How to Create a Custom Android Firmware for CX-01 mini PC

I’ve written a post about updating the firmware on CX-01 mini PC last week. But, this week I’ve been able to go further since I’ve learned some tools available for Telechips TCC8902/TCC8903 firmware files are also compatible with TCC892X firmware files, and it’s possible to extract the firmware, modify/add files in different partitions and repack all this to burn it with FWDN tool. I’ll explain the different steps in this post, and even if you don’t own CX-01 it could be interesting as some of the commands are common to all Android devices. But first:

BIG FAT WARNING!!!

Although I believe the steps mentioned in this post are safe, and errors can be recovered by using the CX-01 firmware, CX-01 mini PC is not unbrickable, and if I’m wrong your device will become useless and you won’t be able to fix it. I may also mention some tools (but not show how to use them) that modify startup code and could potentially brick your device if firmware update fails (e.g. power failure), or if you flash a file for the wrong device.

Firmware files overview

I’ve already discussed about those file in the firmware update post, but here’s a quick reminder:

  • CX1-V1.0-4096-8189_en.rom – MTD – This is the part we’re going to modify as it contains the system partition, kernel and ramdisk.
  • lk.rom – BOOT –  This is the part of the firmware that allows you to enter recovery mode to flash your firmware. If you screw up that file or burn one for the wrong device, you can put your device in the trash bin. I won’t be modifying it in this post.
  • NAND Data.fai – NAND Data – This is the part mounted in /sdcard. It’s just a FAT32 partition, so it’s easy to mount and add files if necessary.

Tools required to modify the firmware

We’ll need to use several command line tools running in a terminal in a Linux machine (I’ll use Ubuntu 12.04) in order to extract files then rebuild the firmware:

  • tccunpack/tccpack– Those are 2 command line tools to extract and (re-)pack 3 files in the ROM file (e.g. CX1-V1.0-4096-8189_en.rom):
    • boot.img – This file contains the Android kernel and the ramdisk
    • recovery.img – Same as boot.img for for recovery.
    • system.img – YAFFS2 partition containing /system directory, that’s the file you are more likely to modify, e.g. change build.prop, add default apps in /system/app, add /system/xbin/su…
  • split_bootimg.pl – This perl script extract the kernel and ramdisk from boot.img (AOSP tool)
  • mkbootimg – This command line tool create boot.img from the kernel and ramdisk (AOSP tool)
  • unyaffs – Extract a yaffs(2) partition into a directory
  • mkyaffs2image – Create a yaffs2 partition from a directory

I imported the 4 first tools into github from files located in http://sidenet.ddo.jp/telechips/tccutils/src/, but tccpack/tccunpack developer (“fun”) keeps the latest version (for now the same) in androtab.com. There is also another tool called tccsplash. This tool can change the splash screen, but it modifies lk.rom, so it’s very risky to use it.  Using tccsplash will brick your CX-01 for good, don’t use it.

unyaffs source code is available in github and mkyaffs2image source code can be downloaded as a tar file.

Building the tools

I’ve already built the tools, you can download the binaries here, extract them and make sure they are in your path. If you want to build the tools yourself, I’ll provide the steps below although it’s pretty simple.

For tools in tccutils git repo:


For unyaffs:


For mkyaffs2image:


Edit the Makefile, and remove -DCONFIG_YAFFS_DOES_ECC, then run make.

Extracting firmware files

We’ve got all we need for now, time to extract the firmware files.


Now extract the kernel and ramdisk:


boot.img-kernel is the kernel image you get after build the kernel, so nothing more to do at this stage for this file.
I won’t modify the ramdisk, but if you want to, it is just a cpio file and can be extracted as follows:


Source: Android DLS Wiki

Extract system.img in system directory:


and check the files are there:


All good!

Modifying files

In this section I’ll just give some examples of the things you can modify, but there are lots of other thing you can do.

System partition

If you want to add some default apps into your ROM, simply copy the apks into /system/app.

One way to do this is to install apps in your device, and copy them to your computer via Samba or a USB flash drive to incorporate into your new firmware.

If you’ve rooted your device, you may want to copy /system/xbin/su and/or /system/bin/su to your firmware.

You are also likely to modify build.prop. Have a look at tatubias’ CX-01 build.prop tweaks, to see whst you can modify to improve performance and some other things.

Build new kernel

You may need to re-build the kernel and some modules to add features or apply stability / performance patches.

The instructions are available in Building the Linux Kernel 3.0.8 For Telechips TCC8925 mini PCs, but use cx-01 config instead:


tcc8920st_cx-01_defconfig is the config file extracted from /proc/config.gz in CX-01 HDMI stick.

After build, the kernel binary is available as arch/arm/boot/Image.

Ramdisk

To do. Some startup files can be modified and I think the Android boot logo is there.

