fl3xbl0w

[alphab0ing]

Can you please forward all of the dump files you have from the bowflex Vantron rk3399 board? I've been working on this for several weeks, I've packaged a complete ROM that is 95% functional based on device tree's from other similar devices, I really would love to get my hands on the original u-boot / dtb....Anything you have would be greatly appreciated and I'm happy to share whatever I find of course! Here's the dtb/device tree I've assembled for the board, working uart ports/ USB ports, the display works however the settings aren't entirely correct so I'm getting backlight and lines on the screen, i've identified and confiugured the bluetooth/wifi device and mapped out for adding an sdcard to the board which is pre-built in since Vantron is essentially using their rk3399 board just white labled for nautical/bowflex. Vantron-Bowflex_alphab0ing.zip ``

[alphab0ing]

Without root on the adb you can use adb shell to copy "/dev/block/platform/fe330000.sdhci/by-name/*" to sdcard and then zip and use adb pull to grab it from the sdcard folder which is not protected

[barrenechea]

I have a backup of files from a system update that the machine received (OTA - HP-22_T56_EEA Android OS Image 3.10 release-keys), but it is close to 1GB so no easy way of sharing it. I'll let you know if I get to upload it/share it.

The file list at the time of the update within the redbend folder was:

1_1_script.rdp
1_delta.rdp
1_suffix.rdp
Credentials.txt
crc.rdp
deltas_header.rdp
dma_config.txt
dp
installation_order.txt
section1.rdp
suffix_section.rdp

Some info that I got at the time was this:

1_delta.rdp: Java archive data (JAR): Decompress as .zip
    - payload.bin: https://github.com/ssut/payload-dumper-go
        - boot.img: Android bootimg, kernel (0x10008000), ramdisk (0x11000000), second stage (0x10f00000), page size: 2048, cmdline (console=ttyFIQ0 androidboot.baseband=N/A androidboot.wificountrycode=US androidboot.veritymode=enforcing androidboot.hardware=r)
        - dtbo.img: data
        - oem.img: Linux rev 1.0 ext2 filesystem data, UUID=b886e36e-ac40-5948-86dd-27c114bd225e, volume name "oem" (extents) (large files) (huge files)
        - system.img: Linux rev 1.0 ext2 filesystem data, UUID=0a7fc206-6c88-5018-bacd-4ea8a11db7ca (extents) (large files) (huge files)
        - trust.img: data
        - uboot.img: data
        - vbmeta.img: data
        - vendor.img: Linux rev 1.0 ext2 filesystem data, UUID=67531afd-7aed-52f3-9196-b1cdad9fd724, volume name "vendor" (extents) (large files) (huge files)

[barrenechea]

Here are the uploaded files https://archive.org/download/HP-22_T56_EEA, I'll push an update into my website so it gets documented 😄

Also, I wasn't able to dump the files you asked, I got the following output:

nftm_lar:/sdcard $ cd /dev/block/platform/fe330000.sdhci/by-name/
nftm_lar:/dev/block/platform/fe330000.sdhci/by-name $ cp -R * /sdcard/dump_files
cp: /sdcard/dump_files/backup: Permission denied
cp: /sdcard/dump_files/boot_a: Permission denied
cp: /sdcard/dump_files/boot_b: Permission denied
cp: /sdcard/dump_files/cache: Permission denied
cp: /sdcard/dump_files/dtb: Permission denied
cp: /sdcard/dump_files/dtbo_a: Permission denied
cp: /sdcard/dump_files/dtbo_b: Permission denied
cp: /sdcard/dump_files/frp: Permission denied
cp: /sdcard/dump_files/kernel: Permission denied
cp: /sdcard/dump_files/metadata: Permission denied
cp: /sdcard/dump_files/misc: Permission denied
cp: /sdcard/dump_files/oem_a: Permission denied
cp: /sdcard/dump_files/oem_b: Permission denied
cp: /sdcard/dump_files/resource: Permission denied
cp: /sdcard/dump_files/security: Permission denied
cp: /sdcard/dump_files/sw_release: Permission denied
cp: /sdcard/dump_files/system_a: Permission denied
cp: /sdcard/dump_files/system_b: Permission denied
cp: /sdcard/dump_files/trust_a: Permission denied
cp: /sdcard/dump_files/trust_b: Permission denied
cp: /sdcard/dump_files/uboot_a: Permission denied
cp: /sdcard/dump_files/uboot_b: Permission denied
cp: /sdcard/dump_files/userdata: Permission denied
cp: /sdcard/dump_files/vbmeta_a: Permission denied
cp: /sdcard/dump_files/vbmeta_b: Permission denied
cp: /sdcard/dump_files/vendor_a: Permission denied
cp: /sdcard/dump_files/vendor_b: Permission denied
cp: /sdcard/dump_files/video: Permission denied

