f182a11f33
This quick and dirty utility allows to extract nand bootloader from raw 1st nand block dump. I post it mainly to somewhat document how BCH error correction engine of the rk27xx works. Change-Id: I37ca91add7d372e3576d2722afc946d0f08971a9
71 lines
3.3 KiB
Text
71 lines
3.3 KiB
Text
This is the collection of small utilities needed to hack Rockchip rk27xx
|
|
series based DAPs. This tools were tested on linux only.
|
|
|
|
|
|
rk27load
|
|
This directory contains tool which can send arbitrary image(s) to the device
|
|
in rockchip recovery mode (VID:PID 0x071B:0x3201).
|
|
|
|
The first image can not exceed 510 bytes (+2 bytes checksum) and entry
|
|
point is 0x18020e00. Usually this code is used to configure SDRAM controller.
|
|
One can use first stage image extracted from Rock27Boot.bin file (a bit
|
|
more sofisticated) or the one provided in rk27load/stage1 directory.
|
|
|
|
The second image is loaded at the begining of the dram (0x60000000)
|
|
and executed. For some reason (which is still unclear) the size of
|
|
2nd stage image is limited to about 3-4 kB.
|
|
|
|
You can find example of custom 2nd stage image in rk27load/stage2 directory.
|
|
The purpose of this image is to configure bulk transfer and allow to
|
|
load usercode without size restriction mentioned above (the max size
|
|
is 8MB actually). The entry point of usercode is 0x60000000.
|
|
|
|
You need libusb 1.0 + header files in order to compile this utility.
|
|
You need working arm-eabi crosscompiler in order to compile stage1/stage2
|
|
bootloader binaries (but You should have one already if You tinker whith this)
|
|
|
|
|
|
rkboottool
|
|
This directory contains tool which allows to extract (and decrypt) images
|
|
stored in Rock27Boot.bin recovery file.
|
|
|
|
|
|
rkusbtool
|
|
This directory contains tool which sends custom scsi commands to the
|
|
rockchip player.
|
|
|
|
You need libusb-1.0 + header files in order to compile this utility.
|
|
|
|
nandextract
|
|
This directory contains quick and dirty tool which allows to extract
|
|
nand bootloader from raw dump of the first nand block. The main reason
|
|
I post this tool is to somewhat document error correction scheme used by
|
|
rk27xx chip. The tool implements BCH error correction processing with
|
|
help of bch library taken from linux kernel (and slightly modified to
|
|
compile standalone). Error correction is SUPER important as the nands used
|
|
in cheap rk27 players have quite high error rates.
|
|
|
|
Nand controler in rk27xx chip implements hw BCH error correction engine.
|
|
The documentation is lacking so this info was obtained from RE and
|
|
various other sources.
|
|
The data on the nand is stored in 528 bytes long chunks - 512 bytes
|
|
of actual data followed by 3 bytes of metadata (used by FTL layer to mark
|
|
special sectors) followed by 13 bytes of BCH ECC. BCH algorithm
|
|
uses m=13, t=8 and primitive polynomial 0x25af. Special masking
|
|
is used such as empty sector (with all 0xff) gives all 0xff ECC bytes.
|
|
Quoting e-mail from Ivan Djelic (the author of bch lib in linux):
|
|
To summarize, the steps needed to compute the rk27xx ecc are the following:
|
|
1. Reverse bits in each input byte
|
|
2. Call encode_bch()
|
|
3. Reverse output bits in each computed ecc byte
|
|
4. Add a polynomial in order to get only 0xff ecc bytes for a blank page
|
|
For more details you need to read the code.
|
|
|
|
Another quirk is that rom loader assumes that there are 4 sectors in each
|
|
nand page. This is actually not true for newer nand chips with page size
|
|
bigger then 2k. That means that on newer 4k page chips only first half of
|
|
every page is used in nand bootloader area. This is for compatibility reasons
|
|
most probably.
|
|
|
|
Finally, every 512 bytes block of data is encoded with rc4 algorithm.
|
|
The key and routine were recovered from rk27xx rom dump by AleMaxx.
|