Backup your SPI flash memory on SD card (Wm8505 – Wm8650 tablets)

The most important thing to do before attempting to change / upgrade / modify the default firmware for a tablet (we speak about the WM8505 / WM8650 models), is to create a backup of the internal SPI flash memory. The internal SPI flash memory is the hearth of a tablet. If you can rewrite it with original contents, you can always restore your tablet to the original state.

I highly recommend, for anyone wants to play this “game” with his own tablet, to build a serial interface, that is a basic, but powerful, instrument to “look” inside a tablet. There are many interfaces available to convert the 3.3V signals, present in the tablet, to RS232 levels, and other cheap circuits that directly connect 3.3V true logic from the tablet to USB port, that is seen as COM port from a PC. I suggest to use my own design circuit proposed on my page at this link, ‘cause is powered by the tablet itself, so it doesn’t introduce any voltage in the device input lines when the device itself isn’t powered on. I have had problems, with direct USB to TTL interfaces, due to the presence of positive voltages on transmitting side of the interface even if the tablet was off. So, please, build my circuit (it works !), or use one similar…

In the oldest tablet I own, the Evodroid Devo, based on WM8505 processor, there isn’t any “dongle” for the USB / LAN / Serial. There is just a mini plug for USB, but the serial port is always present inside the tablet. So, opening the case, you can solder the 4 wires needed for a serial terminal connection on the 4 pads as in the picture below :

The TXD is intended as tablet TXD, so is the output from tablet, while RXD is obviously, the data input to tablet.

Using a terminal emulator and the RS232 interface, we can make huge amount of tests and experiments. I recently updated my PC serial terminal program for some problems encountered on WM8505 tablets. In the new version, available for download at this link , I added the sequence “+++” ; if you quickly type this sequence on your PC keyboard, the terminal sends a Ctrl-C plus a CR to the tablet, stopping the autoboot (as default, U-Boot automatically starts the Linux Kernel and Android OS that are stored on tablet’s mass storage NAND flash).

Note that, for storing a copy of the internal SPI flash memory, you must insert a FAT32 freshly formatted microSD card in the tablet’s slot !

Well, if you have the serial interface connected to your PC, launch the terminal program, then turn on the tablet. You will see the W-load and the U-Boot messages ; immediatly type on the PC the +++ sequence (or type Ctrl-C and Enter if using another terminal program)… After a while the U-Boot will stop writing the command prompt WMT # ; the autoboot has been stopped and you can execute commands from the U-Boot provided set. Note that the U-Boot versions are different from one tablet model to another, but many commands are always available, even with small syntax differences. Here, I will describe the backups done from a relatively new 9.7″ tablet based on WM8650 processor, and from old 7″ Evodroid tablet (the one shown in the picture).

The first command to enter is the MMC initialization (MMC is the default name for the SD card), so we must type :

mmcinit 0

 (0 selects the first SD card in wm8650 tablet, that has 2 SD cards capability)

or simply :


 (in wm8505 that has only one SD card available)

We receive some messages from the tablet ; if all is OK, the MMC (SD) has been initialized and is ready to operate. Remember to use a FAT32 formatted one !

Now, we type the command :

cp.b FFF80000 0 80000

that means : copy bytes from address FFF80000 (the start of SPI flash memory) to address 0 (the start of RAM) for a length of 80000 bytes (that is hexadecimal, as all the data supplied), so 80000 is 8 * 64K = 512K bytes, the size of the whole SPI flash.

This operation will take a couple of seconds… then we have a copy of the whole SPI flash stored in system RAM. Now, we can use the powerful command “fatstore” to save that area to a binary file on the SD card :

fatstore mmc 0:1 0 backup.bin 80000

This command means : store a file on FAT system device mmc (our SD card), on partition 0:1 (the card is freshly formatted, so has just one partition : card 0, partition 1), reading data from RAM address 0, to a file named backup.bin, for a length of 80000 (hexadecimal) bytes. Note that in the wm8650 tablet I havent had any problem to execute this command, but in WM8505 there was something wrong while writing the SD card. The solution, was (simply) to substitute the original 4GB SD card previously used, with another one, a little bit older, sized just 128 MBytes ! That card was VERY OLD, it was in my LG cellphone by many years. So, if you have errors, try with another SD card, freshly formatted, of different type, brand or size.