nftm_lar:/dev/block/platform/fe330000.sdhci/by-name $ whoami
shell
nftm_lar:/dev/block/platform/fe330000.sdhci/by-name $ ls -alg
total 0
drwxr-xr-x 2 root 600 2024-08-20 13:26 .
drwxr-xr-x 3 root 700 2024-08-20 13:26 ..
lrwxrwxrwx 1 root  21 2024-08-20 13:26 backup -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root  21 2024-08-20 13:26 boot_a -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root  21 2024-08-20 13:26 boot_b -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root  21 2024-08-20 13:26 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root  20 2024-08-20 13:26 dtb -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root  20 2024-08-20 13:26 dtbo_a -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root  21 2024-08-20 13:26 dtbo_b -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root  21 2024-08-20 13:26 frp -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root  20 2024-08-20 13:26 kernel -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root  21 2024-08-20 13:26 metadata -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root  20 2024-08-20 13:26 misc -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root  21 2024-08-20 13:26 oem_a -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root  21 2024-08-20 13:26 oem_b -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root  20 2024-08-20 13:26 resource -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root  21 2024-08-20 13:26 security -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root  21 2024-08-20 13:26 sw_release -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root  21 2024-08-20 13:26 system_a -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root  21 2024-08-20 13:26 system_b -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root  20 2024-08-20 13:26 trust_a -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root  20 2024-08-20 13:26 trust_b -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root  20 2024-08-20 13:26 uboot_a -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root  20 2024-08-20 13:26 uboot_b -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root  21 2024-08-20 13:26 userdata -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vbmeta_a -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vbmeta_b -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vendor_a -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vendor_b -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root  21 2024-08-20 13:26 video -> /dev/block/mmcblk0p27

[alphab0ing]

Thank you SO much! I will keep you posted

[alphab0ing]

vantron-rk3399.dts.txt

[alphab0ing]

There it is!! Pot of gold, thank you my friend. Now we can easily make any ROM for this board.

[barrenechea]

There it is!! Pot of gold, thank you my friend. Now we can easily make any ROM for this board.

Lovely! I'm glad I could help 😄 keep me updated if you build an image for it! With root access, I guess we could build an OSS app to communicate via Serial with the treadmill board. It would be awesome if we could make it work without Nautilus/Bowflex software.

[alphab0ing]

Yes I'll have us a working ROM shortly, you will be able to wipe the board clean and start fresh with a rooted 8.1 android OS, I've been very close to having this completed I really really needed that dts file but I had already wiped my board before retrieving it....

