I’ve written a post about updating the firmware on CX-01 mini PC last week. But, this week I’ve been able to go further since I’ve learned some tools available for Telechips TCC8902/TCC8903 firmware files are also compatible with TCC892X firmware files, and it’s possible to extract the firmware, modify/add files in different partitions and repack all this to burn it with FWDN tool. I’ll explain the different steps in this post, and even if you don’t own CX-01 it could be interesting as some of the commands are common to all Android devices. But first:
BIG FAT WARNING!!!
Although I believe the steps mentioned in this post are safe, and errors can be recovered by using the CX-01 firmware, CX-01 mini PC is not unbrickable, and if I’m wrong your device will become useless and you won’t be able to fix it. I may also mention some tools (but not show how to use them) that modify startup code and could potentially brick your device if firmware update fails (e.g. power failure), or if you flash a file for the wrong device.
Firmware files overview
I’ve already discussed about those file in the firmware update post, but here’s a quick reminder:
- CX1-V1.0-4096-8189_en.rom – MTD – This is the part we’re going to modify as it contains the system partition, kernel and ramdisk.
- lk.rom – BOOT – This is the part of the firmware that allows you to enter recovery mode to flash your firmware. If you screw up that file or burn one for the wrong device, you can put your device in the trash bin. I won’t be modifying it in this post.
- NAND Data.fai – NAND Data – This is the part mounted in /sdcard. It’s just a FAT32 partition, so it’s easy to mount and add files if necessary.
Tools required to modify the firmware
We’ll need to use several command line tools running in a terminal in a Linux machine (I’ll use Ubuntu 12.04) in order to extract files then rebuild the firmware:
- tccunpack/tccpack– Those are 2 command line tools to extract and (re-)pack 3 files in the ROM file (e.g. CX1-V1.0-4096-8189_en.rom):
- boot.img – This file contains the Android kernel and the ramdisk
- recovery.img – Same as boot.img for for recovery.
- system.img – YAFFS2 partition containing /system directory, that’s the file you are more likely to modify, e.g. change build.prop, add default apps in /system/app, add /system/xbin/su…
- split_bootimg.pl – This perl script extract the kernel and ramdisk from boot.img (AOSP tool)
- mkbootimg – This command line tool create boot.img from the kernel and ramdisk (AOSP tool)
- unyaffs – Extract a yaffs(2) partition into a directory
- mkyaffs2image – Create a yaffs2 partition from a directory
I imported the 4 first tools into github from files located in http://sidenet.ddo.jp/telechips/tccutils/src/, but tccpack/tccunpack developer (“fun”) keeps the latest version (for now the same) in androtab.com. There is also another tool called tccsplash. This tool can change the splash screen, but it modifies lk.rom, so it’s very risky to use it. Using tccsplash will brick your CX-01 for good, don’t use it.
unyaffs source code is available in github and mkyaffs2image source code can be downloaded as a tar file.
Building the tools
I’ve already built the tools, you can download the binaries here, extract them and make sure they are in your path. If you want to build the tools yourself, I’ll provide the steps below although it’s pretty simple.
For tools in tccutils git repo:
|
1 2 3 4 5 6 |
git clone git://github.com/cnxsoft/tccutils.git cd tccutils/tccutils gcc tccpack.c -o tccpack gcc tccunpack.c -o tccunpack cd ../mkbootimg gcc mkbootimg.c -o mkbootimg -lcrypto |
For unyaffs:
|
1 2 3 |
git clone git://github.com/ehlers/unyaffs.git cd unyaffs make |
For mkyaffs2image:
|
1 2 3 |
wget http://fei-yen.jp/maya/wordpress/wp-content/uploads/2010/08/mkyaffs2.tar.gz tar xzvf mkyaffs2.tar.gz cd mkyaffs2/yaffs2/utils |
Edit the Makefile, and remove -DCONFIG_YAFFS_DOES_ECC, then run make.