Re-create the firmware file

Now that we’ve done some modifications it’s time to repack everything into a flashable firmware:

Let’s create the new system image first:


then the ramdisk:


If you’ve built a new kernel copy arch/arm/boot/Image to the directory where system_new.img and ramdisk_new.cpio.gz are located. Let’s name it boot.img-kernel_new.

Generate a new boot image using the new ramdisk and kernel:

mkbootimg --cmdline 'console=null' --kernel boot.img-kernel_new --ramdisk boot.img-ramdisk_new.cpio.gz --pagesize 4096 --base 0x80000000 -o cx-01-boot-test.img

and finally pack the 2 new boot and system image together with the recovery image to create the new firmware:


That’s it! You can now use CX-01_CNXSOFT_20120821_4GB_en.rom with FWDN to flash the firmware as explained here. Please note, that you do not need to add lk.rom and NAND Data.fai to do the update, and adding lk.rom make even result in briocking your device is firmware update stops during this stage for any reason.

If the device fails to boot after updating your new ROM, simply use CX-01 firmware to recover.

Share this:

Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress

ROCK Pi 4C Plus
Subscribe
Notify of
guest
The comment form collects your name, email and content to allow us keep track of the comments placed on the website. Please read and accept our website Terms and Privacy Policy to post a comment.
39 Comments
oldest
newest
myxa78@gmail.com
11 years ago

cool!

taubias
taubias
11 years ago

excelent update, great tutorial keep on whit your excelent work

tatubias
tatubias
11 years ago

cnxsoft;

when i repack the rom and the use the FWDN application to flash the new rom. it does never finished the CRC check. did you had the same issue?

tatubias
tatubias
11 years ago

finaly got a rom working but when it does finishes. and check the crc it gives us an crc error, but the rom works.
I’m not the one compilin first we were using other that was not your version, and did not work during the flashing then we did update but we get the crc error.

Ken
Ken
11 years ago

I am the guy that tatubias is working with on the rom. (NB I don’t yet have a device!)
If I use your compiled version we get the crc error but the rom works??
I was using a different mkyaffs2 program and that hung the flash program, so all we need to know is how to fix the crc error.
Thanks

Ken
Ken
11 years ago

Just the system.img file, I did try compiling it but it is looking for some arm includes that I don’t have or haven’t specified, as yours worked on 64bit I just left it. (In file included from mkyaffsimage.c:34:0:
../yaffs_guts.h:828:19: error: conflicting types for ‘loff_t’
/usr/include/x86_64-linux-gnu/sys/types.h:45:18: note: previous declaration of ‘loff_t’ was here
)
There has been nothing added that should cause the crc error, so I don’t know.

Hairybiker
Hairybiker
11 years ago

The version of os the image is created in shouldn’t make a difference, and since your included app is 64bit I would have to re-compile it to run in a 32bit vm.

So your compiled roms don’t fail the crc checks?

Teaker1s
Teaker1s
11 years ago

if tccunpack pandawill rom and then tccpack the rom is unusable- did you use autosign as it won’t flash after creating a rom?

Also be aware that unlockroot is installing sweetIM browser hijack spyware

Hairybiker
Hairybiker
11 years ago

OK just recompiled the source rom and a diff shows no differences from the original, so it must be something in the system.img that is screwing the crc check. Do you know if there is a size limit on /system? (Not that I am including that much!)

Hairybiker
Hairybiker
11 years ago

Very strange, I only added what was in the tweaks file, I have no idea why this is causing the crc error.

Hairybiker
Hairybiker
11 years ago

OK just tried in a vm (32 bit Debian) Unpacked the rom and repacked as new rom (only expanded system.img) Result:- virty system # ~/bin/unyaffs ../system.img end of image virty system # ls app build.prop fonts key_3000000.psr lib tts vendor xbin bin etc framework key_921600.psr media usr wifi virty system # ~/bin/mkyaffs2image . ../system2.img virty system # cd .. virty cx-01 # ls boot.img recovery.img system system2.img system.img virty cx-01 # ~/bin/tccpack boot.img system2.img recovery.img test.rom virty cx-01 # diff test.rom ../CX1-V1.0-4096-8189_en.rom Binary files test.rom and ../CX1-V1.0-4096-8189_en.rom differ virty cx-01 # diff system.img system2.img Binary files system.img and system2.img differ… Read more »

Hairybiker
Hairybiker
11 years ago

OK I have him to test the clean rom and make sure it doesn’t crc then will try adding stuff a bit a time.

