Home > Android, Telechips > How to Create a Custom Android Firmware for CX-01 mini PC

How to Create a Custom Android Firmware for CX-01 mini PC

I’ve written a post about updating the firmware on CX-01 mini PC last week. But, this week I’ve been able to go further since I’ve learned some tools available for Telechips TCC8902/TCC8903 firmware files are also compatible with TCC892X firmware files, and it’s possible to extract the firmware, modify/add files in different partitions and repack all this to burn it with FWDN tool. I’ll explain the different steps in this post, and even if you don’t own CX-01 it could be interesting as some of the commands are common to all Android devices. But first:

BIG FAT WARNING!!!

Although I believe the steps mentioned in this post are safe, and errors can be recovered by using the CX-01 firmware, CX-01 mini PC is not unbrickable, and if I’m wrong your device will become useless and you won’t be able to fix it. I may also mention some tools (but not show how to use them) that modify startup code and could potentially brick your device if firmware update fails (e.g. power failure), or if you flash a file for the wrong device.

Firmware files overview

I’ve already discussed about those file in the firmware update post, but here’s a quick reminder:

  • CX1-V1.0-4096-8189_en.rom – MTD – This is the part we’re going to modify as it contains the system partition, kernel and ramdisk.
  • lk.rom – BOOT –  This is the part of the firmware that allows you to enter recovery mode to flash your firmware. If you screw up that file or burn one for the wrong device, you can put your device in the trash bin. I won’t be modifying it in this post.
  • NAND Data.fai – NAND Data – This is the part mounted in /sdcard. It’s just a FAT32 partition, so it’s easy to mount and add files if necessary.

Tools required to modify the firmware

We’ll need to use several command line tools running in a terminal in a Linux machine (I’ll use Ubuntu 12.04) in order to extract files then rebuild the firmware:

  • tccunpack/tccpack– Those are 2 command line tools to extract and (re-)pack 3 files in the ROM file (e.g. CX1-V1.0-4096-8189_en.rom):
    • boot.img – This file contains the Android kernel and the ramdisk
    • recovery.img – Same as boot.img for for recovery.
    • system.img – YAFFS2 partition containing /system directory, that’s the file you are more likely to modify, e.g. change build.prop, add default apps in /system/app, add /system/xbin/su…
  • split_bootimg.pl – This perl script extract the kernel and ramdisk from boot.img (AOSP tool)
  • mkbootimg – This command line tool create boot.img from the kernel and ramdisk (AOSP tool)
  • unyaffs – Extract a yaffs(2) partition into a directory
  • mkyaffs2image – Create a yaffs2 partition from a directory

I imported the 4 first tools into github from files located in http://sidenet.ddo.jp/telechips/tccutils/src/, but tccpack/tccunpack developer (“fun”) keeps the latest version (for now the same) in androtab.com. There is also another tool called tccsplash. This tool can change the splash screen, but it modifies lk.rom, so it’s very risky to use it.  Using tccsplash will brick your CX-01 for good, don’t use it.

unyaffs source code is available in github and mkyaffs2image source code can be downloaded as a tar file.

Building the tools

I’ve already built the tools, you can download the binaries here, extract them and make sure they are in your path. If you want to build the tools yourself, I’ll provide the steps below although it’s pretty simple.

For tools in tccutils git repo:


For unyaffs:


For mkyaffs2image:


Edit the Makefile, and remove -DCONFIG_YAFFS_DOES_ECC, then run make.

Extracting firmware files

We’ve got all we need for now, time to extract the firmware files.


Now extract the kernel and ramdisk:


boot.img-kernel is the kernel image you get after build the kernel, so nothing more to do at this stage for this file.
I won’t modify the ramdisk, but if you want to, it is just a cpio file and can be extracted as follows:


Source: Android DLS Wiki

Extract system.img in system directory:


and check the files are there:


All good!

Modifying files

In this section I’ll just give some examples of the things you can modify, but there are lots of other thing you can do.

System partition

If you want to add some default apps into your ROM, simply copy the apks into /system/app.

One way to do this is to install apps in your device, and copy them to your computer via Samba or a USB flash drive to incorporate into your new firmware.

