Do it before modding your tablet !

This is not a suggestion to have nice time with your girl-friend (or droid-friend, freely choose) but a smart way to operate when going to change your tablet from the “usual” Android to the “excellent” Uberoid. I have seen so much posts, in the HCH TechKnow forum, with messages like “help me, I just upgraded my tablet and now it autonomously speaks in ancient languages even if turned off”. Stop it, let we operate in a smart way. Prior to change, we must know what are we changing. Don’t post messages like “my tablet doesn’t work; it has -probably- a 7 inches screen, help me”, but change your approach. Your tablet is a complex machine, it looks like a toy, but has very sophisticated solutions inside it.

Your tablet COMMUNICATES with you, in its manner, but you can’t see the messages until the display goes on and the user-interface fully starts. BUT… there is some initial activity that is very, very interesting to indagate. I’m speaking about the U-boot.
The U-boot, as all of you can remember, is an underwater… no, sorry, I’m confusing with my other job. Redo: the U-boot is the first program that’s executed by the processor which animates your tablet (in our specific case, the WonderMedia WM8650).

The U-boot has big potential, you can -really- make any sort of operations on your tablet’s core, but the full list of such possibilities is too big to be exposed in this small page. So I just want to point your attention to some commands.

Let’s start. First of all: where U-boot comes out ? And, how can I interact with the program ? Good questions (I like to say to myself I pose good questions).
The answer is that you can’t see the U-boot activity without a little hardware and some software ; both of them are easily available. Note that the time you can lose with this preliminaries, will be widely balanced by that you can spare avoiding to brick your tablet with wrong rom upgrade.

HARDWARE

We need to look at the U-boot messages that are sent to the system serial port. Even if you can’t see any connector, the serial port is ALWAYS present on such tablets (for this generation). Now, the first operation requires some hardware. You must find 3 basic signals: TXD, RXD and GND. These are, respectively, the serial output, serial input and common (ground) signals of ttyS0 peripheral (assigned by the system to the console device). Any tablet has its own arrangement. In my experience, all the tablets that have an external connector for USB and LAN has also pads for such signals in the same external box, while tablets having USB and LAN built-in, must be OPENED (mechanically) to gain access to the lines.

Look at the pictures posted below to some examples of serial port wires in tablets I have used for my embedded applications (click images to enlarge).

This is the expander for a 7″ tablet with 24 pin connector. Wiring is easy ‘cause there are 4 holes 0.100″ spaced. Soldering wires is easy and low probability to destroy pads for overheating.

This is the expander for a 9.7″ tablet with 30 pin connector. Wiring is a little bit more difficult ‘cause the pads haven’t holes; you must take care of overheating to not destroy pads.

 

Another model of expander for a 9.7″ tablet with 30 pin connector. Wiring is difficult due to small pads without holes. Be carefully, high probability of destroy pads for overheating or pulling of soldered wires. Use small, flexyble wires and apply some strong adhesive tape to mantain them in position and to protect pads from strapping.

Connections for a 10.1″ tablet that hasn’t external expander. The USB and LAN ports are inside, so you must mechanically open the tablet to gain access to the pads. You must follow the same rules as for previous model.

This image is very interesting ‘cause you connect the wires directly to the WM8650 CoreBoard, so this solution will be valid for about ALL the tablets based on it. Note that I used 4 wires, getting gnd, txd, rxd and +3.3V, so the power can be used to supply an external interface.

 

Now, the signals have to be connected to your PC to interact with the U-Boot. The processor serial port signal are swinging from 0 to 3.3 Volts in negative logic, while a standard serial port (RS-232) has typically -5 to +5 Volts signals in positive logic, so you can’t connect directly the tablet signals to the PC ones: you need for an interface to logic inversion and level translation.

At least, you have two chances: the first is my own circuit you can find in another my article here ; you have to build it by yourself, it isn’t for sale…

I noticed that my interface was added as part of zip file “kit for tablet unbricking” by the Uberoid guru HcH ! Thanks for considering this small hardware as a useful tool 🙂

 

 

With this interface you can connect a standard PC serial port ( or USB to RS232 adapter) to the tablet; in case you try an USB adapter, remember to disable the FIFO buffers or reduce anyway the latence of signals at the minimum using the device properties menu.

The second option is to buy this USB-Serial-TTL interface. I found it on ebay after the suggestion of a friend; it’s very cheap and (obviously) doesn’t requires any solder works. Just one problem: the shipping time from the Far Orient was 3 weeks, here in Italy. Even with this usb interface (that your PC discovers like a serial port) you will turn OFF the FIFO buffers or decrease the latency to the minimum.

