[How To] Unpack and Repack for Custom Firmwares for Rockchip RK28xx

xaueious

Administrator
Staff member
Jul 9, 2010
3,483
436
This applies to the Archos 7 Home Tablet, Apad iRobot, or any other Rockchip RK2808/RK2808a devices.

Instructions are for use with Windows and Linux together.

First, download the generic RK2808 dev tool:
MydroidDevTool_v1.0CN+Apad_iRobot_0611.zip - apad-irobot - Rockchip SDK Update Flash and Package Tool Chinese (MydroidDevToolv1.0) with Apad iRobot 0611CN - Project Hosting on Google Code

To create Rockchip ROMs, you should start with a stock firmware. If the file is in update.img format, you need to unpack it using AFPTool.exe included with MydroidDevTool, in the folder 'rockdev'.

AFPTool allows you to create and unpack update.img files.

You can unpack images with afptool -unpack update.img folder_to_extract_to

After unpacking the image, you will be presented with update-script, parameter, and a bunch of .img files.

Here's a rundown:
kernel.img -> Linux kernel image
boot.img -> booting ramdisk and scripts to start Android
system.img -> contains the contents of the Android operating system
recovery.img -> recovery image you can boot, containing firmware flashing and data wiping capabilities
misc.img -> performs some unknown but necessary system operations

The only file we need to modify are typically system.img, and sometimes boot.img depending on what you are trying to do.
system.img, boot.img, and recovery.img are all cramfs file systems and can be unpacked with cramfs.

In Ubuntu, you need to install the packages:
Code:
sudo apt-get install cramfsprogs fusecram

A shell script I use to unpack system images is the following:
Code:
#!/bin/sh
mkdir system
sudo mount -t cramfs -o loop system.img  system
tar cvzf system.tgz system
sudo umount system
tar xzvf system.tgz

Run the script in a Terminal shell, and the contents will be extracted into system. Alternate you can find out how to run uncramfs.

You can perform the changes you like, and repack it with the following:
Code:
mkcramfs system system.img

boot.img and recovery are tricker because they require a special CRC appended at the end. Luckily, a Japanese Apad iRobot user reverse engineered the CRC (https://sites.google.com/site/naobsd/android-tablet/apad-irobot).

Unpacking is the same procedure as system.img, but when you pack, you need to run:
Code:
mkfs.cramfs -n v1.01 bootfs boot.img

This will generate a compatible boot.img file without a CRC, which still wont boot yet. So to add the CRC, I am still using the old method. You can find out the new method on naobsd's webpage.

Download genrkcrc.c:
Code:
/*-
 * Copyright (c) 2010 FUKAUMI Naoki.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <stdint.h>
#include <unistd.h>

