Android Tablets Forum banner
1 - 20 of 246 Posts

·
Registered
Joined
·
39 Posts
Here:

http://www.megaupload.com/?d=RATILM3F

Place the files in the zt-update dir.
And boot with camera+power.

I found out a way to boot the kernel without flashing so it "should" be safe. (So you have to always boot it with camera+power)
Ofcourse, it might turn out that it might overheat or something, but that is a different story


To verify>
-Check "no frills cpu clock" for clockspeed
-The camera now works

-run shell, I have changed the builddate string to 2999

-------------

[[email protected] ~]$ /opt/android-sdk/platform-tools/adb shell
[email protected]:/ $ uname -a
Linux localhost 2.6.34 #2834 Sat Dec 24 13:46:36 CST 2011 armv7l GNU/Linux
[email protected]:/ $ exit

[Reboot using camera+power]

[[email protected] ~]$ /opt/android-sdk/platform-tools/adb shell
[email protected]:/ $ uname -a
Linux localhost 2.6.34 #2834 Sat Dec 24 12:34:56 CST 2999 armv7l GNU/Linux
[email protected]:/ $

-------------

To get the best performance in "quadrant" I put max&min clock to 1.0Ghz and govenor to performance.

Bugs:
The first time I hade to change from 200 to 1.0Ghz in "No-frills CPU Controll"
At each boot I have to change HDMI mode to panel. (Might have to do with the recovery boot hack, or the SJPedro custom rom) (This is for the camera to work at all)

It should probably be safe to flash, but I have not tried yet. (Just rename the ZT-280.recovery to ZT-280.kernel)

I have only tried the camera with the native "camera app", not skype etc. Please report..

Thanks to "vgrade" for inspiraton for the boot hack, and SjPedro for the rooted rom.
 

Attachments

·
Registered
Joined
·
101 Posts
Does this mean the overclock hack may make it into an official release?
 

·
Registered
Joined
·
52 Posts
Awesome job johane!

Being able to overclock the CPU to 1,0 Ghz was one of the major requests on this forum. You did it!
I'll have to flash the kernel when I get back from work.

What were the major differences you noticed? Does the tablet feel noticably faster? How's the battery life?

Thank you for your efforts, they are much appreciated!

 

·
Registered
Joined
·
228 Posts
So, went ahead and flashed it, worked like a charm. No single bug for me. Camera works fine, got a little bit brighter. I don't think that there is more room for improvement with this camera...

The 1ghz works fine! Will test how fast the battery drains. How did you mangage to achieve this?? Brilliant!
Sadly I lost root rights on my tablet, so I cant do advanced tests.

Big thanks!
 

·
Registered
Joined
·
39 Posts
Is it possible to set the cpu to higher than 1ghz?
Probably, but there might be some more things that needs to be change for that.

EDIT: I have added a test 1.1Ghz kernel, But I have not tried it (to tablet here ATM)

The "a9_clk" is divided by two from the "sys_pll", and it has a maximum defined clock of 2ghz. (But it doesn't appear to check it anywere.)

The steps to fix the kernel is basically:

Strip the first 128 bytes with dd.

dd if=.. of=temp1 bs=s skip=128

decompress
lzcat < temp1 > kernel

[Modify the kernel]

Then pack it again using lzma
(Here I ran into troubles since the output from the lzma shipped with my linux dist was not recognized by binwalk, So i downloaded a java lzma compressor "java_lzma_4.23.1.tar.bz2")

Then run mkimage two times, first add a "linux kernel header" and then a "linux firmware header". Here was the next problem, it turned out that the bootloader checked that the signature name was "LK:ZT280_H1_2n" Otherwise it just silently ignored the image.

Then verify with binwalk, and compare against the original file.