If you’ve rooted your device, you may want to copy /system/xbin/su and/or /system/bin/su to your firmware.

You are also likely to modify build.prop. Have a look at tatubias’ CX-01 build.prop tweaks, to see whst you can modify to improve performance and some other things.

Build new kernel

You may need to re-build the kernel and some modules to add features or apply stability / performance patches.

The instructions are available in Building the Linux Kernel 3.0.8 For Telechips TCC8925 mini PCs, but use cx-01 config instead:


tcc8920st_cx-01_defconfig is the config file extracted from /proc/config.gz in CX-01 HDMI stick.

After build, the kernel binary is available as arch/arm/boot/Image.

Ramdisk

To do. Some startup files can be modified and I think the Android boot logo is there.

Re-create the firmware file

Now that we’ve done some modifications it’s time to repack everything into a flashable firmware:

Let’s create the new system image first:


then the ramdisk:


If you’ve built a new kernel copy arch/arm/boot/Image to the directory where system_new.img and ramdisk_new.cpio.gz are located. Let’s name it boot.img-kernel_new.

Generate a new boot image using the new ramdisk and kernel:

mkbootimg --cmdline 'console=null' --kernel boot.img-kernel_new --ramdisk boot.img-ramdisk_new.cpio.gz --pagesize 4096 --base 0x80000000 -o cx-01-boot-test.img

and finally pack the 2 new boot and system image together with the recovery image to create the new firmware:


That’s it! You can now use CX-01_CNXSOFT_20120821_4GB_en.rom with FWDN to flash the firmware as explained here. Please note, that you do not need to add lk.rom and NAND Data.fai to do the update, and adding lk.rom make even result in briocking your device is firmware update stops during this stage for any reason.

If the device fails to boot after updating your new ROM, simply use CX-01 firmware to recover.

  1. August 23rd, 2012 at 01:26 | #1

    cool!

  2. taubias
    August 23rd, 2012 at 08:17 | #2

    excelent update, great tutorial keep on whit your excelent work

  3. August 23rd, 2012 at 10:00 | #3

    @taubias
    Thanks. But don’t expect too much from me in the short term. I’ll have to switch to other platforms for now, and by the end of the month I’ll hit the roads so I won’t have time at all.

  4. tatubias
    August 25th, 2012 at 21:19 | #4

    cnxsoft;

    when i repack the rom and the use the FWDN application to flash the new rom. it does never finished the CRC check. did you had the same issue?

  5. August 25th, 2012 at 21:51 | #5

    @tatubias
    Yes, I think when I used mkyaffs2image with -DCONFIG_YAFFS_DOES_ECC enabled. Are you using mkyaffs2image from the binaries I provided?

  6. tatubias
    August 26th, 2012 at 11:14 | #6

    finaly got a rom working but when it does finishes. and check the crc it gives us an crc error, but the rom works.
    I’m not the one compilin first we were using other that was not your version, and did not work during the flashing then we did update but we get the crc error.

  7. Ken
    August 26th, 2012 at 17:45 | #7

    I am the guy that tatubias is working with on the rom. (NB I don’t yet have a device!)
    If I use your compiled version we get the crc error but the rom works??
    I was using a different mkyaffs2 program and that hung the flash program, so all we need to know is how to fix the crc error.
    Thanks

  8. August 26th, 2012 at 17:53 | #8

    @Ken
    I remember I got that CRC error at some points, but I’ve tried so many things before being able to write these instructions that I can’t remember for sure, although I think the problem just lies with mkyaffs2image. Have you tried to build mkyaffs2image yourself with the instructions above, instead of using my binary?

    It could also be related to something you’ve modified. Have you only modified system.img, or also boot.img?

  9. Ken
    August 26th, 2012 at 19:52 | #9

    Just the system.img file, I did try compiling it but it is looking for some arm includes that I don’t have or haven’t specified, as yours worked on 64bit I just left it. (In file included from mkyaffsimage.c:34:0:
    ../yaffs_guts.h:828:19: error: conflicting types for ‘loff_t’
    /usr/include/x86_64-linux-gnu/sys/types.h:45:18: note: previous declaration of ‘loff_t’ was here
    )
    There has been nothing added that should cause the crc error, so I don’t know.