uint32_t t[256] = {
    0x00000000, 0x04c10db7, 0x09821b6e, 0x0d4316d9,
    0x130436dc, 0x17c53b6b, 0x1a862db2, 0x1e472005,
    0x26086db8, 0x22c9600f, 0x2f8a76d6, 0x2b4b7b61,
    0x350c5b64, 0x31cd56d3, 0x3c8e400a, 0x384f4dbd,
    0x4c10db70, 0x48d1d6c7, 0x4592c01e, 0x4153cda9,
    0x5f14edac, 0x5bd5e01b, 0x5696f6c2, 0x5257fb75,
    0x6a18b6c8, 0x6ed9bb7f, 0x639aada6, 0x675ba011,
    0x791c8014, 0x7ddd8da3, 0x709e9b7a, 0x745f96cd,
    0x9821b6e0, 0x9ce0bb57, 0x91a3ad8e, 0x9562a039,
    0x8b25803c, 0x8fe48d8b, 0x82a79b52, 0x866696e5,
    0xbe29db58, 0xbae8d6ef, 0xb7abc036, 0xb36acd81,
    0xad2ded84, 0xa9ece033, 0xa4aff6ea, 0xa06efb5d,
    0xd4316d90, 0xd0f06027, 0xddb376fe, 0xd9727b49,
    0xc7355b4c, 0xc3f456fb, 0xceb74022, 0xca764d95,
    0xf2390028, 0xf6f80d9f, 0xfbbb1b46, 0xff7a16f1,
    0xe13d36f4, 0xe5fc3b43, 0xe8bf2d9a, 0xec7e202d,
    0x34826077, 0x30436dc0, 0x3d007b19, 0x39c176ae,
    0x278656ab, 0x23475b1c, 0x2e044dc5, 0x2ac54072,
    0x128a0dcf, 0x164b0078, 0x1b0816a1, 0x1fc91b16,
    0x018e3b13, 0x054f36a4, 0x080c207d, 0x0ccd2dca,
    0x7892bb07, 0x7c53b6b0, 0x7110a069, 0x75d1adde,
    0x6b968ddb, 0x6f57806c, 0x621496b5, 0x66d59b02,
    0x5e9ad6bf, 0x5a5bdb08, 0x5718cdd1, 0x53d9c066,
    0x4d9ee063, 0x495fedd4, 0x441cfb0d, 0x40ddf6ba,
    0xaca3d697, 0xa862db20, 0xa521cdf9, 0xa1e0c04e,
    0xbfa7e04b, 0xbb66edfc, 0xb625fb25, 0xb2e4f692,
    0x8aabbb2f, 0x8e6ab698, 0x8329a041, 0x87e8adf6,
    0x99af8df3, 0x9d6e8044, 0x902d969d, 0x94ec9b2a,
    0xe0b30de7, 0xe4720050, 0xe9311689, 0xedf01b3e,
    0xf3b73b3b, 0xf776368c, 0xfa352055, 0xfef42de2,
    0xc6bb605f, 0xc27a6de8, 0xcf397b31, 0xcbf87686,
    0xd5bf5683, 0xd17e5b34, 0xdc3d4ded, 0xd8fc405a,
    0x6904c0ee, 0x6dc5cd59, 0x6086db80, 0x6447d637,
    0x7a00f632, 0x7ec1fb85, 0x7382ed5c, 0x7743e0eb,
    0x4f0cad56, 0x4bcda0e1, 0x468eb638, 0x424fbb8f,
    0x5c089b8a, 0x58c9963d, 0x558a80e4, 0x514b8d53,
    0x25141b9e, 0x21d51629, 0x2c9600f0, 0x28570d47,
    0x36102d42, 0x32d120f5, 0x3f92362c, 0x3b533b9b,
    0x031c7626, 0x07dd7b91, 0x0a9e6d48, 0x0e5f60ff,
    0x101840fa, 0x14d94d4d, 0x199a5b94, 0x1d5b5623,
    0xf125760e, 0xf5e47bb9, 0xf8a76d60, 0xfc6660d7,
    0xe22140d2, 0xe6e04d65, 0xeba35bbc, 0xef62560b,
    0xd72d1bb6, 0xd3ec1601, 0xdeaf00d8, 0xda6e0d6f,
    0xc4292d6a, 0xc0e820dd, 0xcdab3604, 0xc96a3bb3,
    0xbd35ad7e, 0xb9f4a0c9, 0xb4b7b610, 0xb076bba7,
    0xae319ba2, 0xaaf09615, 0xa7b380cc, 0xa3728d7b,
    0x9b3dc0c6, 0x9ffccd71, 0x92bfdba8, 0x967ed61f,
    0x8839f61a, 0x8cf8fbad, 0x81bbed74, 0x857ae0c3,
    0x5d86a099, 0x5947ad2e, 0x5404bbf7, 0x50c5b640,
    0x4e829645, 0x4a439bf2, 0x47008d2b, 0x43c1809c,
    0x7b8ecd21, 0x7f4fc096, 0x720cd64f, 0x76cddbf8,
    0x688afbfd, 0x6c4bf64a, 0x6108e093, 0x65c9ed24,
    0x11967be9, 0x1557765e, 0x18146087, 0x1cd56d30,
    0x02924d35, 0x06534082, 0x0b10565b, 0x0fd15bec,
    0x379e1651, 0x335f1be6, 0x3e1c0d3f, 0x3add0088,
    0x249a208d, 0x205b2d3a, 0x2d183be3, 0x29d93654,
    0xc5a71679, 0xc1661bce, 0xcc250d17, 0xc8e400a0,
    0xd6a320a5, 0xd2622d12, 0xdf213bcb, 0xdbe0367c,
    0xe3af7bc1, 0xe76e7676, 0xea2d60af, 0xeeec6d18,
    0xf0ab4d1d, 0xf46a40aa, 0xf9295673, 0xfde85bc4,
    0x89b7cd09, 0x8d76c0be, 0x8035d667, 0x84f4dbd0,
    0x9ab3fbd5, 0x9e72f662, 0x9331e0bb, 0x97f0ed0c,
    0xafbfa0b1, 0xab7ead06, 0xa63dbbdf, 0xa2fcb668,
    0xbcbb966d, 0xb87a9bda, 0xb5398d03, 0xb1f880b4,
};

int
main(void)
{
    uint32_t i;
    uint8_t c1, c2;

    i = 0;

    while (read(STDIN_FILENO, &c1, 1) == 1) {
        c2 = (i >> 24) & 0xff;
        c2 ^= c1;
        i <<= 8;
        i ^= t[c2];
    }

    c1 = (i >> 0) & 0xff;
    write(STDOUT_FILENO, &c1, 1);
    c1 = (i >> 8) & 0xff;
    write(STDOUT_FILENO, &c1, 1);
    c1 = (i >> 16) & 0xff;
    write(STDOUT_FILENO, &c1, 1);
    c1 = (i >> 24) & 0xff;
    write(STDOUT_FILENO, &c1, 1);

    return 0;
}

Compile it (gcc -o genrkcrc genrkcrc.c) and make genrkcrc executable.