Using my interface, you have to connect 4 wires: +3.3V, Txd, Rxd, Gnd (‘cause the circuit is powered by the tablet’s 3.3V), and must cross Txd and Rxd signals between tablet and interface (look at the project’s page for detailed pictures) ; with the commercial interface, you just have to connect Gnd, Txd and Rxd of the circuit to the correspondant signals of the tablet (NO crossing).

SOFTWARE

The software needed is simply a serial terminal. We have many different choises; under Windows the most famous is the HyperTerm, but in Win7 it has been removed (but why ?), so you must use somewhat different. Usually, I use RealTerm under Windows and CuteCom under Linux. There is, also, my own terminal, called miterm-en you can download from this link . The zipped file contains the executable, compiled for Windows (working in Win7) and the source file in FreeBasic, so, if you want, you can easily modify, expand, arrange and compile, for example, under Linux. FreeBasic is a GREAT free compiler available for Windows and Linux. It can be used for small programs like this, but even for huge and sophisticated programs. It’s fast, simple, compatible with old “Basic” dialects like GW-basic, Qbasic etc. and it’s FREE. I use it with the Geany editor (under Win7) and is one of the powerful instruments on my software workbench. In the picture below you can see the program screen at start. The default serial port is COM4, but if such port isn’t available on your system, the program asks you for a new available one. In the example, I typed in the com19, ‘cause is the port number assigned to the usb-serial-ttl interface.
The program simply writes on the screen what comes in from the serial input and puts on serial output what you type on the keyboard. There are only 2 “command” keys: the [Esc] for program terminate and the [Ctrl-R] for toggling on-off the logging of the received data on a disk file.

In the next screen you can see what happens if you type [Ctrl-R]: the recording starts on file named log_xxx.txt, where xxx is a number that increases every second (system timer).

Now, I have my serial port connected to the tablet (that’s actually turned OFF, not suspended, really OFF). Now, I press the power button and the tablet sends a lot of data to my PC, then asks to press any character to stop the autoboot (typically for 3 seconds, then the autoboot takes place). Ok, quickly pressed [cr], and the transmission stopped here…

As you can see, we have the WMT# prompt that indicates we can send commands to the U-Boot program, finally… But we still are recording to a log file, so stop now typing again [Ctrl-R]. If you look inside the last log_xxx.txt file, you can see all the messages sent from the tablet. Please, note that the txt file logs data as sent from the tablet, and this data is in Linux mode, so you can experience missing line breaks when using a Windows program like the Notepad as the viewer, but if you use Geanie or any text editor able to handle the Unix/Linux format, there are no problems. Now, type the question mark then [cr]. This is the alias for HELP, so you will receive a list of ALL possible commands you can execute with U-Boot. Here is what I received on my tablet :

?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
decompanima - decompress logo image to the dest position.
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
show    -
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatstore - store binary file to a dos filesystem
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imls    - list all images found in flash
imm     - i2c memory modify (auto-incrementing)
ims  - set i2c device context from memory
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
memory bit operation :
Format : mbit
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
  mmcinit 0 -- init mmc device 0
  mmcinit 1 -- init mmc device 1
mmcread - read data from SD/MMC card

   -read data from SD/MMC card block address 'block_num' on 'dev_id'
    to memory address 'addr' size is 'bytes'
mmcwrite - write data to SD/MMC card

   -write data to SD/MMC card block address 'block_num' on 'dev_id'
    from memory address 'addr' size is 'bytes'
mtest   - simple RAM test
mw      - memory write (fill)
nandrw  - NAND sub-system
nboot   - boot from NAND device
nfs - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
poweroff - wmt device power off.
printenv- print environment variables
protect - enable or disable FLASH write protection
randmac - generate a random MAC address and save to "ethaddr" environment variable
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdwaitins - wait sd card inserted or removed
sdwaitins 0 -- waiting removed
sdwaitins 1 -- waiting inserted
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
textout - show text to the screen
textout x y "str" color
color is 24bit Hex, R[23:16], G[15:8], B[7:0]
for example: textout 0 0 \"hello world\" FFFFFF
tftpboot- boot image via network using TFTP protocol
version - print monitor version
WMT #

The command that can save us from a wrong rom upgrade is “printenv”. This command simply puts out the env list that actually is stored in your tablet. This is an example taken from my 9.7″ tablet. This tablet has been modded with Uberoid, but it works, so all the settings are right.