[barrenechea]

Just published an update (52213e8) with this new info, already up over here. Thank you very much for reaching out!! Pretty exciting times 😄

[alphab0ing]

I apologize there's one more missing item that you should be able to get pretty easy when you have time. From maskrom using rkdeveloptool I need the partition structure so I can merge what I have correctly, I've tried using standard addresses and it's looping back into a loader mode so I'm guessing it's off, here's my output currently using command "rkdeveloptool ppt"

% rkdeveloptool ppt **Partition Info(GPT)** NO LBA Name
00 00002000 uboot 01 00004000 trust 02 00006000 misc 03 00008000 baseparameter 04 00008800 resource 05 00010800 kernel 06 00020800 boot 07 00030800 recovery 08 00050800 backup 09 00088800 security 10 0008A800 cache 11 0018A800 system 12 0068A800 metadata 13 00692800 vendor 14 00794800 oem 15 00894800 frp 16 00894C00 userdata

An update of those addresses from a functioning board will help rebuild with the modified ROM, also if anyone working on this needs anything I've extracted all the data from the dump you sent over earlier and I'm happy to pass that along to whomever may need it.

[barrenechea]

I apologize there's one more missing item that you should be able to get pretty easy when you have time. From maskrom using rkdeveloptool I need the partition structure so I can merge what I have correctly, I've tried using standard addresses and it's looping back into a loader mode so I'm guessing it's off, here's my output currently using command "rkdeveloptool ppt"

We're actively using the treadmill and I don't have access to the DBG_USB, it may take a bit since I'm on other things as well... ADB is the only thing I have quick access to, already tried a ton of exploits over time with no luck 🤣

I need to replace some capacitors tho, because the speakers started making a crackling noise (and very likely a cap issue), so I can take a chance there!

[tds04]

I have a Bowflex tablet im using as a wall tablet with home assistant. id like to help if i can. tried to get the info using windows version of rkDevtool, let me know if this is what your looking for.

[tds04]

Rkdeveloptool ppt gives me an error. I will try again with different usb cable or maybe different power adapter.

[alphab0ing]

tds04, YES absolutely! I've been having trouble with the image files from the first dump, the device tree does not seem to be complete and I haven't been able to extract the boot.img other then a hexdump which has been helpful but I had kind of hit a dead end so help would be greatly appreciated. Here's a quick update to where I'm currently at...

I have been able to determine that the board kernel is based at least in part on the "rk3399-tve1030g-avb" included with the kernel build readily available, I've been able to use that in conjunction what I can get from the recovered dtb, I have built an android rom based on what I've pieced together but I've ran into a couple issues, I haven't been able to get the screen working yet (this portion of the recovered dtb is incomplete, from what I can get in the hexdump it looks like the board is using an edp bridge but the biggest issue is that my solder work is lousy and I have damaged the defaultt uart/debug port, I'm unable to verify functionality. Ideally if you I can get an image dump would be amazing, I'm not confident enough it what I have to pass that off and potentially damage your hardware.

[alphab0ing]

Rkdeveloptool ppt gives me an error. I will try again with different usb cable or maybe different power adapter.

What's the error you're getting and which platform are you running rkdevelop?

[alphab0ing]

If you can get adb via usb try

adb shell ls /dev/block/by-name/

see if you can see the partitions, it might be possible to copy those over the sdcard folder and then copy from there over to your local system, I dont think you'll be able to pull it directly from /dev/block/by-name

[tds04]

I don’t have a Linux computer setup right now so tried with a live version of kali.

Seems to work and recognizes the tablet in loader and mask room mode

Gives an error of partition not found

I will setup a dedicated box this weekend and try again

Sent from Gmail Mobile

On Tue, Nov 12, 2024 at 6:26 PM alphab0ing @.***> wrote:

Rkdeveloptool ppt gives me an error. I will try again with different usb cable or maybe different power adapter.

What's the error you're getting and which platform are you running rkdevelop?

