How to Create a Custom Android Firmware for CX-01 mini PC

I’ve written a post about updating the firmware on CX-01 mini PC last week. But, this week I’ve been able to go further since I’ve learned some tools available for Telechips TCC8902/TCC8903 firmware files are also compatible with TCC892X firmware files, and it’s possible to extract the firmware, modify/add files in different partitions and repack all this to burn it with FWDN tool. I’ll explain the different steps in this post, and even if you don’t own CX-01 it could be interesting as some of the commands are common to all Android devices. But first:

BIG FAT WARNING!!!

Although I believe the steps mentioned in this post are safe, and errors can be recovered by using the CX-01 firmware, CX-01 mini PC is not unbrickable, and if I’m wrong your device will become useless and you won’t be able to fix it. I may also mention some tools (but not show how to use them) that modify startup code and could potentially brick your device if firmware update fails (e.g. power failure), or if you flash a file for the wrong device.

Firmware files overview

I’ve already discussed about those file in the firmware update post, but here’s a quick reminder:

  • CX1-V1.0-4096-8189_en.rom – MTD – This is the part we’re going to modify as it contains the system partition, kernel and ramdisk.
  • lk.rom – BOOT –  This is the part of the firmware that allows you to enter recovery mode to flash your firmware. If you screw up that file or burn one for the wrong device, you can put your device in the trash bin. I won’t be modifying it in this post.
  • NAND Data.fai – NAND Data – This is the part mounted in /sdcard. It’s just a FAT32 partition, so it’s easy to mount and add files if necessary.

Tools required to modify the firmware

We’ll need to use several command line tools running in a terminal in a Linux machine (I’ll use Ubuntu 12.04) in order to extract files then rebuild the firmware:

  • tccunpack/tccpack– Those are 2 command line tools to extract and (re-)pack 3 files in the ROM file (e.g. CX1-V1.0-4096-8189_en.rom):
    • boot.img – This file contains the Android kernel and the ramdisk
    • recovery.img – Same as boot.img for for recovery.
    • system.img – YAFFS2 partition containing /system directory, that’s the file you are more likely to modify, e.g. change build.prop, add default apps in /system/app, add /system/xbin/su…
  • split_bootimg.pl – This perl script extract the kernel and ramdisk from boot.img (AOSP tool)
  • mkbootimg – This command line tool create boot.img from the kernel and ramdisk (AOSP tool)
  • unyaffs – Extract a yaffs(2) partition into a directory
  • mkyaffs2image – Create a yaffs2 partition from a directory

I imported the 4 first tools into github from files located in http://sidenet.ddo.jp/telechips/tccutils/src/, but tccpack/tccunpack developer (“fun”) keeps the latest version (for now the same) in androtab.com. There is also another tool called tccsplash. This tool can change the splash screen, but it modifies lk.rom, so it’s very risky to use it.  Using tccsplash will brick your CX-01 for good, don’t use it.

unyaffs source code is available in github and mkyaffs2image source code can be downloaded as a tar file.

Building the tools

I’ve already built the tools, you can download the binaries here, extract them and make sure they are in your path. If you want to build the tools yourself, I’ll provide the steps below although it’s pretty simple.

For tools in tccutils git repo:


For unyaffs:


For mkyaffs2image:


Edit the Makefile, and remove -DCONFIG_YAFFS_DOES_ECC, then run make.

Extracting firmware files

We’ve got all we need for now, time to extract the firmware files.


Now extract the kernel and ramdisk:


boot.img-kernel is the kernel image you get after build the kernel, so nothing more to do at this stage for this file.
I won’t modify the ramdisk, but if you want to, it is just a cpio file and can be extracted as follows:


Source: Android DLS Wiki

Extract system.img in system directory:


and check the files are there:


All good!

Modifying files

In this section I’ll just give some examples of the things you can modify, but there are lots of other thing you can do.

System partition

If you want to add some default apps into your ROM, simply copy the apks into /system/app.

One way to do this is to install apps in your device, and copy them to your computer via Samba or a USB flash drive to incorporate into your new firmware.

If you’ve rooted your device, you may want to copy /system/xbin/su and/or /system/bin/su to your firmware.

You are also likely to modify build.prop. Have a look at tatubias’ CX-01 build.prop tweaks, to see whst you can modify to improve performance and some other things.

Build new kernel

You may need to re-build the kernel and some modules to add features or apply stability / performance patches.

