Get serial data from USB GPS receiver

Some years ago, I purchased a “GPS mouse”, a device that has magnetic base and connects to PC USB port to give GPS position to navigation program. I remember I purchased, also, a true licensed copy of Microsoft’s Autoroute 2005 program. This means I’m speaking about a device at least 7 years old…

Recently, I reloaded the software on a very old notebook that is normally hidden under the seat in my car ; it is just for emergency situations (I am able to lost even in a well known regions).

Good, having tried a new route and noticed that the way was every minute much harder, and forced to admit that it terminates on the gate of a haunted house, I tried to make a position search using the GPS receiver with the notebook.

But there was a problem… the device, when connected to the notebook, makes it turning off ! It was like a short circuit on USB connector. So, no position, no help, no GPS. I did my route backside until recognized a known road…

Ok, when at home, I decided to open the GPS receiver to look inside and indagate on the reason of such short circuit. The receiver model is BU-303 and has 2 hidden screws under a rubber plate that covers the magnet (I never attached the device on my car’s top, ‘cause it was originally good to connect satellites even if used inside the car). So, after removing the rubber plate and the screws, I opened the box. Oh, there is a very small battery inside, probably to retain some satellites data when powered off. This small battery was rated for 3.3Volts… Hmmm, using my multimeter to measure the residual charge, I read exactly ZERO volt. The battery is gone. Ok, it was directly  soldered on the circuit and I removed it easily. Now, connecting the USB to a notebook, all worked fine.

I decided to look inside and discovered, after removing a metallic shield, one unused option. As you can see in the picture below, the device can have USB or RS-232 connection !!! The unmounted IC seems (looking at the connections) very similar to one classic MAX232 or equivalent.

Connecting an oscilloscope and measuring the most probable pins, I discovered that the serial output was present on pin 11 of the missing IC, with amplitude of about 3V and protocol 4800,N,8,1. Also it was evident that with a small wire to connect one pad to the very near opposite, that signal can be “routed” to an easy point of the circuit to solder on, so the shield could be soldered again in its place. So I soldered a very small wire to the contacts as in figure :

The yellow dots are the points connected together. It was not easy… But at the end I mounted again the metallic shield on, and soldered 3 wires to make power and serial connections as in the final picture here :

Now, the circuit can be powered from 5V ( also tested and working at 3.3V ) and on the wire S-out you can get (at TTL level, around 3V) the various NMEA sentences that can be read, for example, from a microcontroller to make a satellite localization system, adding a GSM phone module to send you the actual position of your car via sms.

I also tried to connect the circuit to the debug port ( ttyS0 ) of a cheap Android tablet, but unfortunately the ttyS0, when forced by software commands to run at 4800 BPS, on such hardware (WM8650 based) can’t set the right baud rate and “shifts” automatically to 9600, that obviously isn’t useful for this work.

Anyway, I hope this will be useful for someone….

Wireless mouse inside your tablet

Hello, I used old 7″ tablet (plus some circuit made by myself) as interface for house thermal control. The problem is that when I’m on the sofa and want to manual change some parameter, I must leave the sofa (and the cat) and go to the tablet, then press the buttons on touchscreen and change what I want. Now, I noticed that in this tablet there are 4 free pads for connection of USB camera. This tablet was developed for supporting dual camera, but in this arrangment there is only the CMOS one, so the USB isn’t used ; well, I decided to use the free USB pads to connect a wireless mouse !
Gone in a supermarket and purchased (expensive) 9,90 Euro wireless mouse. The miniaturized USB receiver is shown in the picture :

Wireless mouse USB receiver – new, never used

Ok : as first operation I removed the metallic chassis, to gain access to the contacts; the receiver now look as in this picture :

Oops, it has lost the metallic chassis 🙂

Now, I soldered the four wires necessary to connect to the tablet as you can see on next picture :

And now someone attached 4 wires…

Ok, now the last operation is to solder the wires to the main board. Look at the next picture :

Ok, wires connected to the pads (also 2 resistors have been added to mainboard)

OKAY, all right, turn on and… it doesn’t work 🙁

Ok, I have some schematic found on the Internet, so a quick look shown me that there are two missing resistors on CS: R141 and R144. The first one is just a jumper (0 Ohm resistor), while the second is a 100K resistor. I soldered both of them on the circuit and started again turning on…  et voilà, now it works  🙂