memtotal=212M
mmcid=0
lpj=AUTO
ipaddr=192.168.0.2
serverip=192.168.0.1
gatewayip=192.168.0.1
netmask=255.255.255.0
kernelargs=setenv bootargs mem=${memtotal} root=${filesystem-NAND_mtd} noinitrd rootfstype=yaffs2 rw console=ttyS0,115200n8 lpj=${lpj} ${android_bootargs} ${platform_bootargs} quiet
bootcmd=nandrw r ${kernel-NAND_ofs} 0x1000000 ${kernel-NAND_len}; if iminfo 0x1000000; then run kernelargs; bootm 0x1000000; fi; echo No kernel found
logocmd=nandrw r ${wmt.nfc.mtd.u-boot-logo} ${wmt.display.logoaddr} 10000; nandrw r ${wmt.nfc.mtd.u-boot-logo2} ${wmt.display.logoaddr2} 40000; nandrw r ${wmt.nfc.mtd.kernel-logo} ${wmt.kernel.animation.addr} 80000; display init force; decompanima -f ${wmt.display.logoaddr2} 0x3000000; decompanima -f ${wmt.display.logoaddr} 0x3000000
wmt.display.logoaddr=500000
#=chg emilio next line - wmt.display.logoaddr2 550000
wmt.display.logoaddr2=500000
wmt.kernel.animation.addr=f600000
#wmt.audio.spi=1:0:0
wmt.audio.i2s=vt1603:f1:f2:ff:ff:100
wmt.io.pwbn=100:0:2000
wmt.eth.param=1
wmt.gpi.bat=[0:0:00020000:d8110040:d8110080:d8110000:d8110480:d81104C0][1:0:00000020:d8110040:d8110080:d8110000:d8110480:d81104C0][2:1:00010000:d8110040:d8110080:d8110000: d8110480:d81104C0]
wmt.gpo.camera1=1:0:7:D8110040:D8110080:D81100C0
wmt.gpo.wifi=6:1:6:d8110040:d8110080:d81100C0
wmt.gpt.gsensor=3:8:d8110040:d8110080:d8110000:d8110480:d81104c0:83000000:d8110300:8:d8110320:6
wmt.io.bat=3:2:1000:d7a:b22:d7a:d3d:d02:cc5:c8b:c4e:c12:bd6:b9c:b5e:b22
wmt.io.gsensor=1:3:4:0:1:1:-1:2:-1
wmt.sys.keypad=wms8151a:1:rc_1:4:c0_72:c1_73:r0_9e:r2_76:1:9e_8b
wmt.pwbn.param=100:0:500
wmt.ui.storage=7
wmt.io.touch=1:uor615x:0:1024:768
wmt.bus.i2c=i2c0:1:1:i2c1:1:1
bootdelay=3
wmt_ui_hibernation=1
wmt_sys_powerhold=0
wmt.gpo.vibrator=1:1:2:D8110040:D8110080:D81100C0:1
wmt.camera.param=1:1
android_bootargs=init=/init
platform_bootargs=wmtvo=2:0:16:1024:768:60
wmt.display.param=2:0:16:0:0:0
wmt.display.tmr=65000:0:320:480:1024:260:10:6:768:16
wmt.display.pwm=0:50:1000:999
wmt.io.mxcgsensor=1:3:4:0:-1:1:-1:2:-1
##=chg emilio next line - wmt.vt160x.bat 0:1:10:0
#wmt.vt160x.bat=1:0:10:0
wmt.vt160x.bat=0:1:10:0
wmt.gpo.camera=1:1:7:D8110040:D8110080:D81100C0
wmt.model.no=yongpeng_9.7inch_usbcamera
#=chg emilio next line - wmt.io.ts.2dcal 40 -30251 117186489 24194 22 -8405089 106502
wmt.io.ts.2dcal=40 -30251 117186489 24194 22 -8405089 106502
kernel-NAND_mtd=/dev/mtdblock9
kernel-NAND_ofs=0x2600000
kernel-NAND_len=0x800000
initrd-NAND_mtd=/dev/mtdblock10
initrd-NAND_ofs=0x2e00000
initrd-NAND_len=0x600000
filesystem-NAND_mtd=/dev/mtdblock11
filesystem-NAND_ofs=0x3400000
filesystem-NAND_len=0x20000000
wmt.nfc.mtd.u-boot-logo2=0x23500000
ethaddr=00:40:63:26:75:03
serialnum=c93521e3eb114a4ab51e6912e1ed7c4f
sys.flt=1324841537
wmt_sys_restore=0
wmt.nfc.mtd.u-boot-logo=23400000
wmt.nfc.mtd.kernel-logo=23c00000
wmt.io.wifi.drv=start
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.1.4 (Aug 24 2011 - 10:14:10)

Environment size: 2945/65531 bytes
WMT #

Note that in the row wmt.model.no you have your tablet model, that’s more precise than say: “the green led with the black button and the gray case” etc. Also note the row wmt.io.ts.2dcal that contains the touchpad calibration values. Don’t consider the rows in which you can read “emilio” ‘cause are experiments I did changing the default env_uboot file.
Look with attention to the values your tablet has built-in BEFORE trying to update the rom. A quick comparison with the contents of file env_uboot in the FirmwareInstall/env/ folder of the rom you have selected for modding can advice you if there is some incompatibility. Also, look inside the wmt_scriptcmd for some wrong parameter. The screen size for example, if wrong, can lock your tablet in the very first steps of upgrading process. The third and last step to do before a tablet upgrade, can be done without any hardware tool. You just need for a terminal program to run on the tablet, like the Android_Terminal_Emulator or others. Once installed the apk, run the terminal emulator on the tablet and execute the dmesg command, re-directing the output on a file, then save that file on the sdcard. You will have a list of the drivers and all was running in your tablet with the original rom. If you want to take a look to a dmesg.txt file coming from one of my tablets, click on this link (use the right mouse button and “save destination as” if you want to download a copy on your PC).