  10. August 26th, 2012 at 21:17 | #10

    @Ken
    Maybe trying to generate the image in a 32-bit VM is worth a try.

  11. Hairybiker
    August 26th, 2012 at 22:54 | #11

    The version of os the image is created in shouldn’t make a difference, and since your included app is 64bit I would have to re-compile it to run in a 32bit vm.

    So your compiled roms don’t fail the crc checks?

  12. Teaker1s
    August 27th, 2012 at 00:24 | #12

    if tccunpack pandawill rom and then tccpack the rom is unusable- did you use autosign as it won’t flash after creating a rom?

    Also be aware that unlockroot is installing sweetIM browser hijack spyware

  13. August 27th, 2012 at 10:07 | #13

    @Hairybiker
    I’ve built and run the app in Ubuntu 12.04 32-bit. I do not get CRC error when I flash the ROM.

    @Teaker1s
    I works for me. If you use the binary tools above, they are compiled for 32-bit, I should probably have mentioned it. I don’t know what autosign is…

    I did not know about spyware in unlockroot, maybe it depends from where you download it, I’ll check my system however. Thanks.

  14. Hairybiker
    August 27th, 2012 at 17:36 | #14

    OK just recompiled the source rom and a diff shows no differences from the original, so it must be something in the system.img that is screwing the crc check. Do you know if there is a size limit on /system? (Not that I am including that much!)

  15. August 27th, 2012 at 20:17 | #15

    @Hairybiker
    I don’t know about any size limit. I copied about 15 apk to the /system/app directory including (XBMC) so possibly 100 MB and it could still work.

  16. Hairybiker
    August 28th, 2012 at 00:33 | #16

    Very strange, I only added what was in the tweaks file, I have no idea why this is causing the crc error.

  17. Hairybiker
    August 28th, 2012 at 17:23 | #17

    OK just tried in a vm (32 bit Debian)
    Unpacked the rom and repacked as new rom (only expanded system.img)
    Result:-

    virty system # ~/bin/unyaffs ../system.img
    end of image
    virty system # ls
    app build.prop fonts key_3000000.psr lib tts vendor xbin
    bin etc framework key_921600.psr media usr wifi
    virty system # ~/bin/mkyaffs2image . ../system2.img
    virty system # cd ..
    virty cx-01 # ls
    boot.img recovery.img system system2.img system.img
    virty cx-01 # ~/bin/tccpack boot.img system2.img recovery.img test.rom
    virty cx-01 # diff test.rom ../CX1-V1.0-4096-8189_en.rom
    Binary files test.rom and ../CX1-V1.0-4096-8189_en.rom differ
    virty cx-01 # diff system.img system2.img
    Binary files system.img and system2.img differ

    So the system,img and the system2.img are different even though all I have done is extract and rebuild them
    I followed your guide completely and this is a clean install (I had to install libssl-dev to get they cryptlib installed)

    I haven’t sent the “clean” rom for testing to see if it still gets the crc error but I would assume it would.

  18. August 28th, 2012 at 20:42 | #18

    @Hairybiker
    I’ve tried it, and the size is the same between system.img and system2.img but the md5 is different.

    I’ve also updated my post, replacing mkyaffs2 by mkyaffs2image, but you are using already this tool. I’m not sure what could cause your CRC error. Using tools like ultracompare could possibly help pinpointing the issue.

  19. Hairybiker
    August 28th, 2012 at 22:01 | #19

    OK I have him to test the clean rom and make sure it doesn’t crc then will try adding stuff a bit a time.

  20. Hairybiker
    August 28th, 2012 at 22:26 | #20

    OK so not your tools now doing a small change at a time to see where the error occurs
    Thanks for the tools btw 😉

  21. Hairybiker
    August 31st, 2012 at 21:05 | #21

    Could you do a test please.
    Unpack the rom and change one byte in the build.prop (a 1 to a 0 or vice versa) then build and try and flash it, I my case and in others it crc errors.
    If yours doesn’t could you check your makeyaff2image source is what is posted here please as I believe that is where the error lies.

  22. hackandfab
    September 1st, 2012 at 05:21 | #22

    Hi, I extracted config.gz from /proc from the stock rooted android and used the same .config to build the kernel.