Extracting firmware files
We’ve got all we need for now, time to extract the firmware files.
|
1 2 3 4 |
tccunpack CX1-V1.0-4096-8189_en.rom 00000040-0078703f boot.img 7892992 bytes 00787050-0e18d5cf system.img 228615552 bytes 0e18d5e0-0e9665df recovery.img 8228864 bytes |
Now extract the kernel and ramdisk:
|
1 2 3 4 5 6 7 8 9 |
split_bootimg.pl boot.img Page size: 4096 (0x00001000) Kernel size: 6471140 (0x0062bde4) Ramdisk size: 1413414 (0x00159126) Second size: 0 (0x00000000) Board name: Command line: console=null Writing boot.img-kernel ... complete. Writing boot.img-ramdisk.gz ... complete. |
boot.img-kernel is the kernel image you get after build the kernel, so nothing more to do at this stage for this file.
I won’t modify the ramdisk, but if you want to, it is just a cpio file and can be extracted as follows:
|
1 2 3 |
mkdir ramdisk cd ramdisk gunzip -c ../boot.img-ramdisk.gz | cpio -i |
Source: Android DLS Wiki
Extract system.img in system directory:
|
1 2 3 |
mkdir system cd system sudo unyaffs ../system.img |
and check the files are there:
|
1 2 3 |
ls app build.prop fonts key_3000000.psr lib tts vendor xbin bin etc framework key_921600.psr media usr wifi |
All good!
Modifying files
In this section I’ll just give some examples of the things you can modify, but there are lots of other thing you can do.
System partition
If you want to add some default apps into your ROM, simply copy the apks into /system/app.
One way to do this is to install apps in your device, and copy them to your computer via Samba or a USB flash drive to incorporate into your new firmware.
If you’ve rooted your device, you may want to copy /system/xbin/su and/or /system/bin/su to your firmware.
You are also likely to modify build.prop. Have a look at tatubias’ CX-01 build.prop tweaks, to see whst you can modify to improve performance and some other things.
Build new kernel
You may need to re-build the kernel and some modules to add features or apply stability / performance patches.
The instructions are available in Building the Linux Kernel 3.0.8 For Telechips TCC8925 mini PCs, but use cx-01 config instead:
|
1 |
make ARCH=arm tcc8920st_cx-01_defconfig |
tcc8920st_cx-01_defconfig is the config file extracted from /proc/config.gz in CX-01 HDMI stick.
After build, the kernel binary is available as arch/arm/boot/Image.
Ramdisk
To do. Some startup files can be modified and I think the Android boot logo is there.
Re-create the firmware file
Now that we’ve done some modifications it’s time to repack everything into a flashable firmware:
Let’s create the new system image first:
|
1 2 |
cd system sudo mkyaffs2image . ../system_new.img |
then the ramdisk:
|
1 2 |
cd ramdisk find . | cpio -o -H newc | gzip > ../ramdisk_new.cpio.gz |
If you’ve built a new kernel copy arch/arm/boot/Image to the directory where system_new.img and ramdisk_new.cpio.gz are located. Let’s name it boot.img-kernel_new.
Generate a new boot image using the new ramdisk and kernel:
mkbootimg --cmdline 'console=null' --kernel boot.img-kernel_new --ramdisk boot.img-ramdisk_new.cpio.gz --pagesize 4096 --base 0x80000000 -o cx-01-boot-test.img
and finally pack the 2 new boot and system image together with the recovery image to create the new firmware:
|
1 |
tccpack cx-01-boot-test.img system_new.img recovery.img CX-01_CNXSOFT_20120821_4GB_en.rom |
That’s it! You can now use CX-01_CNXSOFT_20120821_4GB_en.rom with FWDN to flash the firmware as explained here. Please note, that you do not need to add lk.rom and NAND Data.fai to do the update, and adding lk.rom make even result in briocking your device is firmware update stops during this stage for any reason.
If the device fails to boot after updating your new ROM, simply use CX-01 firmware to recover.
Jean-Luc started CNX Software in 2010 as a part-time endeavor, before quitting his job as a software engineering manager, and starting to write daily news, and reviews full time later in 2011.
Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress
cool!
excelent update, great tutorial keep on whit your excelent work
@taubias
Thanks. But don’t expect too much from me in the short term. I’ll have to switch to other platforms for now, and by the end of the month I’ll hit the roads so I won’t have time at all.
cnxsoft;
when i repack the rom and the use the FWDN application to flash the new rom. it does never finished the CRC check. did you had the same issue?
@tatubias
Yes, I think when I used mkyaffs2image with -DCONFIG_YAFFS_DOES_ECC enabled. Are you using mkyaffs2image from the binaries I provided?
finaly got a rom working but when it does finishes. and check the crc it gives us an crc error, but the rom works.
I’m not the one compilin first we were using other that was not your version, and did not work during the flashing then we did update but we get the crc error.
I am the guy that tatubias is working with on the rom. (NB I don’t yet have a device!)
If I use your compiled version we get the crc error but the rom works??
I was using a different mkyaffs2 program and that hung the flash program, so all we need to know is how to fix the crc error.
Thanks
@Ken
I remember I got that CRC error at some points, but I’ve tried so many things before being able to write these instructions that I can’t remember for sure, although I think the problem just lies with mkyaffs2image. Have you tried to build mkyaffs2image yourself with the instructions above, instead of using my binary?
It could also be related to something you’ve modified. Have you only modified system.img, or also boot.img?
Just the system.img file, I did try compiling it but it is looking for some arm includes that I don’t have or haven’t specified, as yours worked on 64bit I just left it. (In file included from mkyaffsimage.c:34:0:
../yaffs_guts.h:828:19: error: conflicting types for ‘loff_t’
/usr/include/x86_64-linux-gnu/sys/types.h:45:18: note: previous declaration of ‘loff_t’ was here
)
There has been nothing added that should cause the crc error, so I don’t know.
@Ken
Maybe trying to generate the image in a 32-bit VM is worth a try.
The version of os the image is created in shouldn’t make a difference, and since your included app is 64bit I would have to re-compile it to run in a 32bit vm.
So your compiled roms don’t fail the crc checks?
if tccunpack pandawill rom and then tccpack the rom is unusable- did you use autosign as it won’t flash after creating a rom?
Also be aware that unlockroot is installing sweetIM browser hijack spyware
@Hairybiker
I’ve built and run the app in Ubuntu 12.04 32-bit. I do not get CRC error when I flash the ROM.
@Teaker1s
I works for me. If you use the binary tools above, they are compiled for 32-bit, I should probably have mentioned it. I don’t know what autosign is…
I did not know about spyware in unlockroot, maybe it depends from where you download it, I’ll check my system however. Thanks.
OK just recompiled the source rom and a diff shows no differences from the original, so it must be something in the system.img that is screwing the crc check. Do you know if there is a size limit on /system? (Not that I am including that much!)
@Hairybiker
I don’t know about any size limit. I copied about 15 apk to the /system/app directory including (XBMC) so possibly 100 MB and it could still work.
Very strange, I only added what was in the tweaks file, I have no idea why this is causing the crc error.
OK just tried in a vm (32 bit Debian)
Unpacked the rom and repacked as new rom (only expanded system.img)
Result:-
virty system # ~/bin/unyaffs ../system.img
end of image
virty system # ls
app build.prop fonts key_3000000.psr lib tts vendor xbin
bin etc framework key_921600.psr media usr wifi
virty system # ~/bin/mkyaffs2image . ../system2.img
virty system # cd ..
virty cx-01 # ls
boot.img recovery.img system system2.img system.img
virty cx-01 # ~/bin/tccpack boot.img system2.img recovery.img test.rom
virty cx-01 # diff test.rom ../CX1-V1.0-4096-8189_en.rom
Binary files test.rom and ../CX1-V1.0-4096-8189_en.rom differ
virty cx-01 # diff system.img system2.img
Binary files system.img and system2.img differ
So the system,img and the system2.img are different even though all I have done is extract and rebuild them
I followed your guide completely and this is a clean install (I had to install libssl-dev to get they cryptlib installed)
I haven’t sent the “clean” rom for testing to see if it still gets the crc error but I would assume it would.