That’s all, for now. I hope this document can help someone to save time and to choose the right rom for making his tablet the best (with Uberoid 🙂


 

Android tablet standing

Note: for additional programs for CNC, look at this link.

My tablet asked me for relax. After many modding and electronic surgery, it said “papi, I’m tired, can you build something to stay on and relax ?” . And I took pen and paper and wrote the G-code for my hobby CNC machine.
After grrings and rrrumbles I produced the stand for my tablet that you can see on the attached pictures. Please, note that the wrong cut isn’t an error in the G-code: I did that cut after the control PC was turned off, using my hands as the controller… So you can easily understand that I’m not a good mechanic… My tablet appreciated my work and promised to automatically look on the Internet for free tickets to Cancun, Mexico to make me a present 🙂

The first side cut :

Both sides cut :

Stand mounted :

Tablet now relaxing 🙂

Now, the original drawings…

and a short video of the tablet stand while creating on my hobby CNC machine.


standcnc di robotop

A program to build the right SPI.BIN file for your tablet

I have had a bad experience in reprogramming the SPI flash of my tablet (a new one), due to wrong BIN file used (it was suited for ANOTHER tablet, with different RAM arrangement). After a couple of tries “in the blue”, I stopped working that way and decided to write my own software to merge the U-Boot.bin and the W-Load.bin that are in FirmwareInstall folder of specific update microSD, then create the right output BIN file to be used with external programmer for SPI flashing.

The SPI flash

SPI means Serial Peripheral Interface and “flash” is a particular type of memory, capable to be written (and rewritten) in fast mode and able to retain informations even if power supply is removed, so this kind of memory is part of the “non-volatile” devices.

What’s the purpose of SPI flash in our Android Tablet ? It’s like the (ancient) floppy disk in old computers. The floppy, in VERY old computers, was the device containing the Initial Program Loader, the first program the processor runs to start the whole system. In our tablets, the processor (I’m speaking about the WM8650, in this case) tries to load a boot program from this device. The SPI flash memory is small and simple device. Usually has 8 pins (contacts) and isn’t too miniaturized… it’s still at “human” dimensions and this is the reason we can remove it from the circuit, reprogram and resolder it on place. If your tablet is “bricked”, you can immediatly recover, simply restoring a valid boot program in it.
The hardware and the procedures for rewriting the SPI flash have been described in a very good article 🙂 by me on another page of my site, so, look around if interested in. But… what’s stored in the SPI flash of our tablet ?

There are two programs: the W-load and the U-Boot. The U-Boot can execute commands you supply via serial terminal or you have stored in the microSD, by means of the wmt_scriptcmd script file. U-Boot is the tool for handle the very low-level of your tablet. Btw, the NAND flash is another basic component of your system, ‘cause is your device’s HARD DISK. As in very old computers, the floppy loads the system skeleton and then the Hard Disk starts the programs with usual user interface (or GUI when is Graphical User Interface).

Ok, we turn ON the button, the processor starts, executes the program written in the W-load section. The U-boot then starts the system that’s on NAND memory and you have your tablet working.

When you try to unbrick your tablet rewriting the SPI flash, you must use the right version of U-Boot and W-Load, ‘cause if you choose a wrong version, all the process can’t start. A very important section (usually don’t mentioned) is the W-load program. There is a particular version for any RAM arrangment in your tablet. Not all the RAMs are the same: even if your “global” ram size is a certain number of MB, the rams can be arranged in different ways. For different arrangements, there are different W-loads.

How can I understand what’s my specific W-Load ?

