I’ve written a post about updating the firmware on CX-01 mini PC last week. But, this week I’ve been able to go further since I’ve learned some tools available for Telechips TCC8902/TCC8903 firmware files are also compatible with TCC892X firmware files, and it’s possible to extract the firmware, modify/add files in different partitions and repack all this to burn it with FWDN tool. I’ll explain the different steps in this post, and even if you don’t own CX-01 it could be interesting as some of the commands are common to all Android devices. But first:
BIG FAT WARNING!!!
Although I believe the steps mentioned in this post are safe, and errors can be recovered by using the CX-01 firmware, CX-01 mini PC is not unbrickable, and if I’m wrong your device will become useless and you won’t be able to fix it. I may also mention some tools (but not show how to use them) that modify startup code and could potentially brick your device if firmware update fails (e.g. power failure), or if you flash a file for the wrong device.
Firmware files overview
I’ve already discussed about those file in the firmware update post, but here’s a quick reminder:
- CX1-V1.0-4096-8189_en.rom – MTD – This is the part we’re going to modify as it contains the system partition, kernel and ramdisk.
- lk.rom – BOOT - This is the part of the firmware that allows you to enter recovery mode to flash your firmware. If you screw up that file or burn one for the wrong device, you can put your device in the trash bin. I won’t be modifying it in this post.
- NAND Data.fai – NAND Data – This is the part mounted in /sdcard. It’s just a FAT32 partition, so it’s easy to mount and add files if necessary.
Tools required to modify the firmware
We’ll need to use several command line tools running in a terminal in a Linux machine (I’ll use Ubuntu 12.04) in order to extract files then rebuild the firmware:
- tccunpack/tccpack- Those are 2 command line tools to extract and (re-)pack 3 files in the ROM file (e.g. CX1-V1.0-4096-8189_en.rom):
- boot.img – This file contains the Android kernel and the ramdisk
- recovery.img – Same as boot.img for for recovery.
- system.img – YAFFS2 partition containing /system directory, that’s the file you are more likely to modify, e.g. change build.prop, add default apps in /system/app, add /system/xbin/su…
- split_bootimg.pl – This perl script extract the kernel and ramdisk from boot.img (AOSP tool)
- mkbootimg – This command line tool create boot.img from the kernel and ramdisk (AOSP tool)
- unyaffs – Extract a yaffs(2) partition into a directory
- mkyaffs2image – Create a yaffs2 partition from a directory
I imported the 4 first tools into github from files located in http://sidenet.ddo.jp/telechips/tccutils/src/, but tccpack/tccunpack developer (“fun”) keeps the latest version (for now the same) in androtab.com.
There is also another tool called tccsplash. This tool can change the splash screen, but it modifies lk.rom, so it’s very risky to use it. Using tccsplash will brick your CX-01 for good, don’t use it.
unyaffs source code is available in github and mkyaffs2image source code can be downloaded as a tar file.
Building the tools
I’ve already built the tools, you can download the binaries here, extract them and make sure they are in your path. If you want to build the tools yourself, I’ll provide the steps below although it’s pretty simple.
For tools in tccutils git repo:
git clone git://github.com/cnxsoft/tccutils.git
gcc tccpack.c -o tccpack
gcc tccunpack.c -o tccunpack
gcc mkbootimg.c -o mkbootimg -lcrypto
git clone git://github.com/ehlers/unyaffs.git
tar xzvf mkyaffs2.tar.gz
Edit the Makefile, and remove -DCONFIG_YAFFS_DOES_ECC, then run make.
Extracting firmware files
We’ve got all we need for now, time to extract the firmware files.
00000040-0078703f boot.img 7892992 bytes
00787050-0e18d5cf system.img 228615552 bytes
0e18d5e0-0e9665df recovery.img 8228864 bytes
Now extract the kernel and ramdisk:
Page size: 4096 (0x00001000)
Kernel size: 6471140 (0x0062bde4)
Ramdisk size: 1413414 (0x00159126)
Second size: 0 (0x00000000)
Command line: console=null
Writing boot.img-kernel ... complete.
Writing boot.img-ramdisk.gz ... complete.
boot.img-kernel is the kernel image you get after build the kernel, so nothing more to do at this stage for this file.
I won’t modify the ramdisk, but if you want to, it is just a cpio file and can be extracted as follows:
gunzip -c ../boot.img-ramdisk.gz | cpio -i
Source: Android DLS Wiki
Extract system.img in system directory:
sudo unyaffs ../system.img
and check the files are there:
app build.prop fonts key_3000000.psr lib tts vendor xbin
bin etc framework key_921600.psr media usr wifi
In this section I’ll just give some examples of the things you can modify, but there are lots of other thing you can do.
If you want to add some default apps into your ROM, simply copy the apks into /system/app.
One way to do this is to install apps in your device, and copy them to your computer via Samba or a USB flash drive to incorporate into your new firmware.
If you’ve rooted your device, you may want to copy /system/xbin/su and/or /system/bin/su to your firmware.
You are also likely to modify build.prop. Have a look at tatubias’ CX-01 build.prop tweaks, to see whst you can modify to improve performance and some other things.
Build new kernel
You may need to re-build the kernel and some modules to add features or apply stability / performance patches.
The instructions are available in Building the Linux Kernel 3.0.8 For Telechips TCC8925 mini PCs, but use cx-01 config instead:
make ARCH=arm tcc8920st_cx-01_defconfig
tcc8920st_cx-01_defconfig is the config file extracted from /proc/config.gz in CX-01 HDMI stick.
After build, the kernel binary is available as arch/arm/boot/Image.
To do. Some startup files can be modified and I think the Android boot logo is there.
Re-create the firmware file
Now that we’ve done some modifications it’s time to repack everything into a flashable firmware:
Let’s create the new system image first:
sudo mkyaffs2image . ../system_new.img
then the ramdisk:
find . | cpio -o -H newc | gzip > ../ramdisk_new.cpio.gz
If you’ve built a new kernel copy arch/arm/boot/Image to the directory where system_new.img and ramdisk_new.cpio.gz are located. Let’s name it boot.img-kernel_new.
Generate a new boot image using the new ramdisk and kernel:
mkbootimg --cmdline 'console=null' --kernel boot.img-kernel_new --ramdisk boot.img-ramdisk_new.cpio.gz --pagesize 4096 --base 0x80000000 -o cx-01-boot-test.img
and finally pack the 2 new boot and system image together with the recovery image to create the new firmware:
tccpack cx-01-boot-test.img system_new.img recovery.img CX-01_CNXSOFT_20120821_4GB_en.rom
That’s it! You can now use CX-01_CNXSOFT_20120821_4GB_en.rom with FWDN to flash the firmware as explained here. Please note, that you do not need to add lk.rom and NAND Data.fai to do the update, and adding lk.rom make even result in briocking your device is firmware update stops during this stage for any reason.
If the device fails to boot after updating your new ROM, simply use CX-01 firmware to recover.