The instructions are available in Building the Linux Kernel 3.0.8 For Telechips TCC8925 mini PCs, but use cx-01 config instead:


tcc8920st_cx-01_defconfig is the config file extracted from /proc/config.gz in CX-01 HDMI stick.

After build, the kernel binary is available as arch/arm/boot/Image.

Ramdisk

To do. Some startup files can be modified and I think the Android boot logo is there.

Re-create the firmware file

Now that we’ve done some modifications it’s time to repack everything into a flashable firmware:

Let’s create the new system image first:


then the ramdisk:


If you’ve built a new kernel copy arch/arm/boot/Image to the directory where system_new.img and ramdisk_new.cpio.gz are located. Let’s name it boot.img-kernel_new.

Generate a new boot image using the new ramdisk and kernel:

mkbootimg --cmdline 'console=null' --kernel boot.img-kernel_new --ramdisk boot.img-ramdisk_new.cpio.gz --pagesize 4096 --base 0x80000000 -o cx-01-boot-test.img

and finally pack the 2 new boot and system image together with the recovery image to create the new firmware:


That’s it! You can now use CX-01_CNXSOFT_20120821_4GB_en.rom with FWDN to flash the firmware as explained here. Please note, that you do not need to add lk.rom and NAND Data.fai to do the update, and adding lk.rom make even result in briocking your device is firmware update stops during this stage for any reason.

If the device fails to boot after updating your new ROM, simply use CX-01 firmware to recover.

Support CNX Software - Donate via PayPal or become a Patron on Patreon

39
Leave a Reply

avatar
39 Comment threads
0 Thread replies
0 Followers
 
Most reacted comment
Hottest comment thread
9 Comment authors
Single Aplikasi di Android? | sevankajuanmaSingle Aplikasi di Android? » Sunaryo Hadiazorziolexiyt Recent comment authors
  Subscribe  
newest oldest most voted
Notify of
myxa78@gmail.com
Guest

cool!

taubias
Guest
taubias

excelent update, great tutorial keep on whit your excelent work

tatubias
Guest
tatubias

cnxsoft;

when i repack the rom and the use the FWDN application to flash the new rom. it does never finished the CRC check. did you had the same issue?

tatubias
Guest
tatubias

finaly got a rom working but when it does finishes. and check the crc it gives us an crc error, but the rom works.
I’m not the one compilin first we were using other that was not your version, and did not work during the flashing then we did update but we get the crc error.

Ken
Guest
Ken

I am the guy that tatubias is working with on the rom. (NB I don’t yet have a device!)
If I use your compiled version we get the crc error but the rom works??
I was using a different mkyaffs2 program and that hung the flash program, so all we need to know is how to fix the crc error.
Thanks

Ken
Guest
Ken

Just the system.img file, I did try compiling it but it is looking for some arm includes that I don’t have or haven’t specified, as yours worked on 64bit I just left it. (In file included from mkyaffsimage.c:34:0:
../yaffs_guts.h:828:19: error: conflicting types for ‘loff_t’
/usr/include/x86_64-linux-gnu/sys/types.h:45:18: note: previous declaration of ‘loff_t’ was here
)
There has been nothing added that should cause the crc error, so I don’t know.

Hairybiker
Guest
Hairybiker

The version of os the image is created in shouldn’t make a difference, and since your included app is 64bit I would have to re-compile it to run in a 32bit vm.

So your compiled roms don’t fail the crc checks?

Teaker1s
Guest
Teaker1s

if tccunpack pandawill rom and then tccpack the rom is unusable- did you use autosign as it won’t flash after creating a rom?

Also be aware that unlockroot is installing sweetIM browser hijack spyware

Hairybiker
Guest
Hairybiker

OK just recompiled the source rom and a diff shows no differences from the original, so it must be something in the system.img that is screwing the crc check. Do you know if there is a size limit on /system? (Not that I am including that much!)