You can take a look on the serial output that comes out from your tablet at power on. Obviously… you must do it before upgrading (and possibly bricking) your tablet ! The serial interface is a VERY powerful tool and I highly recommend to you to purchase (or build) one for modding and better understanding your tablet.
Look at this example :

WonderMedia Technologies, Inc.
W-Load Version : 0.15.00.01
UPDATE_ID_1_4_4_0_2_256MB_0150001
ethaddr............found
wloader finish

U-Boot 1.1.4 (Aug 24 2011 - 10:14:10)
WonderMedia Technologies, Inc.
U-Boot Version : UPDATEID_0.04.00.00.10
U-Boot code: 03F80000 -> 03FC3190  BSS: -> 03FCD724
boot from spi flash.
SF0: ManufID = 37, DeviceID = 3013 (Missing or Unknown FLASH)
Use Default - Total size = 8MB, Sector size = 64KB

There are some very useful infos: these are W-Load version and UPDATE_ID, U-Boot Version and UPDATEID. With such informations you can easily “build” your own SPI flash and it will be EXACTLY the one that fits your tablet. You also have infos on which type of SPI flash is mounted in the tablet. In the example before, the memory has ID 0x373013 (that is unknown to the system, so it starts with default values that are good for all memories).

How to build your BIN file for writing a new SPI flash.

Usually, the SPI flash has 512KB (kilobytes) space, but if you look on the datasheet it’s called a 4 megabit memory; that’s exactly the same, ‘cause 4Mbits = 512KBytes.
In our tablets, the SPI flash memory is divided into 2 areas: the first, starting at address 0x00000 and ending at 0x6FFFF (not fully used) is the U-Boot program; the second, starting at address 0x70000 and ending at 0x7FFFF (almost fully used) is the W-Load program.

I wrote a small program that can build for you the my-spi.bin file, the BIN file of 512KB you need to re-flash your SPI memory. The program is written in FreeBasic (under Windows), and doesn’t need for installation. Just decompress the .ZIP you can download from attachments in a folder, for example spi-flash and you have the executable to run.
In order to create your my-spi.bin file, you need, obviously, for the submentioned files u-boot.bin and w-load.bin. So, go to the FirmwareInstall folder of your Uberoid upgrade folder (or to the same folder of original rom) and copy the u-boot.bin you find there in the new created folder. For the w-load, you have (often) different file names that all starts with w-load prefix and finishes with .bin suffix, but the right file is the one has inside the same signature you have read in the serial terminal (in our example is UPDATE_ID_1_4_4_0_2_256MB_0150001). If you are in doubt, simply try copying all of them in your new folder and then rename it, one at a time, in w-load.bin. The program is “stupid” and looks for input files u-boot.bin and w-load.bin and produces as output my-spi.bin .
When you start the buildspi.exe, the program generates the output file and shows to video the actual versions of U-Boot and W-Load programs; if some of that versions isn’t the one you need for, simply load another and try again.

Once the file is created and the versions are both identical to the ones you read from serial terminal at the device boot, you have the right SPI file to program into the chip.

The executable file (zipped) can be downloaded here.

In the picture below, you can have a look to a working program screenshot. Hope this will help you.

 

Using SPI programmer to revive bricked Android Tablet

This mini-guide is based on the very useful software SPI FlashROM Programmer 1.9c (C) 2008-2011 by Martin Rehak. Look for SPIPGM.ZIP on author’s page here


This is my version of the programmer’s circuit. I just modified some resistor value from the original one.

More readable PDF can be downloaded here


I also developed a small printed circuit board, mainly for the ZIF socket pinout (it can’t be mounted on prototyping board with 0.1″ spacing).
The 1:1 scaled PDF can be downloaded here

And finally the fully populated board…

I used a ZIF TexTool socket from 3M (RS catalog code 766-980) and modified the resistor values from the original schematic. The reason for this change is to protect the device under programming, ‘cause the SPI flash memories are powered at 3V and the parallel port of PC may run at 5V. So, increasing the resistor values gives less current to the protection diodes built in the memory chip. In practice, the excess voltage coming from the parallel port falls on the resistor and the total current flowing thru the internal protection diode is (Vpp-Vcc) / R where Vpp is the voltage out from parallel port, Vcc is the flash IC supply (3V battery in this case) and R is the resistor placed between the parallel port and the IC. Note that the flash data output has lower value resistor: this is mandatory ‘cause the parallel port has pull-up resistors inside and therefore the LOW level (zero logical) coming from the flash IC makes partition with the series resistor and the pull-up, and rises in value. If the series resistor is too high, the LOW level goes in the zone that is considered UNSTABLE or HIGH for the parallel port input pin and your device will not work !!! Obviously, this means that the data-out pin is not protected as well as the other pins, but for occasional use it may be considered safe enough to operate. A better solution will be to add some level-translation logic. Note the copper band in the picture: it’s only to make easier to unplug the parallel port connector… don’t remove that connector pulling by the wires ! You easily have to solder them again…


Well, now I will describe the step-by-step procedure to program a flash IC with this programmer. You can download here a zip file containing some batch files I wrote to simplify the execution of every procedure’s step, plus a txt file that’s simply a copy of the help screen of the SPIPGM program.
Who needs for SPI flash programming ?
The man that has bricked his Android Tablet changing the wrong bytes with hex editor !
As me…