I have a wireless mouse inside my tablet. Now I can access my program by the sofa, ‘cause I used wide controls on the screen, for my application, and I can see them at (relatively) long distance…

Hope this will be useful for someone…

MIDI OUT for cheap tablets

midiout di robotop

Hello, I realized a really cheap and small MIDI OUT interface that can work with low-cost tablets (mine is based on WM8650 processor). Just for testing purposes, I also realized a Drum-Pad application that can play four different sounds if attached to standard Midi Expander. I used, in my test, a VERY old Roland SC-7 Expander with standard drum set. There are no problems to expand the number of pads ( until you fill the screen size ! ). At the moment I used only four as: Bass Drum, Snare Drum, Crash Cymbal and Open Hi-Hat. My circuit isn’t supported by ANY program, I have written the application using my own library and the supported MIDI commands are (actually) only NOTE ON, NOTE OFF and PROGRAM CHANGE. I probably will design a printed circuit board for making a “kit” for this device and also I’m planning to write some easy App to “play” with music. Obviously, at this first stage, this CAN’T be considered a professional tool, but can give some interesting opportunities to our low cost tablets.

Here is a picture of the device: (click to enlarge)

The program running…


I did it again: removable SPI flash II

Yes, I did it again… purchased a bricked tablet, can’t revive it in a “soft” way, so decided to make the SPI flash removable to rewrite it with the external programmer ( look at the previous version here ).

This time I used a normal DIL socket (8 pins) connected to the pads of original smd chip via 0.2mm enamelled copper wires. Obviously, that means now I need for a DIL 8 memory chip. I looked on the on-line Farnell catalog and found the AMIC A25L040-F chip with ordering code: 1907077 at less than 1 Euro per unit.
But “I can’t wait, I can’t wait, I will test the circuit immediatly”, so decided to adapt one small smd SOIC 8 memory chip on a standard 0.100″ DIL 8 socket to create a “Frankenstein” DIL 8 IC. Look at the results in the picture below… (click on images to enlarge)

The circuit (incredibly) worked and the tablet was revived. Yeah. A little problem, now… the tablet can’t close (mechanically) due to height of the 2 sockets stacked one over the other. Okay, this time I must wait for the right component, but in meantime I updated the tablet firmware with the UBEROID option 36 that worked after a little change in the command file wmt_scriptcmd. This tablet has 1024×768 screen and the script tried to open a 1024×600, locking the device. You can download my version of this script at this LINK (if interested to). Now, the specific IC is arrived and I executed a dump of the contents of working SPI flash (the “Frankenstein” one) on a bin file. After that, I programmed the new chip (the “normal” one) using that file as data source ; then mounted the DIL 8 chip into the socket, turn tablet on and… GO ! All working fine… Look below at the picture of new chip in the socket

Here is another picture (wide) of the board

Obviously, I modified the programmer’s circuit adding an 8 pin DIL socket to host the device under programming. Nothing difficult, just wired the pins to the correspondant signals of the existent SD card connector. Look on my other pages on this subject for additional infos.

My Android tablet has removable SPI flash

After two rom upgrades with wrong files, my tablet’s SPI flash was unable to run again a new upgrade, so I decided to create a removable SPI flash that can be reprogrammed externally. Now my tablet can’t be “bricked” anymore. If something wrong happens, I simply store a fresh copy of U-Boot and W-Load on the SPI flash and start again… (click on images to enlarge)

Well, I used a microSD adapter like this…

then, with small cutter I opened the adapter…

and soldered the small 8 pin SOIC spi-flash memory to the contacts, using 0.2mm enamelled wires.

After that, I closed the adapter using cyanoacrylate glue. The plastic over the memory was removed for making contact available for electrical inspection and thickness oversize.

Next step was to build a programmer using an SD card socket as connector. I used the same schematic you can find in my page here.

As final step, I soldered another SD card socket in the tablet, connecting the contacts to the pads of the removed IC with small 0.2mm enamelled wires. That’s all. After spi-flash reprogramming, the tablet started again looking for microSD card with the upgrade firmware.

TTL to RS232 interface 3 Volts powered

I realized this circuit for serial communications with my tablet. It converts signals from the 3.3V levels and logic used in the tablet to standard RS232 for the PC or USB to RS232 interfaces. It is directly powered from the tablet’s dongle, as sown in the picture. The IC used may be MAX3232 or ST3232 or similar from other sources. Such ICs are suited for operating voltage of 3 Volts. I connected my PC to a cheap tablet based on WM8650 processors and it worked very well. Please, note that the RX and TX wires must be crossed in this application !