— Reply to this email directly, view it on GitHub https://github.com/barrenechea/barrenechea-website/issues/20#issuecomment-2472114441, or unsubscribe https://github.com/notifications/unsubscribe-auth/AVBHUYCC2L64NTCEF2ZJEP32AKTFZAVCNFSM6AAAAABMYVWWEKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINZSGEYTINBUGE . You are receiving this because you commented.Message ID: @.***>

[tds04]

Ok I have had adb working so I will try that as well

Sent from Gmail Mobile

On Tue, Nov 12, 2024 at 6:31 PM alphab0ing @.***> wrote:

If you can get adb via usb try

adb shell ls /dev/block/by-name/

see if you can see the partitions, it might be possible to copy those over the sdcard folder and then copy from there over to your local system, I dont think you'll be able to pull it directly from /dev/block/by-name

— Reply to this email directly, view it on GitHub https://github.com/barrenechea/barrenechea-website/issues/20#issuecomment-2472118997, or unsubscribe https://github.com/notifications/unsubscribe-auth/AVBHUYAC7RGCXJE6GXGLXWL2AKTV7AVCNFSM6AAAAABMYVWWEKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINZSGEYTQOJZG4 . You are receiving this because you commented.Message ID: @.***>

[alphab0ing]

Yeah I can make myself available when you get a dedicated setup we can do a live conference, I'm not an expert but I have spent a TON of time on this board, I think ADB will likely be the easiest path forward, if I could somehow get the screen working on mine (via a real dtb or boot.img?) then that would be huge for things on my end, I'll attach a copy of my progress dts/dtb if you guys wanted to have look maybe I'm missing something?? I can't seem to get proper voltage on the USB ports, I'm getting 3.4V which I'm hoping is just a bus configuration and then the screen issue..

alphab0ing-fl3xb0w.dts.txt

[alphab0ing]

It looks like @barrenechea has already gone the adb route without very much success, from his earlier post he's been able to identify the direct path for each of the partitions...

drwxr-xr-x 2 root 600 2024-08-20 13:26 . drwxr-xr-x 3 root 700 2024-08-20 13:26 .. lrwxrwxrwx 1 root 21 2024-08-20 13:26 backup -> /dev/block/mmcblk0p15 lrwxrwxrwx 1 root 21 2024-08-20 13:26 boot_a -> /dev/block/mmcblk0p13 lrwxrwxrwx 1 root 21 2024-08-20 13:26 boot_b -> /dev/block/mmcblk0p14 lrwxrwxrwx 1 root 21 2024-08-20 13:26 cache -> /dev/block/mmcblk0p17 lrwxrwxrwx 1 root 20 2024-08-20 13:26 dtb -> /dev/block/mmcblk0p8 lrwxrwxrwx 1 root 20 2024-08-20 13:26 dtbo_a -> /dev/block/mmcblk0p9 lrwxrwxrwx 1 root 21 2024-08-20 13:26 dtbo_b -> /dev/block/mmcblk0p10 lrwxrwxrwx 1 root 21 2024-08-20 13:26 frp -> /dev/block/mmcblk0p25 lrwxrwxrwx 1 root 20 2024-08-20 13:26 kernel -> /dev/block/mmcblk0p7 lrwxrwxrwx 1 root 21 2024-08-20 13:26 metadata -> /dev/block/mmcblk0p20 lrwxrwxrwx 1 root 20 2024-08-20 13:26 misc -> /dev/block/mmcblk0p5 lrwxrwxrwx 1 root 21 2024-08-20 13:26 oem_a -> /dev/block/mmcblk0p23 lrwxrwxrwx 1 root 21 2024-08-20 13:26 oem_b -> /dev/block/mmcblk0p24 lrwxrwxrwx 1 root 20 2024-08-20 13:26 resource -> /dev/block/mmcblk0p6 lrwxrwxrwx 1 root 21 2024-08-20 13:26 security -> /dev/block/mmcblk0p16 lrwxrwxrwx 1 root 21 2024-08-20 13:26 sw_release -> /dev/block/mmcblk0p26 lrwxrwxrwx 1 root 21 2024-08-20 13:26 system_a -> /dev/block/mmcblk0p18 lrwxrwxrwx 1 root 21 2024-08-20 13:26 system_b -> /dev/block/mmcblk0p19 lrwxrwxrwx 1 root 20 2024-08-20 13:26 trust_a -> /dev/block/mmcblk0p3 lrwxrwxrwx 1 root 20 2024-08-20 13:26 trust_b -> /dev/block/mmcblk0p4 lrwxrwxrwx 1 root 20 2024-08-20 13:26 uboot_a -> /dev/block/mmcblk0p1 lrwxrwxrwx 1 root 20 2024-08-20 13:26 uboot_b -> /dev/block/mmcblk0p2 lrwxrwxrwx 1 root 21 2024-08-20 13:26 userdata -> /dev/block/mmcblk0p28 lrwxrwxrwx 1 root 21 2024-08-20 13:26 vbmeta_a -> /dev/block/mmcblk0p11 lrwxrwxrwx 1 root 21 2024-08-20 13:26 vbmeta_b -> /dev/block/mmcblk0p12 lrwxrwxrwx 1 root 21 2024-08-20 13:26 vendor_a -> /dev/block/mmcblk0p21 lrwxrwxrwx 1 root 21 2024-08-20 13:26 vendor_b -> /dev/block/mmcblk0p22 lrwxrwxrwx 1 root 21 2024-08-20 13:26 video -> /dev/block/mmcblk0p27