The last chance, in such horrible situation, is to reprogram the U-boot and W-load that are on the flash chip near the microprocessor. In my WM8650 based Android Tablet, that flash was the 25P40 from ST. It’s a SOIC 8 package, so isn’t too complicate to unsolder from the board. NOTICE: the IC will “die” when unsoldered, as mine did, but if you have the binary file needed to fill the new one, there will be no problems.
Note that in the batch file I used, as source for flash burning, one .bin file called 2711942B.bin ; this strange filename comes from a WM8650.bin I found on the Internet, renamed with the value of its CRC32 checksum. I did this ‘cause there are different binary files with the same purpose (reflashing Android Boot SPI), but in my specific tablet only the one with such CRC32 did the job. Obviously, you need to download the file somewhere (Edited: after some time, I realized a software tool that can build the right BIN file to be used to flash the SPI memory ; read full description in this article) and rename as mentioned to use the batch file without any modifications.
Oops, you also need for a flash memory IC to program 🙂
The original 25P40 from ST was impossible to find in my country, but an equivalent from Atmel is available in the Farnell catalog with code: 171 5441 (AT25DF041A-SSH-B). The component’s electronic signature is unknown for the SPI programmer, but works fine as generic Atmel. As the original one, this flash IC has 4 Megabits (512 KBytes) of reprogrammable memory and costs around 1 Euro for single piece.

Pay attention to static charges ! Connect your body to GND when handling IC

Now, let’s start to program the chip; follow this step-by-step sequence, please…

  • insert the IC in the ZIF socket with DB25 Printer Port Connector and 3V Battery Clip both disconnected !
  • connect the battery clip to the 3V battery pack with special attention to the polarity ! (reverse = destroy)
  • start the “identify.bat” batch file, still without connecting the programmer to the parallel port
(this initializes the parallel port outputs to a safe condition). Obviously, there are errors, ‘cause the programmer is still disconnected.
  • connect the DB25 to the parallel port and run again the “identify.bat” batch.

this time you can see the chip ID that is 1F4401h, that’s specific for the AT25DF041A, but not recognized by program for the type, only for manufacturer (Atmel), but it’s enough.

  • now, run the “unlock.bat” batch. This is necessary to enable the memory to accept writings.


even if the result is “failed”, the unlock has been done.

  • now erase the memory running the “erase.bat” batch. This is not needed for a new IC, but better to do it anyway…


this will take a couple of seconds if all right. If program terminates immediatly, there’s something wrong.

  • and now, run the “program.bat” batch…

the program doesn’t know this type of memory, so prompts for size in Kb; type 512 and go… (note that this step is skipped if the memory chip is fully recognized by the program)

programming has been executed (it will require a couple of minutes or less for the BIN file used).

  • finally, read the programmed flash contents running “dump.bat” batch. It will read the flash contents and store them to arbitrary file name rd_spi.bin ; this will be useful to compare the source file with this readout.

again the program doesn’t know this type of memory, so prompts for size in Kb; once more type 512 and go… (note that this step is skipped if the memory chip is fully recognized by the program)

operation complete… now use a binary file comparision to check if source and readout are equal (I suggest the great open source Frhed to do this job). In alternative you can compare the CRC32, MD5, SHA-1 of both files using the free program HashTab that integrates in Windows shell.

The flash IC is programmed, now follow this sequence to disconnect :

  1. with the IC still in the socket and the battery connected, detach the DB25 connector from the parallel port
  2. detach the clip connector from the 3V battery pack
  3. open the ZIF and get the programmed IC

The new IC has to be soldered in place of the older one. Normally, this isn’t too difficult, but my board pads for pins 5 and 6 were removed by excessive heat during desoldering. This can transform your tablet in a flat expensive electronic rubbish ensemble. I solved the problem using enamelled copper wire (0.2 mm) soldered directly to the PCB tracks and manteined in place by adhesive paper tape. It was very, very hard job. So, please, be patient and carefully remove the original IC from its solder pads. Any excess of heat can damage the chip (and this is not important) and the PCB (and this is terrific) !!! In the picture you can see the “wiring spider” that solved my problem. With this new flash boot and the UBEROID rom placed in the SD card slot, my Android Tablet was finally unbricked.

Added Jul,2,2012 :

I just built a small “tester” circuit that can be used in case of troubles with the programmer. If you can’t program your SPI flash, first of all test if your Parallel Port is really working under the Spipgmw program. The circuit proposed here, has to be connected to the parallel port of your PC. After attaching the circuit, please create a new batch file in the same directory you use for spipgm program and write this command inside:

spipgmw /r 0 16 /d=50000
pause

When you launch this batch, if your parallel port is set correctly, you can see the green led that blinks fast (on my old notebook with 500MHz clock, it blinks at about 10 Hz). If the led DOESN’T BLINK or is always ON or always OFF, there is a problem on your parallel port or the program spipgmw can’t handle it in appropriate way. The parallel port pin 8 is the SCK signal for the programmer, while the pin 18 is GND.

