TCC8803 FwTool disassembled - a hope for bricked touch screens

[madman_xxx]

Hello,

Yes, I'm another idiot, who bricked the touch screen by using the wrong tool... And that's how it started.
I disassembled the infamous FwTool that comes with Coby Kyros MID7022, EM73, Lark 70.2 and other tablets with Telechips TCC8803 and capacitive touch screen (based on SIS9209 chip). What I found until now:

• FwTool uses a native library (SiS810IOjni) to communicate with TS over I2C
• This library offers a few methods, like reading EEPROM, writing, screen recalibration

Now, more about EEPROM structure (names come from disassembled code):

• Bootloader part 2: 0 - 12287 (12288 bytes)
• Bootloader part 1: 12288 - 16383 (4096 bytes)
• Phase 2: 16384 - 20479 (4096 bytes)
• Phase 1: 20480 - 32767 (4096 bytes)
• ZEUS: 32768 - ? (length determined by "flash_file_size - 32768")

The writing process itself doesn't disassemble too well unfortunately, but there are some known things:

• The order of flashing inside FwTool is Phase 2, Phase 1, ZEUS, Bootloader part 1, Bootloader part 2
• The write itself consists of RESET, WRITE_HEADER, QUERY, RESET, WRITE. This is not necessarily the proper order (bad disassembly).

Now, I'm still playing with FwTool and reverse-engineer it, but in a while I will need help from someone from the community, to provide me with the EEPROM image from their tablet, downloaded with my own application (under development). Don't worry, it will only READ memory, no writing. Anyone willing to help, please let me know. Any comments or feedback is highly appreciated.

Also, the whole process was done by me, but there is a post on another forum (Coby Kyrosw Mid7022 Touchscreen doesn't work [Archive] - xda-developers) where some other forum member tried to do this, but obviously didn't finish.

 

[djathom]

hey madman as i see, nobody is interested by testing, reading or even putting a finger on the fwtool icon on a working ts kyros (OBVIOUSLY). like i said at xda-developers, im out of time to spend with fwtool, however i have a working ttc8803 that is pleased to help rescuing her sister´s TS...
im now working in a i2c sniffer (for another project). i hope it can be used to understand whats going on between cpu board an ts board (HARD-LEVEL)
so if you have any app to test on a working ts just post-it here so i can download and install...
(please try to make sure that your app will not brick the working ts. otherwise we will not have any way to keep on testing )

 

[madman_xxx]

I did some further research, which started with buying a working touchscreen But without a memory map of the device I can do nothing... Please refer to this post in the future:
TCC8803 FwTool disassembled - a hope for bricked touch screens - xda-developers