This is the PCB I designed for the circuit. It’s available as PDF and can be printed in 1:1 scale on transparent film (even with laser printer) for use with photosensitive copper boards.

The original 1:1 PDF can be downloaded here .

In the low-res picture below you can see the electric diagram for the circuit. A hi-res PDF of the same schematic can be downloaded here .

Do it before modding your tablet !

This is not a suggestion to have nice time with your girl-friend (or droid-friend, freely choose) but a smart way to operate when going to change your tablet from the “usual” Android to the “excellent” Uberoid. I have seen so much posts, in the HCH TechKnow forum, with messages like “help me, I just upgraded my tablet and now it autonomously speaks in ancient languages even if turned off”. Stop it, let we operate in a smart way. Prior to change, we must know what are we changing. Don’t post messages like “my tablet doesn’t work; it has -probably- a 7 inches screen, help me”, but change your approach. Your tablet is a complex machine, it looks like a toy, but has very sophisticated solutions inside it.

Your tablet COMMUNICATES with you, in its manner, but you can’t see the messages until the display goes on and the user-interface fully starts. BUT… there is some initial activity that is very, very interesting to indagate. I’m speaking about the U-boot.
The U-boot, as all of you can remember, is an underwater… no, sorry, I’m confusing with my other job. Redo: the U-boot is the first program that’s executed by the processor which animates your tablet (in our specific case, the WonderMedia WM8650).

The U-boot has big potential, you can -really- make any sort of operations on your tablet’s core, but the full list of such possibilities is too big to be exposed in this small page. So I just want to point your attention to some commands.

Let’s start. First of all: where U-boot comes out ? And, how can I interact with the program ? Good questions (I like to say to myself I pose good questions).
The answer is that you can’t see the U-boot activity without a little hardware and some software ; both of them are easily available. Note that the time you can lose with this preliminaries, will be widely balanced by that you can spare avoiding to brick your tablet with wrong rom upgrade.


We need to look at the U-boot messages that are sent to the system serial port. Even if you can’t see any connector, the serial port is ALWAYS present on such tablets (for this generation). Now, the first operation requires some hardware. You must find 3 basic signals: TXD, RXD and GND. These are, respectively, the serial output, serial input and common (ground) signals of ttyS0 peripheral (assigned by the system to the console device). Any tablet has its own arrangement. In my experience, all the tablets that have an external connector for USB and LAN has also pads for such signals in the same external box, while tablets having USB and LAN built-in, must be OPENED (mechanically) to gain access to the lines.

Look at the pictures posted below to some examples of serial port wires in tablets I have used for my embedded applications (click images to enlarge).

This is the expander for a 7″ tablet with 24 pin connector. Wiring is easy ‘cause there are 4 holes 0.100″ spaced. Soldering wires is easy and low probability to destroy pads for overheating.

This is the expander for a 9.7″ tablet with 30 pin connector. Wiring is a little bit more difficult ‘cause the pads haven’t holes; you must take care of overheating to not destroy pads.


Another model of expander for a 9.7″ tablet with 30 pin connector. Wiring is difficult due to small pads without holes. Be carefully, high probability of destroy pads for overheating or pulling of soldered wires. Use small, flexyble wires and apply some strong adhesive tape to mantain them in position and to protect pads from strapping.

Connections for a 10.1″ tablet that hasn’t external expander. The USB and LAN ports are inside, so you must mechanically open the tablet to gain access to the pads. You must follow the same rules as for previous model.

This image is very interesting ‘cause you connect the wires directly to the WM8650 CoreBoard, so this solution will be valid for about ALL the tablets based on it. Note that I used 4 wires, getting gnd, txd, rxd and +3.3V, so the power can be used to supply an external interface.


Now, the signals have to be connected to your PC to interact with the U-Boot. The processor serial port signal are swinging from 0 to 3.3 Volts in negative logic, while a standard serial port (RS-232) has typically -5 to +5 Volts signals in positive logic, so you can’t connect directly the tablet signals to the PC ones: you need for an interface to logic inversion and level translation.