Maybe by knowing the exact path it MIGHT let you copy to SDCARD or another directory where you could use adb pull to grab them maybe try something like;

$ adb shell "su -c 'dd if=/dev/block/mmcblk0p13t of=/sdcard/boot_a.img'"
$ adb pull /sdcard/boot_a.img

When you run the rkdevtool in windows is it coming as maskrom specifically? Root shouldn't matter when you're in maskrom and give the addresses you recovered in the partition table you shared you should be able to use rkdeveloptool to dump from terminal for example once you're in maskrom;

$ rkdeveloptool rl 0x0002d000 0x00020000 boot_a.img

One thing to note that on these boards there's a button over near the emmc, when holding that button down while resetting the board it WILL get you to MaskROM but I haven't been able to find out anything tells me specifically what that button does I don't really see the purpose of having it along side a recovery button if it serves an identical purpose, I can't be sure it doesn't erase the emmc or something to that effect rather then just force maskrom like a recovery button would. Just something to be aware of...

[tds04]

tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool list-partitions

LBA start (sectors) LBA end (sectors) Size (bytes) Name

00 16384 24575 4194304 uboot_a 01 24576 32767 4194304 uboot_b 02 32768 40959 4194304 trust_a 03 40960 49151 4194304 trust_b 04 49152 57343 4194304 misc 05 57344 90111 16777216 resource 06 90112 155647 33554432 kernel 07 155648 163839 4194304 dtb 08 163840 172031 4194304 dtbo_a 09 172032 180223 4194304 dtbo_b 10 180224 182271 1048576 vbmeta_a 11 182272 184319 1048576 vbmeta_b 12 184320 315391 67108864 boot_a 13 315392 446463 67108864 boot_b 14 446464 675839 117440512 backup 15 675840 684031 4194304 security 16 684032 1732607 536870912 cache 17 1732608 6975487 2684354560 system_a 18 6975488 12218367 2684354560 system_b 19 12218368 12251135 16777216 metadata 20 12251136 13299711 536870912 vendor_a 21 13299712 14348287 536870912 vendor_b 22 14348288 15396863 536870912 oem_a 23 15396864 16445439 536870912 oem_b 24 16445440 16446463 524288 frp 25 16446464 32007167 7967080448 sw_release 26 32007168 36717567 2411724800 video 27 36717568 61071326 12469124608 userdata tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool read-partition uboot_a uboot.img Read LBA to file (100%) tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool read-partition uboot_b uboot.img Read LBA to file (100%)

[tds04]

[Uploading ubootimages.zip…]()

[tds04]

`tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool -h Usage: rkdeveloptool command [args]... Reads or writes the storage of a rockchip device booted into the rockusb bootloader mode

