Yes, I'm another idiot, who bricked the touch screen by using the wrong tool... And that's how it started.
I disassembled the infamous FwTool that comes with Coby Kyros MID7022, EM73, Lark 70.2 and other tablets with Telechips TCC8803 and capacitive touch screen (based on SIS9209 chip). What I found until now:
- FwTool uses a native library (SiS810IOjni) to communicate with TS over I2C
- This library offers a few methods, like reading EEPROM, writing, screen recalibration
Now, more about EEPROM structure (names come from disassembled code):
- Bootloader part 2: 0 - 12287 (12288 bytes)
- Bootloader part 1: 12288 - 16383 (4096 bytes)
- Phase 2: 16384 - 20479 (4096 bytes)
- Phase 1: 20480 - 32767 (4096 bytes)
- ZEUS: 32768 - ? (length determined by "flash_file_size - 32768")
The writing process itself doesn't disassemble too well unfortunately, but there are some known things:
- The order of flashing inside FwTool is Phase 2, Phase 1, ZEUS, Bootloader part 1, Bootloader part 2
- The write itself consists of RESET, WRITE_HEADER, QUERY, RESET, WRITE. This is not necessarily the proper order (bad disassembly).
Now, I'm still playing with FwTool and reverse-engineer it, but in a while I will need help from someone from the community, to provide me with the EEPROM image from their tablet, downloaded with my own application (under development). Don't worry, it will only READ memory, no writing. Anyone willing to help, please let me know. Any comments or feedback is highly appreciated.
Also, the whole process was done by me, but there is a post on another forum (Coby Kyrosw Mid7022 Touchscreen doesn't work [Archive] - xda-developers) where some other forum member tried to do this, but obviously didn't finish.