Hairybiker
Guest
Hairybiker

Very strange, I only added what was in the tweaks file, I have no idea why this is causing the crc error.

trackback

[…] 7042, Coby 8042, Ployer MOMO8 Read this. How to Create a Custom Android Firmware for CX-01 mini PC | CNXSoft – Embedded Software Develo… Reply With Quote […]

Hairybiker
Guest
Hairybiker

OK just tried in a vm (32 bit Debian)
Unpacked the rom and repacked as new rom (only expanded system.img)
Result:-

virty system # ~/bin/unyaffs ../system.img
end of image
virty system # ls
app build.prop fonts key_3000000.psr lib tts vendor xbin
bin etc framework key_921600.psr media usr wifi
virty system # ~/bin/mkyaffs2image . ../system2.img
virty system # cd ..
virty cx-01 # ls
boot.img recovery.img system system2.img system.img
virty cx-01 # ~/bin/tccpack boot.img system2.img recovery.img test.rom
virty cx-01 # diff test.rom ../CX1-V1.0-4096-8189_en.rom
Binary files test.rom and ../CX1-V1.0-4096-8189_en.rom differ
virty cx-01 # diff system.img system2.img
Binary files system.img and system2.img differ

So the system,img and the system2.img are different even though all I have done is extract and rebuild them
I followed your guide completely and this is a clean install (I had to install libssl-dev to get they cryptlib installed)

I haven’t sent the “clean” rom for testing to see if it still gets the crc error but I would assume it would.

Hairybiker
Guest
Hairybiker

OK I have him to test the clean rom and make sure it doesn’t crc then will try adding stuff a bit a time.

Hairybiker
Guest
Hairybiker

OK so not your tools now doing a small change at a time to see where the error occurs
Thanks for the tools btw 😉

Hairybiker
Guest
Hairybiker

Could you do a test please.
Unpack the rom and change one byte in the build.prop (a 1 to a 0 or vice versa) then build and try and flash it, I my case and in others it crc errors.
If yours doesn’t could you check your makeyaff2image source is what is posted here please as I believe that is where the error lies.

hackandfab
Guest
hackandfab

Hi, I extracted config.gz from /proc from the stock rooted android and used the same .config to build the kernel.

I followed your procedure without changing boot.img-ramdisk.gz and with the original system.img but It doesn’t boot with the new kernel. Only a black screen appears and I don’t receive the usual plug/unplug signal from the USB cable. (I’ve NOT bricked the cx-01, I can go back to the original firmware with fwdn)

I think it can be a problem with mkbootimg or with the kernel base address.

Compiling a new kernel with the original config.gz the load address is 10008000

UIMAGE arch/arm/boot/uImage
Image Name: Linux-3.0.8
Created: Fri Aug 31 16:36:38 2012
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3162664 Bytes = 3088.54 kB = 3.02 MB
Load Address: 10008000
Entry Point: 10008000
Image arch/arm/boot/uImage is ready

But when I did split_bootimg.pl boot.img with the stock boot.img from cx-01
it showed Kernel addr: 0x80008000

../tccutils/split_bootimg.pl boot.img

Page size: 4096 (0x00001000)
Kernel size: 6471140 (0x0062bde4)
Kernel addr: 0x80008000
Ramdisk size: 1413414 (0x00159126)
Ramdisk addr: 0x81000000
Second size: 0 (0x00000000)
Second addr: 0x80f00000
Board name:
Command line: console=null
Writing boot.img-kernel … complete.
Writing boot.img-ramdisk.gz … complete.
note: modules where added later following your blog entry.

Do you have a working kernel so I can test it? Has anyone succeeded booting a custom kernel?

md5sum config
987dc2cf4f897332b63efc148af1a960 config

I’ve put the stock .config on pastebin here: http://pastebin.com/SDfZVHQ8

Thanks

hackandfab
Guest
hackandfab

The kernel header is not the same.

The stock one uses “3.0.8-tcc” vermagic string and the one telechips released as opensource uses “3.0.8+” I’ll try changing the string at the kernel sources. Maybe some .ko fails to load*. When compiling the kernel only a cam and scsi kernel modules are generated but there are more at /lib/modules at the stock ramfs maybe they fail to load. This can be tested with “modinfo moduleyouwantotest.ko”

*= I think this is not the only problem since I don’t see the lk.rom android logo image when booting and it should load first. I’ll also try using gcc 4.4, it seems some people had problems with gcc 4.6 with other androids.

hackandfab
Guest
hackandfab

I Used gcc 4.4.6 , changed kernel config to “CONFIG_MODULE_FORCE_LOAD=y” and did

sed -rie ‘s/echo “\+”/#echo “\+”/’ scripts/setlocalversion

to avoid the plus sign at the kernelversion.

Now the modinfo vermagic is the same.