At least, you have two chances: the first is my own circuit you can find in another my article here ; you have to build it by yourself, it isn’t for sale…

I noticed that my interface was added as part of zip file “kit for tablet unbricking” by the Uberoid guru HcH ! Thanks for considering this small hardware as a useful tool 🙂



With this interface you can connect a standard PC serial port ( or USB to RS232 adapter) to the tablet; in case you try an USB adapter, remember to disable the FIFO buffers or reduce anyway the latence of signals at the minimum using the device properties menu.

The second option is to buy this USB-Serial-TTL interface. I found it on ebay after the suggestion of a friend; it’s very cheap and (obviously) doesn’t requires any solder works. Just one problem: the shipping time from the Far Orient was 3 weeks, here in Italy. Even with this usb interface (that your PC discovers like a serial port) you will turn OFF the FIFO buffers or decrease the latency to the minimum.

Using my interface, you have to connect 4 wires: +3.3V, Txd, Rxd, Gnd (‘cause the circuit is powered by the tablet’s 3.3V), and must cross Txd and Rxd signals between tablet and interface (look at the project’s page for detailed pictures) ; with the commercial interface, you just have to connect Gnd, Txd and Rxd of the circuit to the correspondant signals of the tablet (NO crossing).


The software needed is simply a serial terminal. We have many different choises; under Windows the most famous is the HyperTerm, but in Win7 it has been removed (but why ?), so you must use somewhat different. Usually, I use RealTerm under Windows and CuteCom under Linux. There is, also, my own terminal, called miterm-en you can download from this link . The zipped file contains the executable, compiled for Windows (working in Win7) and the source file in FreeBasic, so, if you want, you can easily modify, expand, arrange and compile, for example, under Linux. FreeBasic is a GREAT free compiler available for Windows and Linux. It can be used for small programs like this, but even for huge and sophisticated programs. It’s fast, simple, compatible with old “Basic” dialects like GW-basic, Qbasic etc. and it’s FREE. I use it with the Geany editor (under Win7) and is one of the powerful instruments on my software workbench. In the picture below you can see the program screen at start. The default serial port is COM4, but if such port isn’t available on your system, the program asks you for a new available one. In the example, I typed in the com19, ‘cause is the port number assigned to the usb-serial-ttl interface.
The program simply writes on the screen what comes in from the serial input and puts on serial output what you type on the keyboard. There are only 2 “command” keys: the [Esc] for program terminate and the [Ctrl-R] for toggling on-off the logging of the received data on a disk file.

In the next screen you can see what happens if you type [Ctrl-R]: the recording starts on file named log_xxx.txt, where xxx is a number that increases every second (system timer).

Now, I have my serial port connected to the tablet (that’s actually turned OFF, not suspended, really OFF). Now, I press the power button and the tablet sends a lot of data to my PC, then asks to press any character to stop the autoboot (typically for 3 seconds, then the autoboot takes place). Ok, quickly pressed [cr], and the transmission stopped here…

As you can see, we have the WMT# prompt that indicates we can send commands to the U-Boot program, finally… But we still are recording to a log file, so stop now typing again [Ctrl-R]. If you look inside the last log_xxx.txt file, you can see all the messages sent from the tablet. Please, note that the txt file logs data as sent from the tablet, and this data is in Linux mode, so you can experience missing line breaks when using a Windows program like the Notepad as the viewer, but if you use Geanie or any text editor able to handle the Unix/Linux format, there are no problems. Now, type the question mark then [cr]. This is the alias for HELP, so you will receive a list of ALL possible commands you can execute with U-Boot. Here is what I received on my tablet :

?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
decompanima - decompress logo image to the dest position.
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
show    -
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatstore - store binary file to a dos filesystem
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imls    - list all images found in flash
imm     - i2c memory modify (auto-incrementing)
ims  - set i2c device context from memory
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
memory bit operation :
Format : mbit
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
  mmcinit 0 -- init mmc device 0
  mmcinit 1 -- init mmc device 1
mmcread - read data from SD/MMC card

   -read data from SD/MMC card block address 'block_num' on 'dev_id'
    to memory address 'addr' size is 'bytes'
mmcwrite - write data to SD/MMC card