Now put boot.img in the same folder and run:
Code:
./genrkcrc < boot.img | cat boot.img - > bootCRC.img

Your outputted file in bootCRC.img is now a compatible boot image for your Rockchip RK2808/RK2808a device.

To complete this, you need to reboot to Windows and replace the files in the SDK under /rockdev/ with what you have unpacked. Then within /rockdev/Image, replace the .img files you have modified. At this point you may choose to pack the firmware into a new update.img by running mkupdate.bat in /rockdev, or by flashing it directly to your device using the tool RKAndroidTool.exe

FOR RK2818, the only difference is that you should sign system.img as well, and use AFPTool for RK2818 to package the firmware instead of AFPTool for RK2808
 

probbiethe1

Super Moderator
Staff member
Jun 30, 2010
1,838
139
i have been reading through all of your tutorials and they are great, you are full of information
 

greenfrog

Member
Aug 11, 2010
17
0
Is it possible to add GPSD to Android, so I can connect my USB GPS dongle and use ANDNav2?

I have the img file for my Blue LED Tablet.

Thanks
 

xaueious

Administrator
Staff member
Jul 9, 2010
3,483
436
Not sure how that's done, but you might try compiling a kernel driver module for Linux kernel 2.6.25 for your particular GPS. But I am not sure what you need to initialize it after you insmod the driver module.
 

ZilverZurfarn

Member
May 3, 2010
133
8
Are there any size limits (of course there are!) for the images and if so, what are they? Specially, I'm playing with making my own boot splash, but initlogo.rle turns out slightly bigger than the one you have in your 1.3.2 aPad rom (that I use as a starting point).
 

Himself

Member
Aug 18, 2010
2
2
Hi,

initlogo.rle can be of varying sizes, smaller is better for performance.

misc.img is used for reboot options for recovery, it's a bunch of zeros except for "boot-recovery" and "recovery.wipe_all", once it reboots and recovery is done, misc is cleared.

You can install wine from linux and use it to run makeupdate.bat, no need to reboot unless you have to recover from a bad flash.

system.img also has a crc added to the end of it, but apparently it isn't enforced, it does no harm to add it in.
 

ZilverZurfarn

Member
May 3, 2010
133
8
Yeah,I figured as much, but when I ask about the size of images, I meant boot.img, system.img and so forth.
EDIT NM, I went ahead and built me a new slightly larger (221 vs 188 kB) boot.img and update.img with my heavier initlogo.rle - And wouldn't you know! It worked! Thanks xaueious and Himself. /EDIT
 
Last edited:

xaueious

Administrator
Staff member
Jul 9, 2010
3,483
436
I never bothered adding the crc to system.img. Never realized there was a crc. It was booting just fine so :D

My initlogo.rle is pretty heavy. It boots fine. The space allocated for boot.img is pretty big actually.
 

leo_usa

Member
Jan 17, 2011
3
0
Very nice guide! Thank you. I just got a new tablet running RK2818. I am wondering whether your guide will work for this new model?
 

RomanticEvil

Member
Oct 26, 2010
245
22
Nice! Though I don't have a Rockchip device at this moment I think at some point I'll have one, then this info will be of great importance! Thanks for sharing xaueious!
 

almafuerte

Member
Jan 17, 2011
1
0
Reboot to windows? What the hell? Android is a GNU/Linux-based operating system, but I need windows to update it? That is certainly weird.

I haven't touched a windows machine since 3.11 for workgroups, can I do the update from GNU/Linux?
 

ransagy

Member
Jan 31, 2011
7
0
Thanks for a great guide. I'm coming over from the HTC Desire modding world, Where im alot more familiar with the rooting and custom ROM making procedures.
Was a bit worried by what i read on these devices, Encryption, various images and partitions, etc. Nice to see it might not be as complicated as i thought.

Anyway, I'm going to take my uncle's RAmos T11AD and give it unicode fonts so he can view Hebrew on them. That one has a RK2818 chip.

1) Do I follow this guide or the one over at Archos for the Home tablet?
2) You mention using some *nix tools to mess with cramfs and the CRC checks for boot, etc. Is there a Windows alternative or should I just grab a Ubuntu LiveCD/VM and use that?

Thanks!
 
Last edited:
Top