-h, --help, help print this help text -v, --version print the version of this tool

list List the detected devices in rockusb mode list-partitions List the GPT partition table on the storage read Read sectors from the internal storage read-partition Read a partition from the internal storage write Write sectors from to internal storage write-partition Write an image to a specific partition write-partition-table Write an image to a specific partition write-parameter Not sure what this does erase-flash Wipe the internal storage boot Download an image to ram and start it test-device Tests the device upgrade-loader Write a new rockusb loader reset Send a reset command reboot Send a reboot command, alias of reset reboot-maskrom Trigger reboot into maskrom mode shutdown Reset without rebooting read-flash-id Read the flash chip serial number read-flash-info Show information about the internal storage read-chip-info Show information about the SoC read-capability Show the bootloader permissions pack Pack bootloader unpack Unpack bootloader tag-spl Tag U-Boot SPL`

this one has more options than the other rkdeveloptool

[alphab0ing]

Was that the linux tool?? looks a little different then the one I use on my mac, where did the upload go?? I thought I saw it but then I can no longer

[tds04]

this tool is from ubuntu https://manpages.ubuntu.com/manpages/noble/man1/rkdeveloptool.1.html

[tds04]

ubootimages.zip

[tds04]

bootloader-magic.zip

[tds04]

Hope this helps!

[tds04]

all this was from loader mode, i can switch to maskrom with the command line or the button but all i get are errors

tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool list-partitions Read GPT failed! Read parameter failed! Not found any partition table! `

[alphab0ing]

@tds04 Thanks for your help this is Fantastic! Also thanks for the tool, that's a new one I haven't seen yet, I'll see what I can get from this image dump. The original dump from @barrenechea included a part_table.bin file that I have not been able to extract any information from so the LBA start/sectors information you provided will be a huge help reconstructing a gpt.

@barrenechea , I noticed you had updated the webpage for the project and I thought I could give a little more information that might be helpful to you guys, I updated the image that you had posted of the board itself added the 4-pin uart location and a little more information on the unknown button.

Also in my research trying to get as much information as I could to rebuild a device tree I came across the board publicly offered by Vantron that which this board is almost certainly some sort of variant, the information from that board which is publicly available was helpful especially as it relates to the possibility of a Micro SD slot, it seems our board does have the capabilities to add a MicroSD and I'll include the structure for it in the device tree so that anyone wanting to solder one on would have a functioning MicroSD slot, there's also other peripherals on this board that are not being utilized for the purpose of the bowflex specifically the LVDS/LCD and additional backlighting options that could be enabled if someone were to want to use a different screen setup for example.

This is awesome I had put this onto the back burner having seemingly hit a dead end and this is a very helpful path forward, thanks guys!

[alphab0ing]

@tds04 could you please include the boot images and possibly the kernel, when you have time the whole image could be helpful for different purposes but the boot/kernel will be the base of a new android rom.

12 184320 315391 67108864 boot_a 13 315392 446463 67108864 boot_b 06 90112 155647 33554432 kernel 07 155648 163839 4194304 dtb 08 163840 172031 4194304 dtbo_a 09 172032 180223 4194304 dtbo_b

Those images would be extremely helpful if possible!

[tds04]

bootkernel.zip

[tds04]

is there a way to download whole image at once?

[alphab0ing]

Yeah create account here https://archive.org/details/FreeFileHosting or any other decent file hosting site and then you can just paste the link here.

[tds04]

Yes I will do that. But I mean from rkdeveloptool Or do I have to extract one at a time

[tds04]

On the unknown button. I have been using it to switch to maskrom mode. Have seen no ill effects. Tablet still turns on after reset.

[tds04]

Do you know the correct voltage for the power input on the board. I have ran from 7-12 just not sure what it's supposed to be.

Also I only use the red and black wires. What are the others used for?

[alphab0ing]

As far as I know there's not a single command to do a full image dump with rkdeveloptool you could do a script I suppose.