    I followed your procedure without changing boot.img-ramdisk.gz and with the original system.img but It doesn’t boot with the new kernel. Only a black screen appears and I don’t receive the usual plug/unplug signal from the USB cable. (I’ve NOT bricked the cx-01, I can go back to the original firmware with fwdn)

    I think it can be a problem with mkbootimg or with the kernel base address.

    Compiling a new kernel with the original config.gz the load address is 10008000

    UIMAGE arch/arm/boot/uImage
    Image Name: Linux-3.0.8
    Created: Fri Aug 31 16:36:38 2012
    Image Type: ARM Linux Kernel Image (uncompressed)
    Data Size: 3162664 Bytes = 3088.54 kB = 3.02 MB
    Load Address: 10008000
    Entry Point: 10008000
    Image arch/arm/boot/uImage is ready

    But when I did split_bootimg.pl boot.img with the stock boot.img from cx-01
    it showed Kernel addr: 0x80008000

    ../tccutils/split_bootimg.pl boot.img

    Page size: 4096 (0x00001000)
    Kernel size: 6471140 (0x0062bde4)
    Kernel addr: 0x80008000
    Ramdisk size: 1413414 (0x00159126)
    Ramdisk addr: 0x81000000
    Second size: 0 (0x00000000)
    Second addr: 0x80f00000
    Board name:
    Command line: console=null
    Writing boot.img-kernel … complete.
    Writing boot.img-ramdisk.gz … complete.
    note: modules where added later following your blog entry.

    Do you have a working kernel so I can test it? Has anyone succeeded booting a custom kernel?

    md5sum config
    987dc2cf4f897332b63efc148af1a960 config

    I’ve put the stock .config on pastebin here: http://pastebin.com/SDfZVHQ8

    Thanks

  23. September 1st, 2012 at 21:19 | #23

    @Hairybiker
    I can try this, but only in early November… I remember I modify build.prop and added a few apk in /system/app. It worked (and no CRC error), but I lost the ability to root the device, probably because I changed the product name.

    @hackandfab
    The packing is working, but using a custom kernel fails to boot (I tried after this post, as I though it would just work OK as the kernel header was the same as the stock one). I also copied the stock config to github, as mentioned above. It should be the same as yours.

  24. September 13th, 2012 at 16:20 | #24

    The kernel header is not the same.

    The stock one uses “3.0.8-tcc” vermagic string and the one telechips released as opensource uses “3.0.8+” I’ll try changing the string at the kernel sources. Maybe some .ko fails to load*. When compiling the kernel only a cam and scsi kernel modules are generated but there are more at /lib/modules at the stock ramfs maybe they fail to load. This can be tested with “modinfo moduleyouwantotest.ko”

    *= I think this is not the only problem since I don’t see the lk.rom android logo image when booting and it should load first. I’ll also try using gcc 4.4, it seems some people had problems with gcc 4.6 with other androids.

  25. September 18th, 2012 at 22:53 | #25

    I Used gcc 4.4.6 , changed kernel config to “CONFIG_MODULE_FORCE_LOAD=y” and did

    sed -rie ‘s/echo “\+”/#echo “\+”/’ scripts/setlocalversion

    to avoid the plus sign at the kernelversion.

    Now the modinfo vermagic is the same.

    Now I can see something at the screen but it ends on a screen with a green Android laying down and a red triangle with an exclamation. No combination of keyboard and mouse (including dongle Fn button and dragging) seems to work. I can see rescue boot with adb devices but adb -s serialnumber shell won’t work.

    I even made a kernel with the exact same lenght as the stock image.

    I tried editing the stock kernel and changing robin to rabit on boot.img-kernel with dhex editor and that kernel booted ok so I don’t think it is a checksum problem.

    I have no idea how to continue 🙁

  26. olexiyt
  27. azorzi
    November 23rd, 2012 at 17:42 | #27

    a question:
    i’m try to compress ramdisk without change data.
    I have see that compress ratio si different from original ramdisk
    why?

    this is an example under ubuntu linux 12
    size – file name original
    1413459 – boot.img-ramdisk.gz

    dezipped will be
    size – file name
    3801088 – boot.img-ramdisk

    now zip the file with gzip
    size – file name
    1417449 – boot.img-ramdisk.gz

    the size is different from origina ramdisk zipped!!!