   -write data to SD/MMC card block address 'block_num' on 'dev_id'
    from memory address 'addr' size is 'bytes'
mtest   - simple RAM test
mw      - memory write (fill)
nandrw  - NAND sub-system
nboot   - boot from NAND device
nfs - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
poweroff - wmt device power off.
printenv- print environment variables
protect - enable or disable FLASH write protection
randmac - generate a random MAC address and save to "ethaddr" environment variable
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdwaitins - wait sd card inserted or removed
sdwaitins 0 -- waiting removed
sdwaitins 1 -- waiting inserted
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
textout - show text to the screen
textout x y "str" color
color is 24bit Hex, R[23:16], G[15:8], B[7:0]
for example: textout 0 0 \"hello world\" FFFFFF
tftpboot- boot image via network using TFTP protocol
version - print monitor version

The command that can save us from a wrong rom upgrade is “printenv”. This command simply puts out the env list that actually is stored in your tablet. This is an example taken from my 9.7″ tablet. This tablet has been modded with Uberoid, but it works, so all the settings are right.

kernelargs=setenv bootargs mem=${memtotal} root=${filesystem-NAND_mtd} noinitrd rootfstype=yaffs2 rw console=ttyS0,115200n8 lpj=${lpj} ${android_bootargs} ${platform_bootargs} quiet
bootcmd=nandrw r ${kernel-NAND_ofs} 0x1000000 ${kernel-NAND_len}; if iminfo 0x1000000; then run kernelargs; bootm 0x1000000; fi; echo No kernel found
logocmd=nandrw r ${wmt.nfc.mtd.u-boot-logo} ${wmt.display.logoaddr} 10000; nandrw r ${wmt.nfc.mtd.u-boot-logo2} ${wmt.display.logoaddr2} 40000; nandrw r ${wmt.nfc.mtd.kernel-logo} ${wmt.kernel.animation.addr} 80000; display init force; decompanima -f ${wmt.display.logoaddr2} 0x3000000; decompanima -f ${wmt.display.logoaddr} 0x3000000
#=chg emilio next line - wmt.display.logoaddr2 550000
wmt.gpi.bat=[0:0:00020000:d8110040:d8110080:d8110000:d8110480:d81104C0][1:0:00000020:d8110040:d8110080:d8110000:d8110480:d81104C0][2:1:00010000:d8110040:d8110080:d8110000: d8110480:d81104C0]
##=chg emilio next line - wmt.vt160x.bat 0:1:10:0
#=chg emilio next line - 40 -30251 117186489 24194 22 -8405089 106502 -30251 117186489 24194 22 -8405089 106502
ver=U-Boot 1.1.4 (Aug 24 2011 - 10:14:10)

Environment size: 2945/65531 bytes

Note that in the row you have your tablet model, that’s more precise than say: “the green led with the black button and the gray case” etc. Also note the row that contains the touchpad calibration values. Don’t consider the rows in which you can read “emilio” ‘cause are experiments I did changing the default env_uboot file.
Look with attention to the values your tablet has built-in BEFORE trying to update the rom. A quick comparison with the contents of file env_uboot in the FirmwareInstall/env/ folder of the rom you have selected for modding can advice you if there is some incompatibility. Also, look inside the wmt_scriptcmd for some wrong parameter. The screen size for example, if wrong, can lock your tablet in the very first steps of upgrading process. The third and last step to do before a tablet upgrade, can be done without any hardware tool. You just need for a terminal program to run on the tablet, like the Android_Terminal_Emulator or others. Once installed the apk, run the terminal emulator on the tablet and execute the dmesg command, re-directing the output on a file, then save that file on the sdcard. You will have a list of the drivers and all was running in your tablet with the original rom. If you want to take a look to a dmesg.txt file coming from one of my tablets, click on this link (use the right mouse button and “save destination as” if you want to download a copy on your PC).

That’s all, for now. I hope this document can help someone to save time and to choose the right rom for making his tablet the best (with Uberoid 🙂


Android tablet standing

Note: for additional programs for CNC, look at this link.