Riparare il tablet: operazione rischiosa…

Rispondo qui al commento inviatomi da Tommaso per il precedente articolo :

Ciao Emilio,
dai tuoi articoli sembra che tu conosca bene i tablet. Io ne ho uno guasto che non riesco a riparare con i miei strumenti, potresti farlo tu per me, con un contributo da parte mia per il tempo che perderai e la copertura delle spese postali ?
Ti ringrazio per la disponibilità

Buongiorno Tommaso.
Nessuna preoccupazione, non sei il primo a chiedermi se posso recuperare un tablet ! Non puoi immaginare quanta gente si trovi nella tua stessa situazione… in Italia e all’estero. Fino ad oggi ho sempre risposto di no, perché riparare tablet NON è il mio mestiere 🙂
L’ultima volta che mi è accaduta una cosa simile, è stata con un docente che aveva acquistato il tablet per organizzare delle lezioni e subito lo aveva “brickkato” (bloccato) ; avendo una buona conoscenza informatica, aveva eseguito alcune operazioni da terminale con lo U-Boot, provocando per errore la cancellazione totale di ogni cosa ! Disperato, era andato sul forum di HCH / TechKnow e avendo visto che “Robotop” era un italiano (il qui presente), mi aveva contattato in privato (allora c’era ancora la mia email) per chiedermi se potevo fare il lavoro per lui.
In breve, gli ho risposto di no, ma lui mi ha comunque inserito come “membro onorario” in una sua associazione per lo sviluppo delle conoscenze informatiche ecc. ecc. Insomma, dopo qualche tempo, diverse email e piccoli miei articoli “postati” sul suo forum, gli ho offerto una certa cifra per vendermi il suo tablet guasto. Così è stato. Una volta ricevuto il tablet l’ho aperto, ho fatto quello che c’era da fare e tutto è tornato a posto.
Poi, dato che stavo lavorando “a progetto” con un’azienda, proprio per utilizzare un tablet come interfaccia utente nel controllo di una complicata macchina, ho usato PROPRIO quel tablet per realizzare il primo prototipo “demo” che è stato fornito al cliente finale.
Ora, ho finito il progetto e mi sono rimasti anche dei tablet in più… Quindi la storia non si ripeterà 🙂

D’altro canto, mi dispiace non poterti aiutare, però vorrei che tu considerassi queste cose:
1) ogni tablet è un caso a parte. Non c’è il 100% di probabilità di poterlo riparare
2) il tablet deve essere aperto e  questo significa sollevare la plastichetta che ricopre lo schermo e la cornice (puoi fare una prova sollevando un angolino) per raggiungere le viti (piccolissime) che si trovano sul perimetro interno di detta cornice. L’operazione potrebbe portare alla rottura del touchscreen nel caso in cui il tuo tablet sia del modello “sfigato” (il termine è usato anche dai Ministri della Repubblica, quindi lo userò anch’io) che ha un potente biadesivo sia sulla cornice, sia sul touchscreen. La cosa mi è successa ed ora ho un tablet senza più touchscreen che funziona solo con un mouse wireless il cui ricevitore è piazzato all’interno del tablet stesso (vedi post su HCH/TK).
3) supponendo di riuscire ad aprire il tablet senza fare danni al touch e senza fare grossi graffi alla “carrozzeria”, arriva il momento di dissaldare la memoria SPI. L’ho fatto diverse volte, ma una di queste si sono staccate due “pads” dal circuito stampato ed ho dovuto usare due fili di rame grandi come capelli per cercare di recuperare la situazione. Ci sono riuscito, ma i miracoli tendono ad essere eventi unici 🙂
4) smontata la memoria SPI si deve “ricostruire” quello che c’era dentro. Io ho scritto un programma che utilizza parte dei files contenuti nella directory FirmwareInstall della versione Uberoid che funziona per il tablet in oggetto e quindi ho bisogno di questi files.
5) supponendo che la memoria SPI non si rompa per il calore durante la dissaldatura, si potrà utilizzarla di nuovo (è una flash) riscrivendo i dati all’interno… se però si è rotta (succede) allora bisogna comprarne una di ricambio. Costa poco, circa 1 euro, ma le spese di spedizione sono di 9 Euro ! Pazzesco. In ogni caso, c’è da aspettare che arrivi.
6) Riprogrammata la SPI, bisogna saldarla di nuovo sul circuito. Anche qui è questione di destrezza e FORTUNA. Diciamo che finora, in fase di saldatura, non ho avuto mai problemi, ma non v’è certezza assoluta.
7) Si inserisce di nuovo la scheda microSD con la versione Uberoid corretta e si fa l’Upgrade. Supponiamo che vada tutto bene… si deve richiudere la meccanica e piazzare di nuovo la plastichetta di copertura, dopo aver riavvitato le piccolissime viti.
8) Si deve preparare un pacco postale ben protetto e sigillato e si deve andare all’ufficio postale, di mattina perché al pomeriggio c’è l’isola pedonale (c’è sempre un’isola pedonale vicino ai pubblici uffici) e quindi attendere la solita mezz’ora (se va bene) per poter spedire il pacco. Pagare i soliti 11,40 Euro per il pacco celere 3 (se nel frattempo non è aumentato) e quindi tornare a casa.
9) Il pacco parte, viene deposto con delicatezza sul furgone (lanciato da un’altezza di tre metri da un nerboruto individuo totalmente disinteressato al contenuto) e si incammina verso la più vicina stazione delle Ferrovie dello Stato, ove viene trasferito con le stesse modalità (lancio) nel vagone postale.
10) Tu ricevi il tablet da me riparato e magari si è rotto durante il trasporto. Allora mi scrivi e mi dici “ma che @#@# hai combinato ?” ed io ti rispondo “ma come, ho fatto del mio meglio !” e così via…