When this operation terminates with success, you have a copy of your SPI flash stored on the SD card. This 512KBytes file has the U-Boot.bin, the Env_uboot.bin and the W-Load.bin files all in one. You can expand in 3 different files using my software tool that can be downloaded from this link. The zip file contains just one executable written in FreeBasic ; it does not require installation ; just deflate it in a new directory and copy in the same folder the spi.bin file you want to split ; at end of the process you will have u-boot.bin, w-load.bin and env_uboot files in the same folder.

Obviously, you can simply use the full file spi.bin file with an SPI programmer in case of tablet “hard bricked”.

To turn off the tablet, type the command :


or, if it isn’t recognized, simply press and hold the power button. Extract the SD card and read the contents with your PC. If you want, send the BIN file to my blog, using the file transfer form ; I will collect the different roms for future help requests… 🙂

7 Risposte a “Backup your SPI flash memory on SD card (Wm8505 – Wm8650 tablets)”

  1. Ray (UK) again,


    There is no stopping you at the moment, a new subject almost every day (good stuff).
    I am just about to purchase an IC from RS, to program the removable SPI. I can build the SPI file as you have shown me, however as I do not have the original files this would be a bit hit and miss.
    Could you please pass on a dump from the WM8505 tablet that you use to upgrade the memory, as this looks very similar internally to my own, from the pictures I have seen as above.

    Many thanks Ray

  2. Hello Ray,
    yes, I can’t stop ! While looking for a new employment I have many time to spend in experiments 🙂
    I will answer to your question about the SPI image file directly via private e-mail.

  3. Hi,

    Many thanks. for the file. I will look at this as soon as I have the required IC.
    I do understand your situation, I was made redundant, and spent 18 months looking for a new job.
    You have a good basis with this work to show a future employee your capabilities. I wish you luck.

    Many thanks


  4. Hello friend! do you have a copy of the env_uboot of other people? I semi-bricked mine, and sorta ressurected, but it will stay on the logo screen… and it boots normally, as the console says. thank you!

  5. Hello, actually, nobody has sent a “fresh” copy of spi.bin extracted from his “untouched” tablet. May be this is for the need of a serial terminal, that is a little bit technical for the “standard” tablet’s user. I’m planning to publish here a very simple script file to save on the microSD, that will automatically create a copy of internal boot memory. Anyway, very often, people reads suggestions for “what to do before modding”, AFTER having bricked the tablet 🙂
    If you can supply additional infos on your tablet, I can check if there is something useable in my actual docs. Also, if you can log all the activity of your tablet (taken from serial terminal) it can help to understand a little bit more… you can use the “file send” form on the right side of the page.

  6. Hi
    How may I send you the SPI file from my new and ‘untouched’ tablet? I am not sure of the make but it is an 8″ (—removed link—)
    and is very similar to my hard bricked Eken M008S V10 (9.7″).
    I have been using your advice on unbricking but hadn’t had any success with creating a suitable SPI.bin file that would wake it up. However, today, with the help of your webpage I managed to save the .bin from the 8″ and wrote it to the SPI flash chip of the M008S. (I have created an external socket on the M008S and program the flash with a stand alone programmer).
    I would be pleased to receive the original SPI.bin for the M008S, if it is available.



  7. Hello Tony, you can use the form at the right side of blog page (click the “Disordine” word to go to main page) to send your file. Please, first ZIP the bin file (and possibly add a text file with the CS board signature or a picture, or as many infos you can add), then send using the form.
    For the M008S I haven’t the original SPI.BIN, but have 2 different tablets sized 9.7 and running Uberoid. I just stored the spi.bin file got from one of them at this TEMPORARY link: — removed link — (I will delete the link from my blog after you confirm to have downloaded it). The printed CS board signature for my tablet is: WMS8151A. Hope the model is the right one; if not, I can try to get the spi.bin from the other model I own. Let me know what happens to your tablet and inform me after you downloaded the BIN.

I commenti sono chiusi.