The voltage is 12v 5a for the power supply, the other to wires are setup for the additional board that goes with that gets the inputs from the equipment, speed, distance that stuff, pictures below how I've got mine setup and I'm just using an old laptop charger 12v 5a to connect to the plug

[tds04]

I just tried the read command Reading all sectors to an img Worked. Not sure of what use it is to you but i can up load that. I'm going to work on getting all the files shortly.

[alphab0ing]

Ok I'm fixin to get started on this I just had my parallels tools crap out on me so I'm dealing with that then ill start in on what you've sent over

[tds04]

Ok got everything but the userdata. So far 18gig Going to be a lot to upload

[tds04]

https://archive.org/details/Vantron

[alphab0ing]

Something didn't come out right on the boot_a/boot_b img files here's what I'm getting...

$ file boot_b.img
boot_b.img: ISO-8859 text, with very long lines (65536), with no line terminators

$ file boot_a.img
boot_a.img: ISO-8859 text, with very long lines (65536), with no line terminators

hexdump -C boot_a.img | head -n 20
00000000  cc cc cc cc cc cc cc cc  cc cc cc cc cc cc cc cc  |................|
*
04000000

Looks like uboot_a.img is showing the right information but nothing is extractable..

binwalk uboot_a.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
608432        0x948B0         CRC32 polynomial table, little endian
642008        0x9CBD8         CRC32 polynomial table, little endian
685192        0xA7488         SHA256 hash constants, little endian
697953        0xAA661         Android bootimg, kernel size: 1413760512 bytes, kernel addr: 0x616F6C20, ramdisk size: 1684086884 bytes, ramdisk addr: 0x30207264, product name: "id's image name: %s"
911296        0xDE7C0         Flattened device tree, size: 11039 bytes, version: 17
1657008       0x1948B0        CRC32 polynomial table, little endian
1690584       0x19CBD8        CRC32 polynomial table, little endian
1733768       0x1A7488        SHA256 hash constants, little endian
1746529       0x1AA661        Android bootimg, kernel size: 1413760512 bytes, kernel addr: 0x616F6C20, ramdisk size: 1684086884 bytes, ramdisk addr: 0x30207264, product name: "id's image name: %s"
1959872       0x1DE7C0        Flattened device tree, size: 11039 bytes, version: 17
2705584       0x2948B0        CRC32 polynomial table, little endian
2739160       0x29CBD8        CRC32 polynomial table, little endian
2782344       0x2A7488        SHA256 hash constants, little endian
2795105       0x2AA661        Android bootimg, kernel size: 1413760512 bytes, kernel addr: 0x616F6C20, ramdisk size: 1684086884 bytes, ramdisk addr: 0x30207264, product name: "id's image name: %s"
3008448       0x2DE7C0        Flattened device tree, size: 11039 bytes, version: 17
3754160       0x3948B0        CRC32 polynomial table, little endian
3787736       0x39CBD8        CRC32 polynomial table, little endian
3830920       0x3A7488        SHA256 hash constants, little endian
3843681       0x3AA661        Android bootimg, kernel size: 1413760512 bytes, kernel addr: 0x616F6C20, ramdisk size: 1684086884 bytes, ramdisk addr: 0x30207264, product name: "id's image name: %s"
4057024       0x3DE7C0        Flattened device tree, size: 11039 bytes, version: 17

I know typically would need to be in MaskROM to extract boot images etc from an unrooted device, I wonder if that's why it's coming up corrupted? I'll keep working with these just thinking out loud

[tds04]

Do you think it could be a size limit issue. Was reading about this here

https://pine64.org/documentation/PineNote/Development/Flashing/

I will try those files again tomorrow. Also try in maskrom mode. I wonder if I need a better power supply? Could try with a Mac as well I suppose

[alphab0ing]

I wonder if its not the zip process?? the bootkernel.zip file that I download is only 176kb and looks like each boot image is 67/68MB and the kernel is around 34 so a+b unzipped is just over 200MB, compressed should be a lot bigger then 176kb

[alphab0ing]

Also the vantron.zip is 22.8MB downloaded? Unzips to 19gb but that can't be right, maybe see if you can just upload the raw boot/kernel img to internet archive see if that works, I'm not convinced that your images aren't good yet.