Hairybiker
Hairybiker
11 years ago

OK so not your tools now doing a small change at a time to see where the error occurs
Thanks for the tools btw 😉

Hairybiker
Hairybiker
11 years ago

Could you do a test please.
Unpack the rom and change one byte in the build.prop (a 1 to a 0 or vice versa) then build and try and flash it, I my case and in others it crc errors.
If yours doesn’t could you check your makeyaff2image source is what is posted here please as I believe that is where the error lies.

hackandfab
hackandfab
11 years ago

Hi, I extracted config.gz from /proc from the stock rooted android and used the same .config to build the kernel. I followed your procedure without changing boot.img-ramdisk.gz and with the original system.img but It doesn’t boot with the new kernel. Only a black screen appears and I don’t receive the usual plug/unplug signal from the USB cable. (I’ve NOT bricked the cx-01, I can go back to the original firmware with fwdn) I think it can be a problem with mkbootimg or with the kernel base address. Compiling a new kernel with the original config.gz the load address is 10008000… Read more »

hackandfab
hackandfab
11 years ago

The kernel header is not the same. The stock one uses “3.0.8-tcc” vermagic string and the one telechips released as opensource uses “3.0.8+” I’ll try changing the string at the kernel sources. Maybe some .ko fails to load*. When compiling the kernel only a cam and scsi kernel modules are generated but there are more at /lib/modules at the stock ramfs maybe they fail to load. This can be tested with “modinfo moduleyouwantotest.ko” *= I think this is not the only problem since I don’t see the lk.rom android logo image when booting and it should load first. I’ll also… Read more »

hackandfab
hackandfab
11 years ago

I Used gcc 4.4.6 , changed kernel config to “CONFIG_MODULE_FORCE_LOAD=y” and did sed -rie ‘s/echo “\+”/#echo “\+”/’ scripts/setlocalversion to avoid the plus sign at the kernelversion. Now the modinfo vermagic is the same. Now I can see something at the screen but it ends on a screen with a green Android laying down and a red triangle with an exclamation. No combination of keyboard and mouse (including dongle Fn button and dragging) seems to work. I can see rescue boot with adb devices but adb -s serialnumber shell won’t work. I even made a kernel with the exact same lenght… Read more »

azorzi
azorzi
11 years ago

a question: i’m try to compress ramdisk without change data. I have see that compress ratio si different from original ramdisk why? this is an example under ubuntu linux 12 size – file name original 1413459 – boot.img-ramdisk.gz dezipped will be size – file name 3801088 – boot.img-ramdisk now zip the file with gzip size – file name 1417449 – boot.img-ramdisk.gz the size is different from origina ramdisk zipped!!! If I reate a rom for CX-01 with this new ramdisk I have boot problem. Instead if I use the original ramdisk I have not problem. Have you had the same… Read more »

azorzi
azorzi
11 years ago


Sorry I have read your reply only now 🙁

this is my command to recreate img-ramdisk

find . | cpio -o -H newc | gzip > ../boot.img-ramdisk_new.gz
7424 blocks

the size is different from origin ramdisk

1413459 boot.img-ramdisk.gz
1417428 boot.img-ramdisk_new.gz

juanma
juanma
11 years ago

Hi all. i’m trying to build a custom firmware for the 8gb device but when I do the mkbootimg it fails with failed writing error. My command and output: mkbootimg –cmdline ‘console=null’ –kernel boot.img-kernel –ramdisk boot.img-ramdisk.gz –pagesize 8192 –base 0x80000000 -o cx-01-boot-test.img error: failed writing ‘cx-01-boot-test.img’: Success If I try to build it with pagesize 4096 it works ok. I’ve used different mkbootimg, some binaries, some compiled from sources (debian sqeeze whit gcc 4.4.5) but it don’t works in any manner. Any help? The last try was unpacking the original 8gb rom (tccunpack, split_image…) and tryng to pack it again… Read more »

juanma
juanma
11 years ago

@Jean-Luc Aufranc (CNXSoft) Hi. Thanks. Finally i’ve succesfully build the 8gb Rom version but i couldn’t test it yet (perhaps tonight). The trick was changing a line in the source code of the mkbootimage. I didn’t remeber well but i think that the line in question was “pagemask = pagesize – 1;” and I replaced with “pagemask=8189;” because is the second “number” of the firmware: CX1-V1.0-4096-8189_en.rom and I know that any number in a released software is there for a well known reason and also in the acknowledge that the “failed wiriting error” was in that line, i saw it… Read more »

juanma
juanma
11 years ago

Hi there.
Only 2 words: It works!!!!!
Now I’ll try to delete/add some files from the ramdisk and check if it continues working.
Thanks for the great job you did and all the info and tools.

juanma
juanma
11 years ago

@juanma
The changes to the mkbootimg.c file are:
line 75:
static unsigned char padding[8192] = { 0, };
line 79:
unsigned pagemask = 8189;
line 108:
unsigned pagesize = 8192;
line 192
if ((pagesize != 8192) && (pagesize != 4096)) {
—————————————————————-
build as usual and profit

The rom is working but i’ve made no change to the firm (only extract and build) so I’ll try later to make some changes and try again. If it works i must play loto definitely.

Khadas VIM4 SBC