@Hairybiker
I’ve tried it, and the size is the same between system.img and system2.img but the md5 is different.
I’ve also updated my post, replacing mkyaffs2 by mkyaffs2image, but you are using already this tool. I’m not sure what could cause your CRC error. Using tools like ultracompare could possibly help pinpointing the issue.
OK I have him to test the clean rom and make sure it doesn’t crc then will try adding stuff a bit a time.
OK so not your tools now doing a small change at a time to see where the error occurs
Thanks for the tools btw 😉
Could you do a test please.
Unpack the rom and change one byte in the build.prop (a 1 to a 0 or vice versa) then build and try and flash it, I my case and in others it crc errors.
If yours doesn’t could you check your makeyaff2image source is what is posted here please as I believe that is where the error lies.
Hi, I extracted config.gz from /proc from the stock rooted android and used the same .config to build the kernel.
I followed your procedure without changing boot.img-ramdisk.gz and with the original system.img but It doesn’t boot with the new kernel. Only a black screen appears and I don’t receive the usual plug/unplug signal from the USB cable. (I’ve NOT bricked the cx-01, I can go back to the original firmware with fwdn)
I think it can be a problem with mkbootimg or with the kernel base address.
Compiling a new kernel with the original config.gz the load address is 10008000
UIMAGE arch/arm/boot/uImage
Image Name: Linux-3.0.8
Created: Fri Aug 31 16:36:38 2012
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3162664 Bytes = 3088.54 kB = 3.02 MB
Load Address: 10008000
Entry Point: 10008000
Image arch/arm/boot/uImage is ready
But when I did split_bootimg.pl boot.img with the stock boot.img from cx-01
it showed Kernel addr: 0x80008000
../tccutils/split_bootimg.pl boot.img
Page size: 4096 (0x00001000)
Kernel size: 6471140 (0x0062bde4)
Kernel addr: 0x80008000
Ramdisk size: 1413414 (0x00159126)
Ramdisk addr: 0x81000000
Second size: 0 (0x00000000)
Second addr: 0x80f00000
Board name:
Command line: console=null
Writing boot.img-kernel … complete.
Writing boot.img-ramdisk.gz … complete.
note: modules where added later following your blog entry.
Do you have a working kernel so I can test it? Has anyone succeeded booting a custom kernel?
md5sum config
987dc2cf4f897332b63efc148af1a960 config
I’ve put the stock .config on pastebin here: http://pastebin.com/SDfZVHQ8
Thanks
@Hairybiker
I can try this, but only in early November… I remember I modify build.prop and added a few apk in /system/app. It worked (and no CRC error), but I lost the ability to root the device, probably because I changed the product name.
@hackandfab
The packing is working, but using a custom kernel fails to boot (I tried after this post, as I though it would just work OK as the kernel header was the same as the stock one). I also copied the stock config to github, as mentioned above. It should be the same as yours.
The kernel header is not the same.
The stock one uses “3.0.8-tcc” vermagic string and the one telechips released as opensource uses “3.0.8+” I’ll try changing the string at the kernel sources. Maybe some .ko fails to load*. When compiling the kernel only a cam and scsi kernel modules are generated but there are more at /lib/modules at the stock ramfs maybe they fail to load. This can be tested with “modinfo moduleyouwantotest.ko”
*= I think this is not the only problem since I don’t see the lk.rom android logo image when booting and it should load first. I’ll also try using gcc 4.4, it seems some people had problems with gcc 4.6 with other androids.
I Used gcc 4.4.6 , changed kernel config to “CONFIG_MODULE_FORCE_LOAD=y” and did
sed -rie ‘s/echo “\+”/#echo “\+”/’ scripts/setlocalversion
to avoid the plus sign at the kernelversion.
Now the modinfo vermagic is the same.
Now I can see something at the screen but it ends on a screen with a green Android laying down and a red triangle with an exclamation. No combination of keyboard and mouse (including dongle Fn button and dragging) seems to work. I can see rescue boot with adb devices but adb -s serialnumber shell won’t work.
I even made a kernel with the exact same lenght as the stock image.