My tablet asked me for relax. After many modding and electronic surgery, it said “papi, I’m tired, can you build something to stay on and relax ?” . And I took pen and paper and wrote the G-code for my hobby CNC machine.
After grrings and rrrumbles I produced the stand for my tablet that you can see on the attached pictures. Please, note that the wrong cut isn’t an error in the G-code: I did that cut after the control PC was turned off, using my hands as the controller… So you can easily understand that I’m not a good mechanic… My tablet appreciated my work and promised to automatically look on the Internet for free tickets to Cancun, Mexico to make me a present 🙂

The first side cut :

Both sides cut :

Stand mounted :

Tablet now relaxing 🙂

Now, the original drawings…

and a short video of the tablet stand while creating on my hobby CNC machine.

standcnc di robotop

A program to build the right SPI.BIN file for your tablet

I have had a bad experience in reprogramming the SPI flash of my tablet (a new one), due to wrong BIN file used (it was suited for ANOTHER tablet, with different RAM arrangement). After a couple of tries “in the blue”, I stopped working that way and decided to write my own software to merge the U-Boot.bin and the W-Load.bin that are in FirmwareInstall folder of specific update microSD, then create the right output BIN file to be used with external programmer for SPI flashing.

The SPI flash

SPI means Serial Peripheral Interface and “flash” is a particular type of memory, capable to be written (and rewritten) in fast mode and able to retain informations even if power supply is removed, so this kind of memory is part of the “non-volatile” devices.

What’s the purpose of SPI flash in our Android Tablet ? It’s like the (ancient) floppy disk in old computers. The floppy, in VERY old computers, was the device containing the Initial Program Loader, the first program the processor runs to start the whole system. In our tablets, the processor (I’m speaking about the WM8650, in this case) tries to load a boot program from this device. The SPI flash memory is small and simple device. Usually has 8 pins (contacts) and isn’t too miniaturized… it’s still at “human” dimensions and this is the reason we can remove it from the circuit, reprogram and resolder it on place. If your tablet is “bricked”, you can immediatly recover, simply restoring a valid boot program in it.
The hardware and the procedures for rewriting the SPI flash have been described in a very good article 🙂 by me on another page of my site, so, look around if interested in. But… what’s stored in the SPI flash of our tablet ?

There are two programs: the W-load and the U-Boot. The U-Boot can execute commands you supply via serial terminal or you have stored in the microSD, by means of the wmt_scriptcmd script file. U-Boot is the tool for handle the very low-level of your tablet. Btw, the NAND flash is another basic component of your system, ‘cause is your device’s HARD DISK. As in very old computers, the floppy loads the system skeleton and then the Hard Disk starts the programs with usual user interface (or GUI when is Graphical User Interface).

Ok, we turn ON the button, the processor starts, executes the program written in the W-load section. The U-boot then starts the system that’s on NAND memory and you have your tablet working.

When you try to unbrick your tablet rewriting the SPI flash, you must use the right version of U-Boot and W-Load, ‘cause if you choose a wrong version, all the process can’t start. A very important section (usually don’t mentioned) is the W-load program. There is a particular version for any RAM arrangment in your tablet. Not all the RAMs are the same: even if your “global” ram size is a certain number of MB, the rams can be arranged in different ways. For different arrangements, there are different W-loads.

How can I understand what’s my specific W-Load ?

You can take a look on the serial output that comes out from your tablet at power on. Obviously… you must do it before upgrading (and possibly bricking) your tablet ! The serial interface is a VERY powerful tool and I highly recommend to you to purchase (or build) one for modding and better understanding your tablet.
Look at this example :

WonderMedia Technologies, Inc.
W-Load Version :
wloader finish

U-Boot 1.1.4 (Aug 24 2011 - 10:14:10)
WonderMedia Technologies, Inc.
U-Boot Version : UPDATEID_0.
U-Boot code: 03F80000 -> 03FC3190  BSS: -> 03FCD724
boot from spi flash.
SF0: ManufID = 37, DeviceID = 3013 (Missing or Unknown FLASH)
Use Default - Total size = 8MB, Sector size = 64KB

There are some very useful infos: these are W-Load version and UPDATE_ID, U-Boot Version and UPDATEID. With such informations you can easily “build” your own SPI flash and it will be EXACTLY the one that fits your tablet. You also have infos on which type of SPI flash is mounted in the tablet. In the example before, the memory has ID 0x373013 (that is unknown to the system, so it starts with default values that are good for all memories).

How to build your BIN file for writing a new SPI flash.

Usually, the SPI flash has 512KB (kilobytes) space, but if you look on the datasheet it’s called a 4 megabit memory; that’s exactly the same, ‘cause 4Mbits = 512KBytes.
In our tablets, the SPI flash memory is divided into 2 areas: the first, starting at address 0x00000 and ending at 0x6FFFF (not fully used) is the U-Boot program; the second, starting at address 0x70000 and ending at 0x7FFFF (almost fully used) is the W-Load program.