Now I can see something at the screen but it ends on a screen with a green Android laying down and a red triangle with an exclamation. No combination of keyboard and mouse (including dongle Fn button and dragging) seems to work. I can see rescue boot with adb devices but adb -s serialnumber shell won’t work.

I even made a kernel with the exact same lenght as the stock image.

I tried editing the stock kernel and changing robin to rabit on boot.img-kernel with dhex editor and that kernel booted ok so I don’t think it is a checksum problem.

I have no idea how to continue 🙁

olexiyt
Guest
olexiyt
azorzi
Guest
azorzi

a question:
i’m try to compress ramdisk without change data.
I have see that compress ratio si different from original ramdisk
why?

this is an example under ubuntu linux 12
size – file name original
1413459 – boot.img-ramdisk.gz

dezipped will be
size – file name
3801088 – boot.img-ramdisk

now zip the file with gzip
size – file name
1417449 – boot.img-ramdisk.gz

the size is different from origina ramdisk zipped!!!

If I reate a rom for CX-01 with this new ramdisk I have boot problem.
Instead if I use the original ramdisk I have not problem.

Have you had the same problem?

azorzi
Guest
azorzi

@cnxsoft
Sorry I have read your reply only now 🙁

this is my command to recreate img-ramdisk

find . | cpio -o -H newc | gzip > ../boot.img-ramdisk_new.gz
7424 blocks

the size is different from origin ramdisk

1413459 boot.img-ramdisk.gz
1417428 boot.img-ramdisk_new.gz

trackback

[…] Membuat versi custom Android sendiri. Dengan kata lain, memodifikasi Android ROM (firmware) yang ada di hardware. Cara ini jauh lebih sulit tentunya. Karena kita harus meng-compile sendiri semua source android yang disesuaikan dengan hardware. Tapi dengan ini, aplikasi yang dijalankan memiliki lebih banyak resource, karena bisa mematikan aplikasi/service yang gak dipake sama sekali. Contoh bikin firmware buat CX-01 ada disini […]

juanma
Guest
juanma

Hi all.
i’m trying to build a custom firmware for the 8gb device but when I do the mkbootimg it fails with failed writing error. My command and output:
mkbootimg –cmdline ‘console=null’ –kernel boot.img-kernel –ramdisk boot.img-ramdisk.gz –pagesize 8192 –base 0x80000000 -o cx-01-boot-test.img
error: failed writing ‘cx-01-boot-test.img’: Success

If I try to build it with pagesize 4096 it works ok. I’ve used different mkbootimg, some binaries, some compiled from sources (debian sqeeze whit gcc 4.4.5) but it don’t works in any manner. Any help?
The last try was unpacking the original 8gb rom (tccunpack, split_image…) and tryng to pack it again without modifying nothing.

thxs

p.d. I apologise for any mistakes in my English, i try to do the best

juanma
Guest
juanma

@cnxsoft
Hi.
Thanks. Finally i’ve succesfully build the 8gb Rom version but i couldn’t test it yet (perhaps tonight).
The trick was changing a line in the source code of the mkbootimage. I didn’t remeber well but i think that the line in question was “pagemask = pagesize – 1;” and I replaced with “pagemask=8189;” because is the second “number” of the firmware: CX1-V1.0-4096-8189_en.rom and I know that any number in a released software is there for a well known reason and also in the acknowledge that the “failed wiriting error” was in that line, i saw it debugging the source, and also a few more changes about adding 8192 as default value in the sources.
I don’t know if it works (if it works I must begin to play loto hehe) but if it finally does I will publish here the changes I made.

Thanks and again apologies for any mistakes in my English.

juanma
Guest
juanma

Hi there.
Only 2 words: It works!!!!!
Now I’ll try to delete/add some files from the ramdisk and check if it continues working.
Thanks for the great job you did and all the info and tools.

juanma
Guest
juanma

@juanma
The changes to the mkbootimg.c file are:
line 75:
static unsigned char padding[8192] = { 0, };
line 79:
unsigned pagemask = 8189;
line 108:
unsigned pagesize = 8192;
line 192
if ((pagesize != 8192) && (pagesize != 4096)) {
—————————————————————-
build as usual and profit

The rom is working but i’ve made no change to the firm (only extract and build) so I’ll try later to make some changes and try again. If it works i must play loto definitely.

trackback

[…] bisa mematikan aplikasi/service yang gak dipake sama sekali. Contoh bikin firmware buat CX-01 ada disini Atau bisa juga lihat penjelasan umum yang […]