I tried editing the stock kernel and changing robin to rabit on boot.img-kernel with dhex editor and that kernel booted ok so I don’t think it is a checksum problem.
I have no idea how to continue 🙁
@hackandfab
Hello!
See my post about built bootable kernel for CX01 http://www.pandawillforum.com/showthread.php?12712-How-to-Building-the-Linux-Kernel-3-0-8-For-CX-01&p=76213&viewfull=1#post76213
a question:
i’m try to compress ramdisk without change data.
I have see that compress ratio si different from original ramdisk
why?
this is an example under ubuntu linux 12
size – file name original
1413459 – boot.img-ramdisk.gz
dezipped will be
size – file name
3801088 – boot.img-ramdisk
now zip the file with gzip
size – file name
1417449 – boot.img-ramdisk.gz
the size is different from origina ramdisk zipped!!!
If I reate a rom for CX-01 with this new ramdisk I have boot problem.
Instead if I use the original ramdisk I have not problem.
Have you had the same problem?
@azorzi
The article linked from this post (Android DLS Wiki) says you need to run:
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
to generate the ramdisk, have you done this?
@cnxsoft
Sorry I have read your reply only now 🙁
this is my command to recreate img-ramdisk
find . | cpio -o -H newc | gzip > ../boot.img-ramdisk_new.gz
7424 blocks
the size is different from origin ramdisk
1413459 boot.img-ramdisk.gz
1417428 boot.img-ramdisk_new.gz
@azorzi
Maybe they used gzip -9 for better compression. But it should not be the issue here.
Hi all.
i’m trying to build a custom firmware for the 8gb device but when I do the mkbootimg it fails with failed writing error. My command and output:
mkbootimg –cmdline ‘console=null’ –kernel boot.img-kernel –ramdisk boot.img-ramdisk.gz –pagesize 8192 –base 0x80000000 -o cx-01-boot-test.img
error: failed writing ‘cx-01-boot-test.img’: Success
If I try to build it with pagesize 4096 it works ok. I’ve used different mkbootimg, some binaries, some compiled from sources (debian sqeeze whit gcc 4.4.5) but it don’t works in any manner. Any help?
The last try was unpacking the original 8gb rom (tccunpack, split_image…) and tryng to pack it again without modifying nothing.
thxs
p.d. I apologise for any mistakes in my English, i try to do the best
@juanma
It’s been a while since I’ve not played with CX-01. It looks like the tools cannot support 8GB. There’s a long thread with people trying it out: http://www.pandawillforum.com/showthread.php?12711-How-to-Create-a-Custom-Android-Firmware-for-CX-01-mini-PC
@cnxsoft
Hi.
Thanks. Finally i’ve succesfully build the 8gb Rom version but i couldn’t test it yet (perhaps tonight).
The trick was changing a line in the source code of the mkbootimage. I didn’t remeber well but i think that the line in question was “pagemask = pagesize – 1;” and I replaced with “pagemask=8189;” because is the second “number” of the firmware: CX1-V1.0-4096-8189_en.rom and I know that any number in a released software is there for a well known reason and also in the acknowledge that the “failed wiriting error” was in that line, i saw it debugging the source, and also a few more changes about adding 8192 as default value in the sources.
I don’t know if it works (if it works I must begin to play loto hehe) but if it finally does I will publish here the changes I made.
Thanks and again apologies for any mistakes in my English.
Hi there.
Only 2 words: It works!!!!!
Now I’ll try to delete/add some files from the ramdisk and check if it continues working.
Thanks for the great job you did and all the info and tools.
@juanma
The changes to the mkbootimg.c file are:
line 75:
static unsigned char padding[8192] = { 0, };
line 79:
unsigned pagemask = 8189;
line 108:
unsigned pagesize = 8192;
line 192
if ((pagesize != 8192) && (pagesize != 4096)) {
—————————————————————-
build as usual and profit
The rom is working but i’ve made no change to the firm (only extract and build) so I’ll try later to make some changes and try again. If it works i must play loto definitely.
Thanks for the update @juanma . Keep us informed if you make further progress.