This is my packing script:

rm uImage-kernel.temp
rm modkernel.lzma
rm firmware.out
java -Xmx512m -jar JLzma.jar e modkernel modkernel.lzma
../../../../../src/u-boot-amlogic/u-boot/build/tools/mkimage -A arm -O linux -T kernel -C lzma -a 80008000 -e 80008000 -d modkernel.lzma -n Linux-2.6.34 uImage-kernel.temp
../../../../../src/u-boot-amlogic/u-boot/build/tools/mkimage -A arm -O linux -T firmware -C none -a ffffffff -e 00000000 -d uImage-kernel.temp -n LK:ZT280_H1_2n firmware.out
binwalk firmware.out

You have to use a patched version of u-boot mkimage that understands lzma, you might get it from the amlogic wiki.

To know what to patch I looked in the amlogic kernel sourcecode to understand how it works, and then I have basically only changed the data for "maximum" a9_clk and part of the init struct for the camera.
A big thanks to abrekk and vgrade for posting their scripts for stripping and packing the kernel. Otherwise it would have taken me forewer to figure that out.

EDIT:

This is the diffs for 1.1Ghz (untested) The max a9_clk is @ 0x009ab70c
1100000000 > 0x4190ab00 and with correct endiannes: 00ab9041

[[email protected] unlzma]$ hexdump -C myfile > stock_dump
[[email protected] unlzma]$ hexdump -C oc_camerafix > mod_dump
[[email protected] unlzma]$ diff stock_dump mod_dump
508758,508759c508758,508759
< 007c98c0 34 20 53 61 74 20 44 65 63 20 32 34 20 31 33 3a |4 Sat Dec 24 13:|
< 007c98d0 34 36 3a 33 36 20 43 53 54 20 32 30 31 31 0a 00 |46:36 CST 2011..|
---
> 007c98c0 34 20 53 61 74 20 44 65 63 20 32 34 20 31 32 3a |4 Sat Dec 24 12:|
> 007c98d0 32 33 3a 34 35 20 43 53 54 20 32 39 39 39 0a 00 |23:45 CST 2999..|
628259,628260c628259,628260
< 009aae00 20 32 34 20 31 33 3a 34 36 3a 33 36 20 43 53 54 | 24 13:46:36 CST|
< 009aae10 20 32 30 31 31 00 00 00 00 00 00 00 00 00 00 00 | 2011...........|
---
> 009aae00 20 32 34 20 31 32 3a 33 34 3a 35 36 20 43 53 54 | 24 12:34:56 CST|
> 009aae10 20 32 39 39 39 00 00 00 00 00 00 00 00 00 00 00 | 2999...........|
628396c628396
< 009ab700 48 81 8f c0 00 46 c3 23 00 c2 eb 0b 00 08 af 2f |H....F.#......./|
---
> 009ab700 48 81 8f c0 00 46 c3 23 00 c2 eb 0b 00 ab 90 41 |H....F.#.......A|
638550c638550
< 009da2a0 df 23 d9 00 da 00 e0 09 ed 04 ee a0 ef 40
03 |.#[email protected]|
---
> 009da2a0 df 23 d9 00 da 00 e0 09 ed 04 ee ff ef ff
03 |.#..............|

Output from the packing script:

[[email protected] unlzma]$ ./script

LZMA# 4.23 Copyright (c) 1999-2004 Igor Pavlov 2004-12-10
JAVA LZMA Encoder 4.23.1 myspace

time : 12601 ms
Image Name: Linux-2.6.34
Created: Thu Jan 5 23:42:20 2012
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 3714216 Bytes = 3627.16 kB = 3.54 MB
Load Address: 80008000
Entry Point: 80008000
Image Name: LK:ZT280_H1_2n
Created: Thu Jan 5 23:42:20 2012
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 3714280 Bytes = 3627.23 kB = 3.54 MB
Load Address: ffffffff
Entry Point: 00000000

DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xF5677D8, created: Thu Jan 5 23:42:20 2012, image size: 3714280 bytes, Data Address: 0xFFFFFFFF, Entry Point: 0x0, data CRC: 0x7F0545BA, OS: Linux, CPU: ARM, image type: Firmware Image, compression type: none, image name: LK:ZT280_H1_2n
64 0x40 uImage header, header size: 64 bytes, header CRC: 0x59BFCC8C, created: Thu Jan 5 23:42:20 2012, image size: 3714216 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xA6FD70C8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: lzma, image name: Linux-2.6.34
128 0x80 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 10409056 bytes

A 1.1 Ghz kernel can be found at: http://www.megaupload.com/?d=Y14ND4J7 [!!!_BUT I HAVE _NOT_ TESTED IT_!!!], please report what you find.. (No tablet here at the moment..)

EDIT2:

A precompile mkimage for 64bit linux with glibc 2.14 can be found at:
http://www.megaupload.com/?d=R7973E8H
EDIT3:
A statically compiled mkimage is at: http://www.megaupload.com/?d=W3ZMP6NI (should work on "all" 64bit linuxes..)
 

·
Registered
Joined
·
228 Posts
johane is hacker!
Very true :)

Again, a big thanks from me for your description! Is is very detailed and helps to understand the process. And also for the time that you invested. You, sir, are a hero.

Sadly I am in my starting phase with linux related things.
I have a question, since you were able to change the maximum cpu speed, do you think that you would be able to insert steps? Like 200, 400, 800, 1000? Im thinking if this could increase batterylife or if it would just annoy because it would stutter more and not save any energy.
Do you know if the cpu voltage is changed along with the cpu speed? Perhaps we could massivley undervolt at 200mhz to save energy? Just in case there is a way we could change the setting.

Thanks again! Did you tell atp how to do it? So that they can rerelease a few firmwares?

Cant test your 1.1 patch atm, because I have no computer and do not want to possibly live without my tablet :)
 

·
Registered
Joined
·
490 Posts
awesome work johane! If I had noticed this sooner, I would have added this kernel to the 1.1 ROM I posted an hour ago!

As for the 5 point multi-touch thing, I have noticed that exist a few mods for cellphones that edit simple files and other things. I will research it again and get back to you

Since we are in a kernel hacking mood, I would like to share with you the following issue:

WPA2-TKIP encryption as you know (because I mention it a lot lol) is still a big issue on my tablet and other users' tablets

I figured out the problem seems to be in the tablet's ability to decrypt it successfully. It tries to decrypt but gets stuck on a loop that is impossible to go over unless you move outside of the range of the connection or reset the tablet. I have managed to screenshot the dmesg on such an occasion and I am wondering if maybe you and me can get to the bottom of this.

the image is attached to this post!

again..great fu*** work
 

Attachments

·
Registered
Joined
·
228 Posts
awesome work johane! If I had noticed this sooner, I would have added this kernel to the 1.1 ROM I posted an hour ago!

As for the 5 point multi-touch thing, I have noticed that exist a few mods for cellphones that edit simple files and other things. I will research it again and get back to you

Since we are in a kernel hacking mood, I would like to share with you the following issue:

WPA2-TKIP encryption as you know (because I mention it a lot lol) is still a big issue on my tablet and other users' tablets

I figured out the problem seems to be in the tablet's ability to decrypt it successfully. It tries to decrypt but gets stuck on a loop that is impossible to go over unless you move outside of the range of the connection or reset the tablet. I have managed to screenshot the dmesg on such an occasion and I am wondering if maybe you and me can get to the bottom of this.

the image is attached to this post!

again..great fu*** work
Sorry to sound ignorant, use AES. Its better.

Reporting a very unbelievable thing:

So I watched House MD in 720p for 1:20 h.
Afterwards, played Defender from Droidhen for 2h.
Sum: 3h 20min. Still left: 65 % battery if the meter is accurate, what I do not believe. However, if this is righ, this is the freaking best tablet with the freaking best mod ever... !!!
 