[tds04]

Ya did seem awful small. I will upload the original files tonight.

[barrenechea]

Hey guys! I've been pretty busy lately. Thank you for keeping this up!

If it helps, I also got the CC issue a couple of years ago when using rkDumper trying to back it up. I guess rkDumper and rkdeveloptool may use similar underlying strategies.

I asked the rkDumper developer about it here and the response states that it may be a bootloader "protection" causing it to reply with hex CC. I have no way around it :(

Also, maybe because pretty much all the files may be filled with CC, I guess that the compression is just very good at compressing that repeated pattern, and we're seeing very small sizes?

[alphab0ing]

Before you upload you can check the file with hexdump just to make sure its legit...

Mike@MacBook-Pro Image % hexdump boot_a.img
0000000 cccc cccc cccc cccc cccc cccc cccc cccc
*
4000000
Mike@MacBook-Pro Image %

Here's the info that I get from the first image dump from @barrenechea ...

Mike@MacBook-Pro payload % file boot.img   
boot.img: Android bootimg, kernel (0x10008000), ramdisk (0x11000000), second stage (0x10f00000), page size: 2048, cmdline (console=ttyFIQ0 androidboot.baseband=N/A androidboot.wificountrycode=US androidboot.veritymode=enforcing androidboot.hardware=r)
Mike@MacBook-Pro payload % hexdump boot.img
0000000 4e41 5244 494f 2144 a008 0130 8000 1000
0000010 2e66 009d 0000 1100 7400 00bf 0000 10f0
0000020 0100 1000 0800 0000 0001 0000 0161 1200
0000030 0000 0000 0000 0000 0000 0000 0000 0000
0000040 6f63 736e 6c6f 3d65 7474 4679 5149 2030
0000050 6e61 7264 696f 6264 6f6f 2e74 6162 6573
0000060 6162 646e 4e3d 412f 6120 646e 6f72 6469
0000070 6f62 746f 772e 6669 6369 756f 746e 7972
0000080 6f63 6564 553d 2053 6e61 7264 696f 6264
0000090 6f6f 2e74 6576 6972 7974 6f6d 6564 653d
00000a0 666e 726f 6963 676e 6120 646e 6f72 6469
00000b0 6f62 746f 682e 7261 7764 7261 3d65 6b72
00000c0 3033 6f62 7261 2064 6e61 7264 696f 6264
00000d0 6f6f 2e74 6f63 736e 6c6f 3d65 7474 4679
00000e0 5149 2030 6966 6d72 6177 6572 635f 616c
00000f0 7373 702e 7461 3d68 762f 6e65 6f64 2f72
0000100 7465 2f63 6966 6d72 6177 6572 6920 696e
0000110 3d74 692f 696e 2074 6f72 746f 6177 7469
0000120 7220 206f 6e69 7469 2f3d 6e69 7469 6220
0000130 6975 646c 6176 6972 6e61 3d74 7375 7265
0000140 0000 0000 0000 0000 0000 0000 0000 0000

##Continues on...

The boot.img from @barrenechea seems to be intact the problem I'm facing is when I extract the device tree it's not bootable so it could be that the image is fine but the extraction process for the dtb might be the problem. I'll attach a copy of the boot.img I was able to get from @barrenechea ....

boot.img.zip

[alphab0ing]

Also, maybe because pretty much all the files may be filled with CC, I guess that the compression is just very good at compressing that repeated pattern, and we're seeing very small sizes?

@barrenechea, I think you could be spot on with this...

I'm going to use the gpt provided by @tds04 and flash the image provided in the first dump and see if that brings this board back to life but at some point we will need a functioning device tree that I can package into the android rom