I wrote a small program that can build for you the my-spi.bin file, the BIN file of 512KB you need to re-flash your SPI memory. The program is written in FreeBasic (under Windows), and doesn’t need for installation. Just decompress the .ZIP you can download from attachments in a folder, for example spi-flash and you have the executable to run.
In order to create your my-spi.bin file, you need, obviously, for the submentioned files u-boot.bin and w-load.bin. So, go to the FirmwareInstall folder of your Uberoid upgrade folder (or to the same folder of original rom) and copy the u-boot.bin you find there in the new created folder. For the w-load, you have (often) different file names that all starts with w-load prefix and finishes with .bin suffix, but the right file is the one has inside the same signature you have read in the serial terminal (in our example is UPDATE_ID_1_4_4_0_2_256MB_0150001). If you are in doubt, simply try copying all of them in your new folder and then rename it, one at a time, in w-load.bin. The program is “stupid” and looks for input files u-boot.bin and w-load.bin and produces as output my-spi.bin .
When you start the buildspi.exe, the program generates the output file and shows to video the actual versions of U-Boot and W-Load programs; if some of that versions isn’t the one you need for, simply load another and try again.

Once the file is created and the versions are both identical to the ones you read from serial terminal at the device boot, you have the right SPI file to program into the chip.

The executable file (zipped) can be downloaded here.

In the picture below, you can have a look to a working program screenshot. Hope this will help you.


Using SPI programmer to revive bricked Android Tablet

This mini-guide is based on the very useful software SPI FlashROM Programmer 1.9c (C) 2008-2011 by Martin Rehak. Look for SPIPGM.ZIP on author’s page here

This is my version of the programmer’s circuit. I just modified some resistor value from the original one.

More readable PDF can be downloaded here

I also developed a small printed circuit board, mainly for the ZIF socket pinout (it can’t be mounted on prototyping board with 0.1″ spacing).
The 1:1 scaled PDF can be downloaded here

And finally the fully populated board…

I used a ZIF TexTool socket from 3M (RS catalog code 766-980) and modified the resistor values from the original schematic. The reason for this change is to protect the device under programming, ‘cause the SPI flash memories are powered at 3V and the parallel port of PC may run at 5V. So, increasing the resistor values gives less current to the protection diodes built in the memory chip. In practice, the excess voltage coming from the parallel port falls on the resistor and the total current flowing thru the internal protection diode is (Vpp-Vcc) / R where Vpp is the voltage out from parallel port, Vcc is the flash IC supply (3V battery in this case) and R is the resistor placed between the parallel port and the IC. Note that the flash data output has lower value resistor: this is mandatory ‘cause the parallel port has pull-up resistors inside and therefore the LOW level (zero logical) coming from the flash IC makes partition with the series resistor and the pull-up, and rises in value. If the series resistor is too high, the LOW level goes in the zone that is considered UNSTABLE or HIGH for the parallel port input pin and your device will not work !!! Obviously, this means that the data-out pin is not protected as well as the other pins, but for occasional use it may be considered safe enough to operate. A better solution will be to add some level-translation logic. Note the copper band in the picture: it’s only to make easier to unplug the parallel port connector… don’t remove that connector pulling by the wires ! You easily have to solder them again…

Well, now I will describe the step-by-step procedure to program a flash IC with this programmer. You can download here a zip file containing some batch files I wrote to simplify the execution of every procedure’s step, plus a txt file that’s simply a copy of the help screen of the SPIPGM program.
Who needs for SPI flash programming ?
The man that has bricked his Android Tablet changing the wrong bytes with hex editor !
As me…