Bene, se i dieci punti non ti hanno dissuaso, ti faccio presente che un tablet molto simile a quello che mi hai descritto in privato (9.7″ basato su processore WM8650, sistema operativo Android 2.2, touchscreen resistivo) costa on-line 109.99 Euro, compresa IVA e spedizione da Unione Europea, quindi senza dazi aggiuntivi.

From microSD to standard SD : another “robomod” for tablets

Hello all, my microSD socket was broken ; after many insertions/extractions, it refuses to get the microSD in and spits out two meters far from tablet 🙂 Nice spring inside, small but bastard. Ok, I was looking for a spare part, but can’t find a socket with same pinout… Many types, all different from the one I was looking for. So I unmounted the defective socket and had the idea to connect a NORMAL SD card connector. In the next picture you can look how the tablet was arranged before the modification.

I soldered small enamelled wires from the original microSD socket to the relative pins on a normal SD socket, as you can see in next picture. I also moved the speaker in place of old socket, so there is also a hole in the plastic for sound going out. I had to enlarge the original hole (set for the speaker, originally) to reach the exact measure of a standard SD card. It required only a minute of dremel action 🙂

Now, putting inside a standard SD card, my tablet recognizes it and works fine. I can also use, obviously, the microSD cards, with the usual converter that is supplied in bundle with such small cards and therefore NOW I can use the dozens of standard SD card that cames from my old PDAs, cameras and various devices…
In the next picture you can find a MAD (Manually Aided Design) schematic of the connections 🙂

Seven inches plus one : put 1″ Hard Disk into the tablet

I decided to add a real Hard Disk in my 7″ tablet. In my (large) collection of used things, I found an USB disk, not flash, real microdrive. It was originally by 5GB, but I purchased on ebay one of 8GB (originally used in a professional camera) and changed. I didn’t used for years, but now I had the idea to check if it will fit inside my tablet. In the first picture you can see:
A) the external of the specified device
B) the device opened, and disk view
C) the device opened, with USB connector extracted; the circuit side is visible

My first operation was to connect the 4 wires from the device to the unused USB pads for second camera (that doesn’t exists in my model). After that, I moved the battery to gain some space in center of tablet. You can see this arrangement in the next picture:

Now I fixed with bi-adhesive tape the disk to the backplane of the display and this is shown in the next picture :

For closing the tablet was necessary to remove, with small cutter, two little plastic distancers, cause they was positioned on new battery assembly. This way, the case was closed perfectly. At first boot the new disk wasn’t recognized, so I booted again. Now it was recognized but there was some defect… it was formatted in bootable EXT2 and this may be the problem. I reformatted the disk with the Android menu and all was correct. Rebooted again to verify the disk will be automatically mounted and was OK. Also set the wifi connection (having added a 33 mm wire to enhance the antenna) and the signal was “excellent”. In the next picture you can see the new u-disk with 7.44 GB available ! The old man reflected in the screen it’s me 🙂

Pinout presa USB

Ho aggiunto al mio tablet alcune cose, smontandolo e trovando i collegamenti giusti. Avendo aggiunto anche uno HUB USB per aumentare le periferiche a disposizione, mi sono trovato nella necessità di rilevare la piedinatura di una normale presa USB. Ho pensato di fare cosa utile pubblicando qui la foto di una di queste con i relativi segnali. I colori rosso, giallo e verde sono indicativi (il bianco sostituisce il nero che non avrebbe avuto risalto nella figura), ma non è detto che i fili elettrici che troverete nelle periferiche rispettino questa colorazione. La posizione dei segnali, invece, è quella esatta.