This is the collection of small utilities needed to hack Rockchip rk27xx
series based DAPs. This tools were tested on linux only.
rk27load
This directory contains tool which can send arbitrary image(s) to the device
in rockchip recovery mode (VID:PID 0x071B:0x3201).
The first image can not exceed 510 bytes (+2 bytes checksum) and entry
point is 0x18020e00. Usually this code is used to configure SDRAM controller.
One can use first stage image extracted from Rock27Boot.bin file (a bit
more sofisticated) or the one provided in rk27load/stage1 directory.
The second image is loaded at the begining of the dram (0x60000000)
and executed. For some reason (which is still unclear) the size of
2nd stage image is limited to about 3-4 kB.
You can find example of custom 2nd stage image in rk27load/stage2 directory.
The purpose of this image is to configure bulk transfer and allow to
load usercode without size restriction mentioned above (the max size
is 8MB actually). The entry point of usercode is 0x60000000.
You need libusb 1.0 + header files in order to compile this utility.
You need working arm-eabi crosscompiler in order to compile stage1/stage2
bootloader binaries (but You should have one already if You tinker whith this)
rkboottool
This directory contains tool which allows to extract (and decrypt) images
stored in Rock27Boot.bin recovery file.
rkusbtool
This directory contains tool which sends custom scsi commands to the
rockchip player.
You need libusb-1.0 + header files in order to compile this utility.
e0024c9a71