The last chance, in such horrible situation, is to reprogram the U-boot and W-load that are on the flash chip near the microprocessor. In my WM8650 based Android Tablet, that flash was the 25P40 from ST. It’s a SOIC 8 package, so isn’t too complicate to unsolder from the board. NOTICE: the IC will “die” when unsoldered, as mine did, but if you have the binary file needed to fill the new one, there will be no problems.
Note that in the batch file I used, as source for flash burning, one .bin file called 2711942B.bin ; this strange filename comes from a WM8650.bin I found on the Internet, renamed with the value of its CRC32 checksum. I did this ‘cause there are different binary files with the same purpose (reflashing Android Boot SPI), but in my specific tablet only the one with such CRC32 did the job. Obviously, you need to download the file somewhere (Edited: after some time, I realized a software tool that can build the right BIN file to be used to flash the SPI memory ; read full description in this article) and rename as mentioned to use the batch file without any modifications.
Oops, you also need for a flash memory IC to program 🙂
The original 25P40 from ST was impossible to find in my country, but an equivalent from Atmel is available in the Farnell catalog with code: 171 5441 (AT25DF041A-SSH-B). The component’s electronic signature is unknown for the SPI programmer, but works fine as generic Atmel. As the original one, this flash IC has 4 Megabits (512 KBytes) of reprogrammable memory and costs around 1 Euro for single piece.

Pay attention to static charges ! Connect your body to GND when handling IC

Now, let’s start to program the chip; follow this step-by-step sequence, please…

  • insert the IC in the ZIF socket with DB25 Printer Port Connector and 3V Battery Clip both disconnected !
  • connect the battery clip to the 3V battery pack with special attention to the polarity ! (reverse = destroy)
  • start the “identify.bat” batch file, still without connecting the programmer to the parallel port
(this initializes the parallel port outputs to a safe condition). Obviously, there are errors, ‘cause the programmer is still disconnected.
  • connect the DB25 to the parallel port and run again the “identify.bat” batch.

this time you can see the chip ID that is 1F4401h, that’s specific for the AT25DF041A, but not recognized by program for the type, only for manufacturer (Atmel), but it’s enough.

  • now, run the “unlock.bat” batch. This is necessary to enable the memory to accept writings.

even if the result is “failed”, the unlock has been done.

  • now erase the memory running the “erase.bat” batch. This is not needed for a new IC, but better to do it anyway…

this will take a couple of seconds if all right. If program terminates immediatly, there’s something wrong.

  • and now, run the “program.bat” batch…

the program doesn’t know this type of memory, so prompts for size in Kb; type 512 and go… (note that this step is skipped if the memory chip is fully recognized by the program)

programming has been executed (it will require a couple of minutes or less for the BIN file used).

  • finally, read the programmed flash contents running “dump.bat” batch. It will read the flash contents and store them to arbitrary file name rd_spi.bin ; this will be useful to compare the source file with this readout.

again the program doesn’t know this type of memory, so prompts for size in Kb; once more type 512 and go… (note that this step is skipped if the memory chip is fully recognized by the program)

operation complete… now use a binary file comparision to check if source and readout are equal (I suggest the great open source Frhed to do this job). In alternative you can compare the CRC32, MD5, SHA-1 of both files using the free program HashTab that integrates in Windows shell.

The flash IC is programmed, now follow this sequence to disconnect :

  1. with the IC still in the socket and the battery connected, detach the DB25 connector from the parallel port
  2. detach the clip connector from the 3V battery pack
  3. open the ZIF and get the programmed IC

The new IC has to be soldered in place of the older one. Normally, this isn’t too difficult, but my board pads for pins 5 and 6 were removed by excessive heat during desoldering. This can transform your tablet in a flat expensive electronic rubbish ensemble. I solved the problem using enamelled copper wire (0.2 mm) soldered directly to the PCB tracks and manteined in place by adhesive paper tape. It was very, very hard job. So, please, be patient and carefully remove the original IC from its solder pads. Any excess of heat can damage the chip (and this is not important) and the PCB (and this is terrific) !!! In the picture you can see the “wiring spider” that solved my problem. With this new flash boot and the UBEROID rom placed in the SD card slot, my Android Tablet was finally unbricked.

Added Jul,2,2012 :

I just built a small “tester” circuit that can be used in case of troubles with the programmer. If you can’t program your SPI flash, first of all test if your Parallel Port is really working under the Spipgmw program. The circuit proposed here, has to be connected to the parallel port of your PC. After attaching the circuit, please create a new batch file in the same directory you use for spipgm program and write this command inside:

spipgmw /r 0 16 /d=50000

When you launch this batch, if your parallel port is set correctly, you can see the green led that blinks fast (on my old notebook with 500MHz clock, it blinks at about 10 Hz). If the led DOESN’T BLINK or is always ON or always OFF, there is a problem on your parallel port or the program spipgmw can’t handle it in appropriate way. The parallel port pin 8 is the SCK signal for the programmer, while the pin 18 is GND.