    If I reate a rom for CX-01 with this new ramdisk I have boot problem.
    Instead if I use the original ramdisk I have not problem.

    Have you had the same problem?

  28. November 23rd, 2012 at 22:24 | #28

    @azorzi
    The article linked from this post (Android DLS Wiki) says you need to run:
    find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz

    to generate the ramdisk, have you done this?

  29. azorzi
    December 3rd, 2012 at 04:49 | #29

    @cnxsoft
    Sorry I have read your reply only now 🙁

    this is my command to recreate img-ramdisk

    find . | cpio -o -H newc | gzip > ../boot.img-ramdisk_new.gz
    7424 blocks

    the size is different from origin ramdisk

    1413459 boot.img-ramdisk.gz
    1417428 boot.img-ramdisk_new.gz

  30. December 3rd, 2012 at 08:42 | #30

    @azorzi
    Maybe they used gzip -9 for better compression. But it should not be the issue here.

  31. juanma
    January 13th, 2013 at 03:20 | #31

    Hi all.
    i’m trying to build a custom firmware for the 8gb device but when I do the mkbootimg it fails with failed writing error. My command and output:
    mkbootimg –cmdline ‘console=null’ –kernel boot.img-kernel –ramdisk boot.img-ramdisk.gz –pagesize 8192 –base 0x80000000 -o cx-01-boot-test.img
    error: failed writing ‘cx-01-boot-test.img’: Success

    If I try to build it with pagesize 4096 it works ok. I’ve used different mkbootimg, some binaries, some compiled from sources (debian sqeeze whit gcc 4.4.5) but it don’t works in any manner. Any help?
    The last try was unpacking the original 8gb rom (tccunpack, split_image…) and tryng to pack it again without modifying nothing.

    thxs

    p.d. I apologise for any mistakes in my English, i try to do the best

  32. January 13th, 2013 at 10:12 | #32

    @juanma
    It’s been a while since I’ve not played with CX-01. It looks like the tools cannot support 8GB. There’s a long thread with people trying it out: http://www.pandawillforum.com/showthread.php?12711-How-to-Create-a-Custom-Android-Firmware-for-CX-01-mini-PC

  33. juanma
    January 15th, 2013 at 19:30 | #33

    @cnxsoft
    Hi.
    Thanks. Finally i’ve succesfully build the 8gb Rom version but i couldn’t test it yet (perhaps tonight).
    The trick was changing a line in the source code of the mkbootimage. I didn’t remeber well but i think that the line in question was “pagemask = pagesize – 1;” and I replaced with “pagemask=8189;” because is the second “number” of the firmware: CX1-V1.0-4096-8189_en.rom and I know that any number in a released software is there for a well known reason and also in the acknowledge that the “failed wiriting error” was in that line, i saw it debugging the source, and also a few more changes about adding 8192 as default value in the sources.
    I don’t know if it works (if it works I must begin to play loto hehe) but if it finally does I will publish here the changes I made.

    Thanks and again apologies for any mistakes in my English.

  34. juanma
    January 18th, 2013 at 02:49 | #34

    Hi there.
    Only 2 words: It works!!!!!
    Now I’ll try to delete/add some files from the ramdisk and check if it continues working.
    Thanks for the great job you did and all the info and tools.

  35. juanma
    January 18th, 2013 at 02:55 | #35

    @juanma
    The changes to the mkbootimg.c file are:
    line 75:
    static unsigned char padding[8192] = { 0, };
    line 79:
    unsigned pagemask = 8189;
    line 108:
    unsigned pagesize = 8192;
    line 192
    if ((pagesize != 8192) && (pagesize != 4096)) {
    —————————————————————-
    build as usual and profit

    The rom is working but i’ve made no change to the firm (only extract and build) so I’ll try later to make some changes and try again. If it works i must play loto definitely.

  36. January 18th, 2013 at 13:55 | #36

    Thanks for the update @juanma . Keep us informed if you make further progress.

  1. August 28th, 2012 at 01:38 | #1
  2. December 25th, 2012 at 15:12 | #2
  3. March 26th, 2013 at 16:55 | #3