·
Registered
Joined
·
18 Posts
I have tried this on ics rom and the gb rom, both freeze on boot up and I have to wait till the battery runs out to reboot. What am I doing wrong? I have the 7n modle number if that helps.
 

·
Registered
Joined
·
34 Posts
I have tried this on ics rom and the gb rom, both freeze on boot up and I have to wait till the battery runs out to reboot. What am I doing wrong? I have the 7n modle number if that helps.
the same to me with the leatest SjPedro custom rom. had to reset the tablet.
 

·
Registered
Joined
·
228 Posts
I would Aonir but the problem is the eduroam connection of my college does not allow other types of encryption
Wow, that sucks I understand. Luckily mine offers most options that are possible, like WPA2 AES, WPA1 and some more :)
 

·
Registered
Joined
·
490 Posts
it's probably nothing serious and difficult to fix once we find the solution...so many times that a problem eludes us until it becomes painfully obvious
 

·
Registered
Joined
·
39 Posts
Hi all

Several people have asked about doing something similar for the C71 and I think it is possible do do exactly the same, The offsets just have to be calculated. (The same would apply to the 3n version af the C91 and future kernel releases)

basically just search for the number 800000000 in the decompressed binary and change to 1000000000. (hex: 00 08 af 2f change to 00 ab 90 41)
And the same for the camera (if it is the same") search for ee a0 ef 40 and change to ee ff ef ff.

If there is multiple occurances then look at the neighbouring data to find out which one is the correct one.

Someone good at scripting could do some automatic fix for this.

Or it might be possible to make a kernel module that searches for the data and patches the kernel at runtime.

--

I noticed that some people have lookup problems, and I can think of a few problems..
1. This is for 2n version (someone should do the same for 3n).
2. The 1.1Ghz version doesn't work. (I havent bothered to try it) Has anyone tested it?
3.1. The filename is wrong. For temporary testing the modified kernel it should be called ZT280.recovery with the commandfile from the first post(This file should really not be needed, but I have not bothered to try and remove it). And SJPedros ICS firmware or official 1224 version should be flashed. (This is like "multi-boot": Camera + Power to start modified kernel, Power to start stock kernel).
3.2 Or to flash it "permanent": Swap the ZT280.kernel from official 1224 firmware or SJPedro modified firmware with this modified one, and then flash it (Camera+power).
4. Some tablets is more "unstable" than others and will not support this clockfrequency. (There is probably a reason for AMlogic to only put 800M as default speed.

The default AM-logic source does not seem to change the CPU-voltage when it changes frequency. But this should be trivial to add with WHEN the sourcecode is availible..

Regarding frequency stepping and fixing the encryption I would say that it is definetely possible but the better solution is to persuade zenithink to release the modified amlogic source. (Or they just release a Patch against the amlogic source)
They do seem to be worried about copyright etc since they have removed AC3 and now also some videocodecs from their firmware. So I think it would makes sense to also comply with the GPL.
http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic

What is your opinion about this atp_uestc?

EDIT:

it's probably nothing serious and difficult to fix once we find the solution...so many times that a problem eludes us until it becomes painfully obvious
Is this some known bug (The encryption problem..) for linux/the wifi driver we are using?

EDIT2: Fixed some typos etc..
 

·
Registered
Joined
·
490 Posts
honestly I have no idea. I have tried to google it a few times and I haven't found anything. But it does seem to be either a driver problem or a kernel problem with the TKIP encryption. On gingerbread releases the tablet would actually connect and be able to stay connected for a while. it would then loose connection, freeze and never be able to connect again to it. So there is something on the kernel or the driver that sometimes works and sometimes doesn't.

On ICS releases the tablet just quite simply freezes and doesn't allow connection.

Quite puzzling


Drivers or kernel or a combination of both? You tell me! I don't have the slightest clue. The only thing even close to a clue was that dmesg screen I managed to get (complete stroke of luck to get it!)
 
1 - 20 of 246 Posts
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top