testing thing as that uploads a binary through the ADFU directly to the device and runs it, but that also has the binary packed into the program and it's process is done at runtime. Running things post VMLINUX is a no no for me since it locks down the MMU page map and CPU permissions.

The only way I can see that could possibly allow for a raw binary to be run on the device is to reverse engineer the ADFU protocol, but it's really extreme and I personally just don't have the time to do it

Profeta, qUE-ARM, there is a slight change of hurting the tablet when trying a unknown firmware.
Particularly touch drivers have been causing troubles in the past.

qUE-ARM, much what you're saying is beyond my understanding. There is some 7021 source codes (see the
7029 source code thread here) that might have a ready-made sd-card bootloader for your tab.
There is bnmguy's github link mentioned, where you (maybe) can download just the files needed.

The bootloader has been encrypted a very simple way, it's like ABC is XYZ (I'll add the number here later).

Spoiler

edit: to decrypt boot.bin: for every byte do A * 2 = B, if B>255 then B=B-255

Finding out that didn't help a novice like me much though.
I didn't find out how it was packed - although I've unpacked (partly) some before...

 

[shopmobi62]

Brother I've ATM two pad both are working fine one I flashed with PAD tool working fine only problem with Camera is not connected now I want to read the other pad with same version every thing is same can you tell me the procedure how to read clone file and flash with PAD tool

please need urgent help.

 

[cxz]

Brother I've ATM two pad both are working fine one I flashed with PAD tool working fine only problem with Camera is not connected now I want to read the other pad with same version every thing is same can you tell me the procedure how to read clone file and flash with PAD tool
please need urgent help.

Here is some dumpers. www.slatedroid.com/topic/108162-gdippo...
Cannot totally remember how they work, but you should get img files (acta, actb, actc).
Then using adb (or whatever) write them back to the partitions. Like this and so on:
(adb shell) cat acta.img>/dev/block/acta

 

[a8nsli]

Hello everyone, I have a problem with some tablets that I give to my clients. I am 30 now but surely if I can fix this problem will be about 300. It's a tablet quite simply.

No brand, the model is 816. On the motherboard indicates

GPT ATM7051H_H88_V1.1
06/04/2016
1.91.001.0145

The main problem is that I want to customize the tablet with the logo of my business but can not find tools for this type of chip.
I'm testing with the tools we cxz offers in this thread, I even managed to clone the tablet I've prepared as shown with my logo.

After that I was able to flash one with the PAD Product Tool. Finish the flashing properly but then no longer start the tablet.

I think it can be a problem because it is a quad-core processor. Can not find the necessary tools. I appreciate your help. Please all data and photos you need order them.

 

[cxz]

customize the tablet with the logo of my business but can not find tools for this type of chip.
I'm testing with the tools we cxz offers in this thread, I even managed to clone the tablet I've prepared as shown with my logo.
After that I was able to flash one with the PAD Product Tool. Finish the flashing properly but then no longer start the tablet.

I think it can be a problem because it is a quad-core processor. Can not find the necessary tools. I appreciate your help. Please all data and photos you need order them.

So, you have the orig. (stock) *.fw file for these? If so flashing shouldn't be a problem.
Also the Modify Tool should work okay I think. Which image you want to replace?

 

[a8nsli]

Thanks for answer so soon. I have another tablet with the original firmware already changed my logo and animation, cloning the Modify firmware Firmware Tool PAD me create the file * .fw which is what flash attempt on other tablets without success.

 

[cxz]

Thanks for answer so soon. I have another tablet with the original firmware already changed my logo and animation, cloning the Modify firmware Firmware Tool PAD me create the file * .fw which is what flash attempt on other tablets without success.

The Modify Tool doesn't make *.fw files, it only modifies them. At least for me I doesn't.
Also cloning doesn't work in the resent versions, so - if it does work - update, i.e. use the latest.

To change the logo and animation one also could use adb or recovery flashable zip
but then again the Product Tool can be faster and easier.

 

[a8nsli]

Here it is when I'm a little green. I flashed hundreds of tablets but I've never created a update.zip for this model. The first thing is to get the image of the tablet that would have finished and then create that update.zip. I need a streamlined process for flashing because they are many. If you can tell me how to create the update.zip from the other tablet I would appreciate it. While I'm looking for.

 

[a8nsli]

Nothing in the first tablet that flash are bricked only have access to adb

C: \ adb> adb devices
List of devices attached
0123456789ABCDEF recovery

I root but do not know how I can go back to charge the recovery.

C:\adb>adb shell
$ mount
/system/bin/sh: mount: not found
$