| Marcin Bukat | 8f4202d | 2011-05-30 21:10:43 +0000 | [diff] [blame] | 1 | This is the collection of small utilities needed to hack Rockchip rk27xx |
| 2 | series based DAPs. This tools were tested on linux only. |
| 3 | |
| 4 | |
| 5 | rk27load |
| 6 | This directory contains tool which can send arbitrary image(s) to the device |
| 7 | in rockchip recovery mode (VID:PID 0x071B:0x3201). |
| 8 | |
| 9 | The first image can not exceed 510 bytes (+2 bytes checksum) and entry |
| 10 | point is 0x18020e00. Usually this code is used to configure SDRAM controller. |
| 11 | One can use first stage image extracted from Rock27Boot.bin file (a bit |
| 12 | more sofisticated) or the one provided in rk27load/stage1 directory. |
| 13 | |
| 14 | The second image is loaded at the begining of the dram (0x60000000) |
| 15 | and executed. For some reason (which is still unclear) the size of |
| 16 | 2nd stage image is limited to about 3-4 kB. |
| 17 | |
| 18 | You can find example of custom 2nd stage image in rk27load/stage2 directory. |
| 19 | The purpose of this image is to configure bulk transfer and allow to |
| 20 | load usercode without size restriction mentioned above (the max size |
| 21 | is 8MB actually). The entry point of usercode is 0x60000000. |
| 22 | |
| 23 | You need libusb 1.0 + header files in order to compile this utility. |
| 24 | You need working arm-eabi crosscompiler in order to compile stage1/stage2 |
| 25 | bootloader binaries (but You should have one already if You tinker whith this) |
| 26 | |
| 27 | |
| 28 | rkboottool |
| 29 | This directory contains tool which allows to extract (and decrypt) images |
| 30 | stored in Rock27Boot.bin recovery file. |
| 31 | |
| 32 | |
| 33 | rkusbtool |
| 34 | This directory contains tool which sends custom scsi commands to the |
| 35 | rockchip player. |
| 36 | |
| 37 | You need libusb-1.0 + header files in order to compile this utility. |