Analysis of Scroll Essential 2

[moussevic]

Hi guys,

I have a Scroll Essential 2. Got it for good price with aim of turning it into a custom photo-frame/skype device. So, some serious changes to the Android bring-up process are required.

I've been looking at it's innards for a few days now.

/proc/cpuinfo:

Code: Select all

Processor       : ARMv7 Processor rev 2 (v7l)
BogoMIPS        : 1001.88
Features        : swp half thumb fastmult vfp edsp neon vfpv3
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x3
CPU part        : 0xc08
CPU revision    : 2

Hardware        : sun5i
Revision        : a13a
Serial          : 0201d94131373030504b503116254155

/proc/partitions:

Code: Select all

major minor  #blocks  name

  93        0      26384 nanda
  93        8      16384 nandb
  93       16      32768 nandc
  93       24     524288 nandd
  93       32    1228800 nande
  93       40      16384 nandf
  93       48      32768 nandg
  93       56     262144 nandh
  93       64     262144 nandi
  93       72    5445872 nandj
179        0     976896 mmcblk0
179        1     976831 mmcblk0p1

Explanation of nand partitions, got from kmsg:

Code: Select all

The 0 disk name = bootloader
The 1 disk name = env
The 2 disk name = boot
The 3 disk name = system
The 4 disk name = data
The 5 disk name = misc
The 6 disk name = recovery
The 7 disk name = cache
The 8 disk name = databk
The 9 disk name = UDISK
The 9 disk size = 10891744

I've uploaded the most interesting bits:
bootloader (nand partition 0)
https://www.dropbox.com/s/j8oi0g75i9fdpq7/nanda.img

environment (partition 1)
https://www.dropbox.com/s/7wln5a7diqai6ca/nandb.img

boot img (partition 2, containing kernel and initrd)
https://www.dropbox.com/s/di8p8h1yixxsa6y/nandc.img
To save you some work, the initrd starts at the 18352 sector (1 sector = 512B).
The size is 1008304 bytes.

The recovery kernel is identical to the boot kernel (bit for bit) so I've only uploaded the initrd (cpio archive)
https://www.dropbox.com/s/5iv4hm3tabmg7 ... ery_initrd


Some initial observations:
1. The contents of the boot image are strange. According to the format (mkbootimg header) the kernel comes to >9MB. Also, it doesn't look like a kernel.

2. I can't get the darn thing into a recovery mode where options can be selected. I get to the Android with open belly image, but there are no options to select. ADB reports the device in recovery mode, but there's nothing I can do. Fastboot doesn't work either.


What I'm looking for is:
- retrieving the kernel binary, so I can have the original backed-up
- putting a recovery mechanism in place, so I can re-flash in peace.

At the moment I'm trying to install the shell in the recovery initrd and hope I can run the recovery executable (in sbin/ in the recovery initrd).

Hope this gets the ball rolling.

Best,
moussevic

[suggsy89]

In terms of the OS it looks like it is the same as an Extreme.

When you get to the Android guy, press the "menu" key

Hows about of a dump of nandd...the system partition could cook a flashable rom then but just a thought

[moussevic]

Unfortunately there's no menu button

The system image is ~ 500MB. Sure, I can upload it. But is there anything specific that you need from it? Maybe I can upload only bits. By uplink is slooooow....

Any ideas on the kernel? When you said the OS is like the Extreme, was that the kernel you were talking about?

[suggsy89]

Okay, just try the volume keys... With regards to the recovery, you will not get many options, only to factory reset or flash a signed update.zip

nandg is your recovery, dump that and upload it, i can try it and if it works on my tablet..
I have the Excel and an Extreme clone, you could then just try to flash a version of Clockwork Mod Recovery.

Just dump everything first and make a copy on your PC somewhere safe.

Well i dont need anything specificly no, but a full dump of the system, bootloader and boot is needed to make a rom.

The kernel is a kernel and cannot me modded as such... so what are your intentions here if i may ask ?

[suggsy89]

This is the difference between your "boot.img" and mine... please bear in mind i am running a custom build.
They are almost identical.
I dont know how good you are regarding Android and Linux so please forgive me if you already know.

Code: Select all


Jellybean Boot Info

Working folder's boot.img information
-------------------------------------

Kernel Size                : 8581476 bytes
Kernel Base Address        : 0x40000000
Ramdisk Size               : 183340 bytes
Ramdisk Load Address       : 0x41000000
Second Stage Size          : 0 bytes
Second Stage Load Address  : 0x40f00000
Page Size                  : 2048 bytes
ASCIIZ Product Name        : (None)

Command Line: "console=ttyS0,115200 rw init=/init loglevel=8"

**********************************************************************************

Essential 2 Boot Info

Working folder's boot.img information
-------------------------------------

Kernel Size                : 9393996 bytes
Kernel Base Address        : 0x40000000
Ramdisk Size               : 1008304 bytes
Ramdisk Load Address       : 0x41000000
Second Stage Size          : 0 bytes
Second Stage Load Address  : 0x40f00000
Page Size                  : 2048 bytes
ASCIIZ Product Name        : (None)

Command Line: "console=ttyS0,115200 rw init=/init loglevel=5"






[moussevic]

Alright. Will try to upload it.

With regards to the kernel - its size is quite unusual - 9MB!!! Plus there's no distinguishable header on it.

My intention is to replace the Android init with a custom one. I want to see if I can run a simple Linux environment where I can run some apps, like a photo frame and a custom Skype app (using the Skype devkit). So no kernel mods... I wouldn't be dreaming of that anyway

Here's the recovery image. I'll upload the system tomorrow.
https://www.dropbox.com/s/c4aqlhlpc9acnvf/recovery.img


Cheers,
moussevic

PS. Just saw your latest post. So your kernel is also quite big. They probably shoved all the modules in there. Thanks!

[suggsy89]

I wouldnt say the kernel is an unusual size but i am no expert

Here is the file structure of your boot.img, the ramdisk is shown, the kernel itself is on its own in "boot-extracted" named simply as Zimage.
You could customise these files here as much as you want, but obviously if something you do is wrong, you will boot-loop as you may already know.



The "modules" you speak of (that match the kernel) are located in the "system" directory not in the boot.img.
The directory is something like "system/vendor/modules"

Uhm, good luck

[suggsy89]

Oh here is an interesting fact also - It seems that the hardware is from a Gpad-M758a as thats what Windows 7 told me when i booted up to recovery just after i flashed yours.

[moussevic]

Hi suggsy,

Thanks for the info.

Here's the link to the system image (compressed):
https://www.dropbox.com/s/d3tzzdhpucx76lf/system.bz2

So I take it the recovery worked with your tablet, which would mean that the CWM recovery should work with mine. Would you be able to send me that file, please?

Your kernel, when you do a "file" command on it, do you get the "Linux kernel..." result, or just "data"? I get data for mine.
I think it's quite big. My Linux kernel is <3MB and that's the situation for most kernels I've worked with. They could have compiled some of the modules as part of the kernel, hence the size, but who knows...

I've downloaded the sources for the kernel from
https://github.com/linux-sunxi/linux-sunxi
and if I have time I'll compile it to see what the deal is.

All the best,
moussevic